dnp3-outstation-inventorylisted

## When to Use - Building the outstation list for a DNP3 segment. - Checking which outstations answer READ and which accept SELECT or OPERATE. - Investigating a data link address collision reported by the master. - Baselining function code distribution before monitoring deployment. ## Prerequisites - tshark 4.x. Verify with `tshark --version`. - zeek 5.x. Verify with `zeek --version`. - SPAN port or network TAP on the segment. - nmap 7.94 or newer for the gated port confirmation. - Credentials: none for passive capture. - Authorization: segment owner sign-off. The gated port check needs a maintenance window. - Upstream skills: `passive-ot-network-discovery` for the segment capture. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. ## Workflow 1. Resolve the DNP3 field names for this tshark revision: `tshark -G fields | grep -i dnp3 | grep -iE "func|dst|src" | head -30` Use the resolved function code field in the commands below. 2. Passive address map: `tshark -r capture.pcapng -Y "dnp3" -T fields -e ip.src -e ip.dst -e dnp3.func -E separator=, | sort -u > dnp3_flat.csv` The endpoint receiving READ requests is the outstation. The sender is the master. 3. Function code distribution: `tshark -r capture.pcapng -Y "dnp3" -T fields -e ip.src -e ip.dst -e dnp3.func | sort | uniq -c | sort -rn` Function codes appear as