Wireshark interpretation of DNP3

431 views

Skip to first unread message

Kiran Anand

unread,

Aug 8, 2016, 10:14:07 AM8/8/16

to automatak-dnp3

OK, this is not strictly an opendnp3 question but since there are networking gurus here, I thought I might take a chance and post this? please forgive if this is improper.

DNP3 protocol uses TCP destination port number of 20000 for its traffic. I am setting this destination port in my SharpPCap packet and I can see it successfully received in my set up. However in Wireshark the protocol field never gets set to DNP3 but is always set to TCP.

Now, when I use System.Net.Sockets to build and send DNP3 packets inside TCP packets, Wireshark labels the protocol field as 'DNP3' correctly.

It looks like I need to do something more to my SharpPCap DNP3-TCP packet to force Wireshark to set the protocol field and I need to know what that is. I have included a screen capture of the comparison of the TCP content of both packets in this link. Any help would be great.