DNP3 Industrial Protocol Utility

DNP3 Frame Decoder

Decode DNP3 data-link frames from hexadecimal bytes. Inspect the 05 64 start sequence, LENGTH field, control flags, link-layer function, destination and source addresses, header CRC, user-data blocks and per-block CRC values.

✓ Link Header ✓ Addresses ✓ Control Flags ✓ Header CRC ✓ Data CRC Blocks

DNP

DNP3 Data-Link Decode

● Ready

DNP3 Frame Hex Bytes Enter one complete DNP3 data-link frame. Spaces, commas, colons, hyphens, 0x-prefixed bytes and continuous hexadecimal input are accepted.

DNP3 LENGTH rule: the LENGTH byte counts the five link-header bytes beginning with CONTROL through SOURCE plus the user-data bytes. It does not count the two start bytes, the LENGTH byte itself, the header CRC or the CRC bytes inserted after user-data blocks.

DNP3 Frame Decode Result Decoded

Decoded Link-Layer Frame —

Start Bytes —

Length —

Control —

Direction —

PRM —

Link Function —

Destination —

Source —

Header CRC —

User Data —

Data CRC Blocks —

Total Frame Bytes —

User Data Without CRC Bytes

—

#	Data Offset	Data Bytes	Received CRC	Calculated CRC	Status

Frame Breakdown

—

What Is a DNP3 Frame?

DNP3, or Distributed Network Protocol 3, is widely used in industrial control, utility, SCADA and telemetry systems. At the data-link layer, a DNP3 frame contains synchronization bytes, a length field, link-control information, source and destination addresses, cyclic redundancy checks and optional user data.

The link layer provides framing, addressing and error detection before transport and application-layer DNP3 information is interpreted.

DNP3 Frame Structure

05 64
LENGTH
CONTROL
DESTINATION low
DESTINATION high
SOURCE low
SOURCE high
HEADER CRC low
HEADER CRC high

USER DATA block 1
CRC low
CRC high

USER DATA block 2
CRC low
CRC high
...

User data is divided into blocks of no more than 16 bytes, with a two-byte CRC following every block.

DNP3 Start Bytes 05 64

A standard DNP3 data-link frame begins with two synchronization bytes: hexadecimal 05 64.

Start byte 1:
0x05

Start byte 2:
0x64

These bytes allow a receiver to recognize the beginning of a DNP3 frame in a serial or network byte stream.

How the DNP3 Length Byte Works

The LENGTH field does not represent the complete physical frame length. It counts the CONTROL byte, two destination-address bytes, two source-address bytes and all user-data bytes.

LENGTH =
5 link-header bytes
+ user data length

Therefore:

User Data Length =
LENGTH - 5

CRC bytes are excluded from this value. A DNP3 frame with no user data therefore has a LENGTH value of 5.

DNP3 Source and Destination Addresses

DNP3 link-layer addresses are 16-bit values transmitted with the low byte first.

Address bytes:
34 12

Little-endian decode:

0x1234

Decimal:
4660

Both the destination and source addresses are decoded using this byte order.

DNP3 Link Control Byte

The eight-bit CONTROL field contains direction, primary-message indication, flow/link-control flags and a four-bit link-layer function code.

Bit 7    DIR
Bit 6    PRM
Bit 5    FCB or reserved/DFC context
Bit 4    FCV or DFC/reserved context
Bits 3:0 Link Function Code

The exact interpretation of control bits 4 and 5 depends on whether PRM indicates a primary or secondary link-layer frame, so this decoder reports the raw bits as well as their contextual names.

DNP3 Direction Bit

The DIR bit indicates the communication direction defined by the DNP3 link layer.

DIR = 1
Master → Outstation

DIR = 0
Outstation → Master

Common Primary Link Function Codes

Code	Primary Function
0	Reset Link States
1	Reset User Process
2	Test Link States
3	Confirmed User Data
4	Unconfirmed User Data
9	Request Link Status

Common Secondary Link Function Codes

Code	Secondary Function
0	ACK
1	NACK
11	Link Status
15	Not Supported

DNP3 Header CRC

A two-byte DNP3 CRC follows the eight bytes from the start sequence through the source address. This CRC protects the data-link header.

Header CRC input:

05
64
LENGTH
CONTROL
DEST low
DEST high
SOURCE low
SOURCE high

The CRC bytes themselves are transmitted low byte first.

DNP3 User-Data CRC Blocks

DNP3 protects user data in blocks containing up to 16 data bytes. Each block is followed by its own two-byte CRC.

User Data:

Bytes 1–16
CRC

Bytes 17–32
CRC

Bytes 33–48
CRC

...

The final block can contain fewer than 16 bytes, but it still has its own two-byte CRC.

DNP3 Physical Frame Length

Because the LENGTH field excludes CRC bytes, the number of bytes physically present on the link is larger than the LENGTH value.

UserData =
LENGTH - 5

Data CRC Blocks =
ceil(UserData / 16)

Physical Frame Bytes =
10
+ UserData
+ 2 × Data CRC Blocks

The fixed ten bytes include the start sequence, LENGTH, five link-header bytes and the two-byte header CRC.

DNP3 CRC Algorithm

DNP3 uses a 16-bit CRC with polynomial 0x3D65. The common reflected implementation uses polynomial 0xA6BC, starts with zero and complements the final 16-bit result. The resulting CRC is transmitted low byte first.

This calculator applies that algorithm independently to the header and every user-data block, allowing corruption or incorrect CRC bytes to be detected.

DNP3 Link Layer vs Application Layer

A valid data-link frame does not automatically reveal the full DNP3 application meaning. User data can contain transport control followed by application control, function codes, object headers, qualifiers and object data.

This page focuses specifically on the DNP3 frame and link-layer structure. It preserves the reconstructed user data without inventing application-level object interpretations.

DNP3 Frame Decoder FAQs

What bytes start a DNP3 frame?

A normal DNP3 data-link frame starts with hexadecimal bytes 05 64.

What does the DNP3 LENGTH byte include?

It includes CONTROL, destination address, source address and user-data bytes. It excludes start bytes, the LENGTH byte and all CRC bytes.

What is the minimum DNP3 LENGTH value?

A normal frame without user data has LENGTH 5 because the link header after the length field contains five bytes.

Are DNP3 addresses little-endian?

Yes. The low byte of each 16-bit link-layer address is transmitted first.

How much data does one DNP3 CRC protect?

After the header, each CRC protects a user-data block containing up to 16 bytes.

How long is a DNP3 CRC?

Each DNP3 CRC field is 16 bits, or two bytes.

What does DIR = 1 mean?

At the DNP3 link layer it represents traffic in the master-to-outstation direction.

What does PRM mean?

PRM identifies whether the frame uses the primary or secondary link-control function interpretation.

Can this decoder verify DNP3 CRCs?

Yes. It calculates the header CRC and each user-data block CRC and compares them against the bytes supplied.

Does this decode DNP3 objects and application data?

No. This page focuses on the data-link frame. Application objects require additional transport/application-layer decoding.

Decode DNP3 Data-Link Frames

Inspect DNP3 start bytes, link control flags, function codes, source and destination addresses, payload boundaries and CRC integrity directly from hexadecimal frame captures.