DNP3

What is DNP3?

DNP3 (Distributed Network Protocol version 3) is an open communication protocol that a central SCADA system uses to exchange data with RTUs and IEDs in the field, designed for reliable telemetry over slow or error-prone links. It is used mainly in the energy, water and utility sectors and has been an IEEE standard, IEEE 1815, since 2010. DNP3 combines ordinary polling with report by exception: field stations buffer time-stamped events and send only what has changed. This makes it one of the most important protocols in industrial automation for geographically distributed installations.

🧠 Why was DNP3 developed?

DNP3 was developed in 1993 by Westronic (later GE-Harris Canada) in Calgary. The company based the protocol on the then unfinished IEC 60870-5 specifications and tailored it to North American requirements. The same IEC series later produced IEC 60870-5-104, its European counterpart. Shortly after its introduction, ownership was handed over to the independent DNP Users Group, which still maintains the protocol.

DNP3 was designed for environments where:

• Links are slow or unreliable - leased lines, radio and dial-up connections to remote stations
• Sequence and time matter - after a grid fault, the operator needs to know which breaker tripped first, down to the millisecond
• No data may be lost - events stay in the field station’s buffer until the SCADA system acknowledges them
• Remote control must be safe - switching commands are checked in two steps before they are executed
• Availability is essential - many implementations support redundant communication paths and a second master

The original DNP3 had no security at all. That was normal at the time: links were closed and serial. Security was added later and is still far from universally enabled.

🔧 How does DNP3 work?

DNP3 follows the Enhanced Performance Architecture from IEC 60870-5: a compact model with three layers instead of the seven of the OSI model, plus a simple transport function.

The central system is called the master and the field station the outstation. Data is organised into object groups such as binary inputs, counters, analogue inputs and analogue outputs. Each value can carry a timestamp, a quality flag and an event class. Not every device has to support everything: the DNP Users Group defines subset levels 1 to 4, from simple field devices up to full masters. A vendor’s device profile describes which objects and function codes a device actually supports, and the users group offers conformance test procedures for IEDs.

Classes and report by exception

• Class 0 - the current (static) value of all points
• Classes 1, 2 and 3 - buffers for events, usually in descending priority
• Integrity poll - at start-up the master reads classes 1, 2, 3 and 0 in one go, so it has a complete and current picture
• Event polls - after that the master only requests the event classes, and only changes are returned
• Unsolicited responses - an outstation may also report an event on its own initiative (function code 130), without waiting for a poll

This makes DNP3 very economical with bandwidth. A pumping station where nothing changes for hours sends almost nothing for hours.

Control with select-before-operate

For switching commands DNP3 uses SELECT (function code 3) followed by OPERATE (4). The field station first confirms which point has been selected and only executes the command when an identical OPERATE message follows. DIRECT OPERATE (5) skips this check and is faster, but less robust against corrupted messages. Time synchronisation uses dedicated time objects. On IP networks, NTP is often used as well.

Serial and over IP

DNP3 started out on RS-232, RS-485 and radio links. Today it runs mostly over TCP or UDP on port 20000, which IANA has registered for DNP3. The complete link frame is carried unchanged inside the IP packet.

🔄 What is the difference between DNP3, Modbus and IEC 60870-5-104?

For new substations in Europe, IEC 61850 is the standard. The IEEE 1815.1-2015 standard lets a gateway map DNP3 and IEC 61850 onto each other, so a DNP3 master can still read an IEC 61850 substation.

🏭 Where is DNP3 used?

• Electricity - communication between control centres, substations, IEDs and distribution automation
• Drinking water and wastewater - levels, flows and remote pump control, often over radio or 4G
• Oil and gas - Monitoring of pipelines, valves, tanks and flow meters
• Transport - bridges, tunnels and railway infrastructure

In the Netherlands and the rest of Europe, grid operators mainly use IEC 60870-5-104 and IEC 61850. You will encounter DNP3 here in RTUs and controllers from North American and Australian vendors, for example in water, energy and oil and gas installations. Many SCADA packages support DNP3 out of the box alongside other protocols.

🔐 How do you secure DNP3?

