Practical_modern_SCADA_protocols_-_dnp3,_60870-5_and_Related_Systems

512 Practical Modern SCADA Protocols: DNP3, 60870.5 and Related Systems
We see the control byte can be interpreted as such…
C0 = 1100 0000 00 = 0000 0000 therefore…
The First Packet
The Second Packet
A to B 1 B to A 0
From the Pri/Sec 1 From the Pri/Sec 0 (1= Primary, 0 = Secondary)
FCB / Res 0 FCB / Res 0
FCV/ Ignored 0 FCV/ Ignored 0
First bit of Function 0 First bit of Function 0
0 0
0 0
0 0
Reset the Link
Acknowledgement
Notice: the two least significant bits denote the datalink functions (if any) of the packets.
If a protocol analyzer was used to look at the previous packets it might interpret the data
as such.
Reset Link Command From 170 to 2
Started at 30-Aug-101 15:13:1, protocol DNP 3.0 —>
[ 15:13:3] 05 64 05 C0 02 00 AA 00<
Data Link Header [DIR] [PRM]
Reset Link (Confirm) Length 5 Dest 2 Source 170 crc:A7 crc:6E
05640500AA0002003F42
Next we are going to look at a more complicated packet. The “disabling unsolicited
response” packet is a very common packet that is used to put the DNP3 system into a
master/slave only mode. This guarantees that there are no collisions within the system. It
also makes the system more deterministic. (we know who talks to whom and when)
Disabling Unsolicited Responses From the Slave:
056411C40200AA0010D7C0C1153C02063C03063C0406944305640A44AA0002007FBAD
AC1810000A393
Again the first thing is to separate the data into packets.
056411C40200AA0010D7C0C1153C02063C03063C04069443
05640A44AA0002007FBADAC1810000A393