Practical_modern_SCADA_protocols_-_dnp3,_60870-5_and_Related_Systems

514 Practical Modern SCADA Protocols: DNP3, 60870.5 and Related Systems
The First Packet
The Second Packet
A to B 1 B to A 0
From Pri/Sec 1 From Pri/Sec 1 (1= Primary, 0 = Secondary)
FCB / Res 0 FCB / Res 0
FCV/ Ignored 0 FCV/ Ignored 0
First bit of Function 0 First bit of Function 0
1 1
0 0
0 0
User Data (no Confirm)
User Data (no Confirm)
Next we look at Block 1 of Packet 1 (Transport + Application Data)
C0C1153C02063C03063C0406
has been already removed.
Note that since this Block is 16 bytes or less the CRC
The first byte on the left is the Transport Header (C0).
C0 = 1100 0000
FIN FIR Sequence
1 1 00 0000
This tells us that this packet is the first and last packet in this sequence and therefore it is
not fragmented. We then know that the rest of the packet is an Application Layer Block.
C1153C02063C03063C0406
The first byte on the left is the Application header (C1).
C1 = 1100 0001
FIR FIN Confirmation Sequence
1 1 0 0 0001
This tells us that this packet is the first and last packet in this sequence and therefore it is
not fragmented at the Application Layer level. It also tells us that this packet is sequence
number 1.
153C02063C03063C0406
The next byte on the left (15) tells us that this packet is sending a function code that disables
the unsolicited message capabilities of the slave. This can be seen under Func. Code under
Request Header under Message Header under APCI on the DNP APDU sheet. (0X15)
3C02063C03063C0406