skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-dnp3-protocol-anomalies

Detect unauthorized DNP3 commands and protocol anomalies in SCADA network traffic.

954|172|Updated Mar 13, 2026
Search Tags:#anomaly detection#IDs#SCADA#ics security#OT security#PCAP analysis#dnp3
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-dnp3-protocol-anomalies
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-dnp3-protocol-anomalies
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/detecting-dnp3-protocol-anomalies
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-dnp3-protocol-anomalies

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy.

What problem does it solve?

SCADA environments in the energy sector rely on DNP3, which lacks built-in authentication, making it hard to spot unauthorized control commands, firmware update attempts, and restart attacks hidden in normal traffic.

Core Features & Use Cases

  • DNP3 Packet Analysis: Parses DNP3 data link, transport, and application layers from pcap captures to extract function codes and master-outstation sessions.
  • Baseline-Based Detection: Alerts on unauthorized masters, cold/warm restarts, file operations, and control commands that deviate from an authorized communication baseline.
  • MITRE ICS Mapping: Maps each alert to MITRE ATT&CK for ICS techniques such as T0816 (Device Restart/Shutdown) and T0839 (Module Firmware).
  • Use Case: A utility security team analyzes a substation pcap and immediately flags a cold restart command sent to an RTU by an unrecognized master, indicating a potential PIPEDREAM-style intrusion.

Quick Start

Analyze the captured file substation-traffic.pcap against my authorized baseline.json and report any unauthorized DNP3 masters, restart commands, or firmware file operations.

Frequently Asked Questions about detecting-dnp3-protocol-anomalies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect unauthorized DNP3 commands in SCADA traffic?▼

Analyze a pcap capture with the detector script, which parses DNP3 function codes and flags Select/Operate, restart, and file transfer commands. Provide a baseline JSON of authorized masters and expected function codes to catch deviations.

What DNP3 function codes indicate an attack on an outstation?▼

High-risk codes include Cold Restart (0x0D), Warm Restart (0x0E), Select/Operate (0x03-0x06), and file operations (0x19-0x1E) used for firmware updates. These map to MITRE ICS techniques like T0816 and T0839.

Does DNP3 anomaly detection work over serial connections?▼

A TCP-only sensor cannot see serial DNP3 traffic, which many substations use to reach RTUs. You must tap the serial-to-IP gateway or explicitly document the coverage gap in your monitoring deployment.

Can I test DNP3 detection rules against a live outstation?▼

No, never send live Operate or Cold Restart commands to a production outstation, since a cold restart causes a real denial of service. Instead, replay captured pcaps with injected restart or file-transfer frames into the detector offline.

Why do valid-looking DNP3 control commands evade signature rules?▼

Without DNP3 Secure Authentication (SAv5), a spoofed master can issue commands that pass signature checks. Baselining allowed function codes and object groups per master-outstation pair is required to catch them.

Related Skills

Explore More Software Engineering Skills→
GeneralReasoningGeneralReasoning
4

pcap-analysis

Analyze PCAP files to extract network statistics and detect traffic patterns.

Official
Intermediate
claude-office-skillsclaude-office-skills
368

Security Monitoring

Automate security monitoring, threat detection, and incident response workflows.

Official
Advanced
YukiIto1999YukiIto1999

analyzing-network-traffic-for-incidents

Detect adversary activity in PCAPs, Zeek logs, and IDS alerts.

Community
Advanced
G36maidG36maid
6

ics-traffic

Analyze ICS/SCADA Modbus/TCP, IEC 104, and DNP3 traffic using Ettercap ARP spoofing and Scapy scripts.

Community
Advanced