Secure Authentication

DNP3 Secure Authentication (SA) verifies that a message really comes from an authorised party and has not been altered in transit. Version 5 (SAv5) is part of IEEE 1815-2012 and is based on IEC/TS 62351-5.

• Challenge-response - for critical commands, the receiving station challenges the sender to compute an HMAC (with SHA-1 or, preferably, SHA-256) over the message
• Aggressive mode - the HMAC is sent directly with the message. This is faster but less strict
• Session keys - are refreshed periodically. Since 2012, update keys can be changed remotely, including with PKI
• Protection against spoofing, replay attacks and unauthorised commands

Secure Authentication does not encrypt anything. If you need confidentiality, use TLS in line with IEC 62351-3 or a VPN. IEC 62351-5:2023 adds authenticated encryption at application level for the IEC 60870-5 family. A successor, SAv6, is still under development.

Vulnerabilities in implementations

In 2013 and 2014, Adam Crain and Chris Sistrunk tested DNP3 implementations with fuzzing (Project Robus). They found dozens of flaws in masters and outstations from many vendors. A master could even be crashed through a serial link. The problem was not the protocol itself but sloppy input validation. That makes patching policy and supplier requirements under IEC 62443 just as important as the protocol.

Practical measures

1. Inventory all DNP3 connections, addresses and function codes in your asset inventory, including serial and radio links.
2. Segment the network with network segmentation and an industrial firewall that only allows port 20000 between known masters and outstations.
3. Filter by function code with protocol filtering: for example, block cold restarts, write commands and firmware uploads from unknown stations.
4. Monitor passively with an IDS or passive monitoring. Zeek, Suricata, Snort and Wireshark can all parse DNP3.
5. Enable Secure Authentication where equipment supports it, and use TLS or a VPN across public networks.
6. Plan the replacement of legacy RTUs that do not support authentication, and specify authentication requirements in procurement.

For Dutch drinking water companies, water boards and energy companies, DNP3 networks fall under the duty of care of the Cybersecurity Act, the Dutch implementation of NIS2, which has been in force since 15 August 2026. See also Water Sector OT Security.

❓ Frequently asked questions

What does DNP3 stand for?

DNP3 stands for Distributed Network Protocol version 3. It is an open protocol for telemetry and remote control between a SCADA master and field stations such as RTUs and IEDs. It is maintained by the DNP Users Group and has also been IEEE standard 1815 since 2010.

Which port does DNP3 use?

DNP3 over IP uses TCP or UDP port 20000 by default, which IANA has registered for DNP3. Firewalls in OT networks should ideally allow this port only between known masters and outstations. Serial DNP3 links over RS-232 or RS-485 naturally use no port number.

Is DNP3 encrypted?

Standard DNP3 is not encrypted: messages travel across the link in readable form. DNP3 Secure Authentication only adds authentication and integrity checking, not encryption. For confidentiality, DNP3 has to be tunnelled through TLS in line with IEC 62351-3 or a VPN.

What is an outstation in DNP3?

In DNP3, an outstation is the field station that supplies measurements and events and executes commands, usually an RTU, IED or PLC. The master is the central SCADA system that polls the outstation. A single DNP3 outstation can communicate with more than one master.

Is DNP3 used in Europe?

DNP3 is used less in Europe than in North America, because European grid operators mainly apply IEC 60870-5-104 and IEC 61850. DNP3 does appear in European water and energy installations that use equipment from North American or Australian vendors. Such DNP3 links are subject to the same security requirements under NIS2 as other OT protocols.

What is the difference between DNP3 and Modbus?

DNP3 supports timestamps, event buffering, report by exception and select-before-operate, while Modbus does not. Modbus is simpler and only reads registers when a master asks for them. That makes DNP3 better suited to long-distance telemetry and Modbus to communication within a single installation.

📌 In summary

DNP3 is the open telemetry protocol (IEEE 1815) that lets SCADA systems communicate reliably with RTUs and IEDs over slow or error-prone links, with timestamps, event buffering and controlled remote operation. The protocol dominates North American utilities and in Europe mainly appears alongside IEC 60870-5-104 and IEC 61850. Because DNP3 is unencrypted by default, segmentation, function code filtering, monitoring and Secure Authentication or TLS belong in every implementation.