Display Filter Reference: Distributed Network Protocol 3.0

Protocol field name: dnp3

Versions: 1.0.0 to 2.6.1

Back to Display Filter Reference

Field name Description Type Versions
dnp.application_chunk Application Chunk Sequence of bytes 2.0.0 to 2.2.15
dnp.crc_failed Expert Info Label 2.0.0 to 2.2.15
dnp.data_chunk Data Chunk Sequence of bytes 2.4.0 to 2.6.1
dnp.data_chunk.CRC Data Chunk checksum Unsigned integer, 2 bytes 2.4.0 to 2.6.1
dnp.data_chunk.CRC.status Data Chunk Checksum Status Unsigned integer, 1 byte 2.4.0 to 2.6.1
dnp.data_chunk_len Data Chunk length Unsigned integer, 2 bytes 2.4.0 to 2.6.1
dnp.hdr.CRC.status Data Link Header Checksum Status Unsigned integer, 1 byte 2.4.0 to 2.6.1
dnp3.addr Address Unsigned integer, 2 bytes 1.12.0 to 2.6.1
dnp3.al.2bit Value (two bit) Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.aiq.b0 Online Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b1 Restart Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b2 Comm Fail Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b3 Remote Force Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b4 Local Force Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b5 Over-Range Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b6 Reference Check Boolean 1.0.0 to 2.6.1
dnp3.al.aiq.b7 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.ana Value (16 bit) Signed integer, 2 bytes 1.0.0 to 2.0.16
dnp3.al.ana.double Value (double) Floating point (double-precision) 2.2.0 to 2.6.1
dnp3.al.ana.float Value (float) Floating point (single-precision) 2.2.0 to 2.6.1
dnp3.al.ana.int Value (16 bit) Signed integer, 2 bytes 2.2.0 to 2.6.1
dnp3.al.anaout Output Value (16 bit) Signed integer, 2 bytes 1.0.0 to 2.0.16
dnp3.al.anaout.double Output (double) Floating point (double-precision) 2.2.0 to 2.6.1
dnp3.al.anaout.float Output Value (float) Floating point (single-precision) 2.2.0 to 2.6.1
dnp3.al.anaout.int Output Value (16 bit) Signed integer, 2 bytes 2.2.0 to 2.6.1
dnp3.al.aoq.b0 Online Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b1 Restart Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b2 Comm Fail Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b3 Remote Force Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b4 Local Force Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b5 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b6 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.aoq.b7 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b0 Online Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b1 Restart Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b2 Comm Fail Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b3 Remote Force Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b4 Local Force Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b5 Chatter Filter Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b6 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.biq.b7 Point Value Boolean 1.0.0 to 2.6.1
dnp3.al.bit Value (bit) Boolean 1.0.0 to 2.6.1
dnp3.al.bocs Commanded State Boolean 2.0.0 to 2.6.1
dnp3.al.boq.b0 Online Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b1 Restart Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b2 Comm Fail Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b3 Remote Force Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b4 Local Force Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b5 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b6 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.boq.b7 Point Value Boolean 1.0.0 to 2.6.1
dnp3.al.cnt Counter (16 bit) Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.al.con Confirm Boolean 1.0.0 to 2.6.1
dnp3.al.count Count Unsigned integer, 1 byte 2.0.0 to 2.6.1
dnp3.al.ctl Application Control Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.ctrlstatus Control Status Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.ctrq.b0 Online Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b1 Restart Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b2 Comm Fail Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b3 Remote Force Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b4 Local Force Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b5 Roll-Over Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b6 Discontinuity Boolean 1.0.0 to 2.6.1
