AJapps

SCADA Protocol Capture Analyser — IEC 104, Modbus TCP, DNP3

Open a Wireshark capture of a telecontrol or SCADA link and read it as a protocol engineer would: every IEC 60870-5-104 APDU with sequence numbers, causes, addresses, values, quality and time tags; every Modbus TCP request with its response, exception and response time, and the register map it reveals; every DNP3 frame with CRC check, function code, internal indications and objects — with findings that explain what is wrong and what to check.

Capture

IEC 104 parameters

Defaults per IEC 60870-5-104: k 12, w 8, t1 15 s, t2 10 s, t3 20 s. Enter the values configured on the link.

Modbus and DNP3

Result

Open a capture or load one of the samples.

Tool guide · know before you use

What this tool is, how it works and how far to trust it

An analyser for captures of SCADA telecontrol links: it decodes IEC 60870-5-104, Modbus TCP and DNP3 from a Wireshark file and checks them against the protocol rules.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Read pcap and pcapng files and reassemble each TCP connection in both directions (retransmissions dropped, missing data reported).
  • IEC 104: decode I, S and U frames and 40 ASDU types with value, quality and CP56Time2a time tag; check STARTDT, sequence numbers, k and w, unconfirmed TESTFR/STARTDT within t1, idle time t3, general interrogation and command sequences, causes 44–47, time-tag offset; build a point list.
  • Modbus TCP: match requests and responses, explain exceptions, find unanswered requests, measure response times, list polling blocks and their cycle, and build a register map of every address read or written.
  • DNP3: check the CRC of every link-frame block, reassemble transport segments, decode function codes, IIN bits and the common object groups, and find unanswered requests, SELECT without OPERATE and unconfirmed unsolicited responses.

Why you need it

  • When data stops or arrives wrong, the capture shows which side is at fault — but reading hundreds of frames by hand is slow, and the protocol rules are not obvious.
  • Gateways, RTUs and control centres from different vendors interpret parameters (k, w, timers, cause of transmission, word order, IIN handling) differently; the capture is the neutral evidence.

Understand this first

  • IEC 104 numbers every I-frame; the receiver acknowledges with N(R). A jump in N(S) means frames were lost or repeated, and the connection must be closed. The sender may have at most k unacknowledged frames; the receiver should acknowledge at the latest after w frames or t2 seconds.
  • Cause of transmission tells why a value is sent: spontaneous (3), interrogated (20), activation (6), confirmation (7), termination (10); causes 44–47 mean the receiver does not know the type, cause, common address or object address — a configuration mismatch.
  • Modbus has no time stamps, no quality and no events: the master polls, and an exception code tells why a request failed (2 = address not in the map, 11 = the device behind a gateway did not answer).
  • DNP3 protects each 16-byte block with a CRC; internal indications (IIN) in every response report device restart, need time, event buffer overflow and trouble.

What you need before you start

  • A capture (.pcap or .pcapng) taken at a mirror port or TAP next to the gateway, RTU or SCADA front end, ideally including a general interrogation or integrity poll.
  • The link parameters configured on the devices (IEC 104 k, w, t1–t3, ports) if they differ from the defaults.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Open the capture or load a sample; the tab with the most traffic opens first.
  • Enter the configured IEC 104 parameters and ports if they are not the defaults.
  • Read the findings with their frame numbers, then look at those frames in Wireshark if needed. Export the IEC 104 point list or the Modbus register map.

What you get

  • Per connection: statistics, findings with frame numbers, a frame table; the IEC 104 point list (CSV); Modbus polling blocks and register map (CSV); DNP3 application messages with IIN and objects.

How to read the results

  • Sequence-number errors and unconfirmed TESTFR: the link is unreliable or one side does not follow the timers — compare the parameters on both sides.
  • Causes 44–47 and Modbus exception 2: the two configurations do not match (address list, common address, register map, offset).
  • Time tags off by whole hours: one side uses local time instead of UTC. DNP3 NEED TIME: the outstation clock is not set.
  • Invalid quality (IV, NT) on points: the gateway has lost the source IED or the value is not refreshed.

Technical basis

  • IEC 60870-5-104 APCI and timers; ASDU structure, type identifications, causes and CP56Time2a per IEC 60870-5-101/104 (cause of transmission 2 octets, common address 2 octets, object address 3 octets).
  • Modbus Application Protocol V1.1b3 and Modbus Messaging on TCP/IP (MBAP header, limits of 2000 bits / 125 registers per read and 123 per write).
  • IEEE 1815 DNP3: link frame 0x0564 with CRC-16 (polynomial 0x3D65), transport header FIR/FIN/sequence, application control and function codes, IIN.
  • The sample captures were generated with Scapy's independent IEC 104 and Modbus implementations; the DNP3 CRC is checked against the published example 05 64 05 C0 01 00 00 04 → E9 21.

Limits: when not to rely on it

  • Encrypted links (TLS) cannot be decoded; IEC 101 and DNP3 serial links need a capture in pcap form from a serial-to-Ethernet tap.
  • IP fragments are not reassembled; captures with lost packets are decoded around the gaps, which are reported.
  • DNP3 objects are decoded for the common groups (binary, double-bit, analog, counter, CROB, analog output, time); other groups are listed by header only.

Sample files for this tool

Download, open and compare with what the guide says you should see.

All sample files and what to expect →

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 0473054 · 2026-11-14