I was trying to capture dnp3 exchanges using wireshark but failed. Read some email and tried “decode as” and filters but did not work. How can I capture dnp3 over tcp or ip exchange using wireshark?
I capture and inspect DNP3 traffic almost daily so Wireshark in general has no issue with this.
The IANA allocated port for DNP3 traffic is 20000 and this is set as the default port in the dissector preferences.
If your traffic isn't using 20000, you can use Decode As.... to set DNP3 as the dissector for the port in use.
Is it possible your traffic is in some kind of encrypted tunnel, e.g. over a VPN or TLS connection? Can you share a capture on a public share and post a link to the capture in a comment?
Comments