dnp3.al.ctrq.b7 Reserved Boolean 1.0.0 to 2.6.1
dnp3.al.da.double Device Attribute Double Value Floating point (double-precision) 2.6.0 to 2.6.1
dnp3.al.da.float Device Attribute Float Value Floating point (single-precision) 2.6.0 to 2.6.1
dnp3.al.da.int16 Device Attribute 16-Bit Integer Value Signed integer, 2 bytes 2.6.0 to 2.6.1
dnp3.al.da.int32 Device Attribute 32-Bit Integer Value Signed integer, 4 bytes 1.12.0 to 2.6.1
dnp3.al.da.int8 Device Attribute 8-Bit Integer Value Signed integer, 1 byte 1.12.0 to 2.6.1
dnp3.al.da.length Device Attribute Length Unsigned integer, 1 byte 1.12.0 to 2.6.1
dnp3.al.da.uint16 Device Attribute 16-Bit Unsigned Integer Value Unsigned integer, 2 bytes 2.6.0 to 2.6.1
dnp3.al.da.uint32 Device Attribute 32-Bit Unsigned Integer Value Unsigned integer, 4 bytes 2.6.0 to 2.6.1
dnp3.al.da.uint8 Device Attribute 8-Bit Unsigned Integer Value Unsigned integer, 1 byte 2.6.0 to 2.6.1
dnp3.al.da.value Value Character string 2.0.0 to 2.6.1
dnp3.al.datatype Data Type Unsigned integer, 1 byte 1.12.0 to 2.6.1
dnp3.al.file.auth File Authentication Key Unsigned integer, 4 bytes 1.6.0 to 2.6.1
dnp3.al.file.blocknum File Block Number Unsigned integer, 4 bytes 1.6.0 to 2.6.1
dnp3.al.file.data File Data Sequence of bytes 1.6.0 to 2.6.1
dnp3.al.file.handle File Handle Unsigned integer, 4 bytes 1.6.0 to 2.6.1
dnp3.al.file.lastblock File Last Block Boolean 1.6.0 to 2.6.1
dnp3.al.file.maxblock File Max Block Size Unsigned integer, 2 bytes 1.6.0 to 2.6.1
dnp3.al.file.mode File Control Mode Unsigned integer, 2 bytes 1.6.0 to 2.6.1
dnp3.al.file.perms Permissions Unsigned integer, 2 bytes 1.10.0 to 2.6.1
dnp3.al.file.perms.exec_group Execute permission for group Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.exec_owner Execute permission for owner Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.exec_world Execute permission for world Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.read_group Read permission for group Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.read_owner Read permission for owner Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.read_world Read permission for world Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.write_group Write permission for group Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.write_owner Write permission for owner Boolean 1.10.0 to 2.6.1
dnp3.al.file.perms.write_world Write permission for world Boolean 1.10.0 to 2.6.1
dnp3.al.file.reqID File Request Identifier Unsigned integer, 2 bytes 1.6.0 to 2.6.1
dnp3.al.file.size File Size Unsigned integer, 4 bytes 1.6.0 to 2.6.1
dnp3.al.file.status File Control Status Unsigned integer, 1 byte 1.6.0 to 2.6.1
dnp3.al.file_name File Name Character string 2.0.0 to 2.6.1
dnp3.al.file_string_length File String Length Unsigned integer, 2 bytes 2.0.0 to 2.6.1
dnp3.al.file_string_offset File String Offset Unsigned integer, 2 bytes 2.0.0 to 2.6.1
dnp3.al.fin Final Boolean 1.0.0 to 2.6.1
dnp3.al.fir First Boolean 1.0.0 to 2.6.1
dnp3.al.frag_data DNP3.0 AL Fragment Data Sequence of bytes 2.4.0 to 2.6.1
dnp3.al.fragment DNP 3.0 AL Fragment Frame number 1.0.0 to 2.6.1
dnp3.al.fragment.count Fragment count Unsigned integer, 4 bytes 1.6.0 to 2.6.1
dnp3.al.fragment.error Defragmentation error Frame number 1.0.0 to 2.6.1
dnp3.al.fragment.multipletails Multiple tail fragments found Boolean 1.0.0 to 2.6.1
dnp3.al.fragment.overlap Fragment overlap Boolean 1.0.0 to 2.6.1
dnp3.al.fragment.overlap.conflict Conflicting data in fragment overlap Boolean 1.0.0 to 2.6.1
dnp3.al.fragment.reassembled.length Reassembled DNP length Unsigned integer, 4 bytes 1.4.0 to 2.6.1
dnp3.al.fragment.reassembled_in Reassembled PDU In Frame Frame number 1.0.0 to 2.6.1
dnp3.al.fragment.toolongfragment Fragment too long Boolean 1.0.0 to 2.6.1
dnp3.al.fragments DNP 3.0 AL Fragments Label 1.0.0 to 2.6.1
dnp3.al.func Application Layer Function Code Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.iin Internal Indications Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.al.iin.bmsg Broadcast Msg Rx Boolean 1.0.0 to 2.6.1
dnp3.al.iin.cc Configuration Corrupt Boolean 1.0.0 to 2.6.1
dnp3.al.iin.cls1d Class 1 Data Available Boolean 1.0.0 to 2.6.1
dnp3.al.iin.cls2d Class 2 Data Available Boolean 1.0.0 to 2.6.1
dnp3.al.iin.cls3d Class 3 Data Available Boolean 1.0.0 to 2.6.1
