DNP3 Outstation Discovery With OTserver
Overview
DNP3 (IEEE 1815) is used by utility outstations, remote terminal units, and other telemetry devices. OTserver Otter reads device attributes and attaches the resulting identity evidence to an asset with a discovered MAC address.
How OTserver discovers DNP3 devices
Otter connects to TCP port 20000 and sends a link-layer Reset Link States followed by a confirmed application Read of Group 0 Variation 0 with the all-objects qualifier (0x06). The link reset initializes communication state; it is not a device restart.
Because outstations can silently ignore frames addressed elsewhere, the scanner pipelines this exchange for four fixed (outstation, master) address pairs: (1, 1), (1, 1024), (1024, 1), and (0, 0). It retains the replying addresses and the first application response. Devices requiring other addresses may not respond.
The reader checks link framing and header/data CRCs, reassembles transport and application fragments, and processes at most 64 frames with read timeouts. Unsolicited reports are not used as the requested attribute response. A valid link reply without an attribute response can still identify DNP3, with a warning and no invented identity fields.
Evidence extracted
| OTserver evidence | DNP3 Group 0 attribute |
|---|---|
| Vendor | Manufacturer, variation 252 |
| Model | Product name, variation 250 |
| Name | User-assigned device name, variation 247; product name is the fallback |
| Firmware | Software version, variation 242 |
| Serial number | Serial number, variation 248 |
| Location | User-assigned location, variation 245 |
| Additional raw evidence | Hardware version (243), ID code (246), conformance (249), responding link addresses, and application response bytes |
Only attributes supplied by the outstation become identity evidence. Unsupported attributes and rejected requests remain visible through warnings.
Security and read-only safety
Otter sends the fixed link reset and attribute read. It does not write or operate points, assign classes, freeze counters, restart devices, or use DNP3 Secure Authentication. Discovery currently covers plain DNP3/TCP only, not serial DNP3, DNP3/UDP, or TLS-wrapped DNP3.
DNP3 is enabled by default. Disable it with --no-dnp3, set "noDnp3": true in otter.json, or turn off DNP3 in the GUI. Every scan requires --ack-authorized.
Frequently asked questions
Why is DNP3 detected without a vendor or model?
An outstation can answer at the link layer while rejecting or not implementing Group 0 device attributes. Otter preserves that protocol evidence and reports the missing application response or unsupported attributes.
Does the link reset restart the outstation?
No. Reset Link States is a link-layer communication operation. Otter does not send the DNP3 application cold-restart or warm-restart functions.
Compare all supported discovery protocols or configure the scanner.