Port 20000 — DNP3

• IEEE 1815 standard (2012 update)
• Unsolicited responses: RTU notifies the master of events on its own
• Secure Authentication v5: HMAC-SHA256, challenge-response
• IEC 62351-3 — TLS wrapper for DNP3
• Used by: PG&E, DTEK, Enel, national grid operators

# Scan DNP3
$ nmap -p 20000 --script dnp3-info 192.168.1.10

# Python (dnp3 library)
from pydnp3 import opendnp3
master = opendnp3.DNP3Manager(1)
channel = master.AddTCPClient("main", [opendnp3.IPEndpoint("10.0.1.1", 20000)])

• Modbus
• BACnet

The Distributed Network Protocol (DNP3) operates over TCP and UDP on port 20000, facilitating communication in SCADA (Supervisory Control and Data Acquisition) systems. Proper configuration is essential for optimal performance and security. Below are key configuration aspects to consider:

• Network Setup: Ensure that devices using DNP3 are correctly addressed within the network. Assign static IP addresses to devices to prevent communication issues.
• Transport Layer: Utilize TCP for reliable data transmission, as it ensures ordered and error-checked delivery. Configure your network firewall to allow traffic on port 20000.
• Device Configuration: Each DNP3 device must be configured with the correct parameters, including the role (master or outstation), link layer settings, and event reporting parameters.
• Security Measures: Implement Secure Authentication v5 (IEC 62351) to enhance security. Although it adds HMAC for message integrity, consider using a TLS tunnel for encryption, as DNP3 does not support encryption natively.

By carefully configuring these aspects, you can minimize vulnerabilities and ensure efficient communication within your SCADA infrastructure.

When considering industrial protocols for SCADA systems, DNP3 and Modbus are among the most widely used. While both serve similar purposes, they have distinct features that can influence your choice. Here’s a comparative analysis:

• Data Handling: DNP3 supports event-driven communication, allowing unsolicited responses from devices based on events, whereas Modbus primarily employs a request-response model. This makes DNP3 more efficient in real-time applications.
• Data Types: DNP3 can handle a wider range of data types, including binary inputs, analog inputs, and counters, providing more flexibility in monitoring and control compared to Modbus.
• Time Synchronization: DNP3 includes built-in time synchronization capabilities, enabling devices to maintain accurate timestamps for events. Modbus lacks this feature, which can hinder time-sensitive applications.
• Security Features: DNP3 has integrated security protocols (IEC 62351) to secure communications, while Modbus requires external measures for security, such as VPNs or firewalls.

Ultimately, the choice between DNP3 and Modbus will depend on your specific application requirements and the complexity of the SCADA system being implemented.

To effectively utilize DNP3 over port 20000, various commands and configurations can be employed to manage and monitor devices. Below are practical examples:

• Configuring a DNP3 Master: Use the following command to set up a DNP3 master device:

• Creating a DNP3 Outstation: To configure an outstation, the command is:

• Testing Communication: Use the following command to test communication between the master and outstation:

These commands allow for the configuration and testing of DNP3 devices, ensuring that they can communicate effectively over port 20000. Regular testing and monitoring are advised to maintain system integrity and performance.