dnp3.al.iin.dol Digital Outputs in Local Boolean 1.0.0 to 2.6.1
dnp3.al.iin.dt Device Trouble Boolean 1.0.0 to 2.6.1
dnp3.al.iin.ebo Event Buffer Overflow Boolean 1.0.0 to 2.6.1
dnp3.al.iin.fcni Function Code not implemented Boolean 1.8.0 to 2.6.1
dnp3.al.iin.oae Operation Already Executing Boolean 1.0.0 to 2.6.1
dnp3.al.iin.obju Requested Objects Unknown Boolean 1.0.0 to 2.6.1
dnp3.al.iin.pioor Parameters Invalid or Out of Range Boolean 1.0.0 to 2.6.1
dnp3.al.iin.rst Device Restart Boolean 1.0.0 to 2.6.1
dnp3.al.iin.tsr Time Sync Required Boolean 1.0.0 to 2.6.1
dnp3.al.index Index (8 bit) Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.obj Object Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.al.objq.code Qualifier Code Unsigned integer, 1 byte 1.0.0 to 2.0.16
dnp3.al.objq.index Index Prefix Unsigned integer, 1 byte 1.0.0 to 2.0.16
dnp3.al.objq.prefix Prefix Code Unsigned integer, 1 byte 2.2.0 to 2.6.1
dnp3.al.objq.range Range Code Unsigned integer, 1 byte 2.2.0 to 2.6.1
dnp3.al.octet_string Octet String Sequence of bytes 2.0.0 to 2.6.1
dnp3.al.off_time Off Time Unsigned integer, 4 bytes 2.0.0 to 2.6.1
dnp3.al.on_time On Time Unsigned integer, 4 bytes 2.0.0 to 2.6.1
dnp3.al.point_index Point Index Unsigned integer, 4 bytes 2.0.0 to 2.6.1
dnp3.al.ptnum Object Point Number Unsigned integer, 2 bytes 1.0.0 to 1.8.15
dnp3.al.range.abs Address (8 bit) Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.range.quantity Quantity (8 bit) Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.range.start Start (8 bit) Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.range.stop Stop (8 bit) Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.reltimestamp Relative Timestamp Time offset 1.0.0 to 2.6.1
dnp3.al.seq Sequence Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.al.size Size (8 bit) Unsigned integer, 1 byte 1.6.0 to 2.6.1
dnp3.al.time_delay Time Delay Unsigned integer, 2 bytes 2.0.0 to 2.6.1
dnp3.al.timestamp Timestamp Date and time 1.0.0 to 2.6.1
dnp3.al.unknown_data_chunk Unknown Data Chunk Sequence of bytes 2.0.0 to 2.6.1
dnp3.al.uns Unsolicited Boolean 1.4.0 to 2.6.1
dnp3.buffering_user_data_until_final_frame_is_received Expert Info Label 2.0.0 to 2.0.16
dnp3.ctl Control Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.ctl.clr Queue / Clear Field Unsigned integer, 1 byte 1.10.0 to 2.6.1
dnp3.ctl.dfc Data Flow Control Boolean 1.0.0 to 2.6.1
dnp3.ctl.dir Direction Boolean 1.0.0 to 2.6.1
dnp3.ctl.fcb Frame Count Bit Boolean 1.0.0 to 2.6.1
dnp3.ctl.fcv Frame Count Valid Boolean 1.0.0 to 2.6.1
dnp3.ctl.op Operation Type Unsigned integer, 1 byte 1.10.0 to 2.6.1
dnp3.ctl.prifunc Control Function Code Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.ctl.prm Primary Boolean 1.0.0 to 2.6.1
dnp3.ctl.secfunc Control Function Code Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.ctl.trip Trip Control Code Unsigned integer, 1 byte 1.10.0 to 2.6.1
dnp3.data_chunk.CRC.incorrect Data Chunk Checksum incorrect Label 2.4.0 to 2.6.1
dnp3.dst Destination Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.empty_field_limit Empty field limit reached. Potentially malicious packet Label 2.6.0 to 2.6.1
dnp3.hdr.CRC Data Link Header checksum Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.hdr.CRC.incorrect Data Link Header Checksum incorrect Label 2.4.0 to 2.6.1
dnp3.hdr.CRC_bad Bad CRC Boolean 1.0.0 to 2.2.15
dnp3.iin_abnormal IIN Abnormality Label 1.12.0 to 2.6.1
dnp3.invalid_length Invalid length Label 1.12.0 to 2.6.1
dnp3.len Length Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.num_items_neg Negative number of items Label 1.12.0 to 2.6.1
dnp3.src Source Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.start Start Bytes Unsigned integer, 2 bytes 1.0.0 to 2.6.1
dnp3.tr.ctl Transport Control Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.tr.fin Final Boolean 1.0.0 to 2.6.1
dnp3.tr.fir First Boolean 1.0.0 to 2.6.1
dnp3.tr.seq Sequence Unsigned integer, 1 byte 1.0.0 to 2.6.1
dnp3.unknown_group0_variation Unknown Group 0 Variation Label 2.6.0 to 2.6.1
dnp3.unknown_object Unknown Object\Variation Label 2.6.0 to 2.6.1
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ NetShark appliance
  • • Troubleshoot problems faster
  • • Quickly identify the applications running on your network
  • • Monitor your virtual machine traffic
Learn More