DNP3 Explorer Documentation

Installation

MacTools DNP3 Explorer is a native macOS app built with Rust and Tauri. It runs natively on Apple Silicon and Intel Macs: no Rosetta, no Parallels, no Java, no .NET runtime. One-time purchase, no subscription.

Download

Direct purchase: buy direct ($29.99 one-time): you receive a download link by email
Product page: /dnp3-explorer/

System Requirements

Requirement	Minimum
macOS	13 Ventura or newer (Apple Silicon & Intel)
Network	TCP/IP reachability to the outstation on the configured DNP3 TCP port (default 20000)

First Launch

If you downloaded the direct build outside the App Store, macOS Gatekeeper may block the unsigned binary on first run. Right-click the app, choose Open, then confirm. This is only required once.

DNP3 is layered. A connection that opens but yields no data almost always points to a link-layer or application-layer addressing mismatch, not a network issue. Skim the Troubleshooting section before opening your first outstation.

Quick Start

1. Connect to a DNP3 TCP outstation (5 minutes)

The most common path: reading analog and binary points from an RTU, meter, or protection relay over Ethernet.

Open the app and create a new TCP master connection.
Enter the outstation IP address and port 20000 (the DNP3 default; some vendors use 20001 or 47808).
Set Source Address (master, commonly 1) and Destination Address (outstation, commonly 3 or 1024). These must match the device's config exactly. DNP3 will silently drop frames addressed to anyone else.
Click Connect. The link-layer link comes up; the status pill turns green.
The app polls the point list you defined (an integrity poll, class 0). Values populate the point table. Add points by group, variation and index first; the list is editable.

2. Run event scans

Click Class 1, Class 2 or Class 3 under Class polling to send an event scan.
The communication log records how many events each scan returned, and the point table refreshes afterwards.
The app does not enable or listen for unsolicited responses, so events are only collected when you scan.

3. Operate a control

Click a point row to open the control dialog. Choose Select before operate (the default) or Direct operate. For binary outputs pick latch on, latch off, pulse on or pulse off with a count and on/off times; for analog outputs enter a float32 setpoint.

Configuration

Connection Types

Transport	Parameters
DNP3 TCP	IP, port (default 20000), source (master) and destination (outstation) address

Link & Application Layer

Setting	Purpose / Typical Value
Source address	The master's link-layer address (commonly 1)
Destination address	The outstation's link-layer address (commonly 3, 10, or 1024)
Application timeout	The master waits up to 5 seconds for an application-layer response
Class 0/1/2/3 scan	Integrity poll (Class 0) runs with the point list at the poll interval; class 1, 2 and 3 event scans are sent on demand

Object Groups & Variations

DNP3 organizes data into groups (the data type) and variations (the encoding). The most-used groups:

Group	Type	Common Variations
G20	Counter	Var 1 (32-bit with flag); freeze command for all counters
G1	Binary Input	Var 1 (single bit), Var 2 (with flags)
G2	Binary Input Change	Events that drove a state flip: class 1/2/3
G10	Binary Output	Control status: read-back of a relay point
G12	Binary Output Command	Operate / Direct Operate with Control Relay Output Block
G30	Analog Input	Var 1–6: 32/16-bit int or float, with/without flags
G32	Analog Input Change	Events that exceeded deadband: class 2/3
G40	Analog Output Status	Read-back of an analog setpoint
G41	Analog Output Command	Write an analog setpoint

Control operations

Binary controls (Group 12) use a Control Relay Output Block with an operation type, count and on/off time. The control dialog defaults to Select-before-Operate (SBO), which sends a SELECT and then an OPERATE with the same object once the outstation accepts it; Direct Operate issues the command in a single request and should be reserved for trusted local networks. If the SELECT is refused or unanswered, no OPERATE is sent. Analog outputs (Group 41, float32) work the same way.

Key Features

Point list and integrity poll

Define the points you want (group, variation and index) in an editable list and the app polls them at the interval you choose. You need to know the device's point map: the app does not discover points on its own.

Communication log

Every request the app sends and every response it receives is logged with a timestamp, marked TX or RX. Export the log to CSV for troubleshooting.

Class event scans

Class 1, 2 and 3 event scans send the standard class read, log the number of events returned, and refresh the point table.

Device controls

Time sync, cold restart, warm restart and a freeze command for counters are available from the master.

Controls with select before operate

Issue Group 12 binary controls and Group 41 analog controls as SELECT then OPERATE, or as Direct Operate. A refused or timed-out SELECT stops the sequence, and a control the outstation answers with a status other than success is reported as an error.

Troubleshooting

Connection opens but polling returns no data

Symptom: The TCP connection opens, but the integrity poll returns an empty response or never completes.
Fix: Check source/destination addresses. DNP3 silently drops frames whose link-layer destination does not match the device's local address. Confirm source = master (commonly 1), destination = outstation (commonly 3, 10, or 1024), and check that the group, variation and index of each point match the device's point map. The communication log shows what the app sent and what came back.

DNP3 link-layer error codes

Link-layer responses use a function byte. The ones you'll see in practice:

Code	Name	Likely Cause
0x01	RESET_LINK_STATES	Sent on initial connect; should be followed by a link reset ACK
0x09	REQUEST_LINK_STATUS	Health probe: reply is 0x0B
0x0E	NOT_LINKED	Link dropped; usually a link timeout, address mismatch, or device reboot
0x10	NOT_SUPPORTED	Device doesn't support this link function: rare; indicates a misconfigured device

Application-layer IIN (Internal Indicators) bits

Every response carries a 2-byte IIN field. Decode them in the live event log:

Byte.Bit	Meaning
IIN.1.0	BROADCAST: response to a broadcast, not addressed to you
IIN.1.1	CLASS_1_EVENTS: class 1 events queued, poll needed
IIN.1.2 / 1.3	CLASS_2 / CLASS_3_EVENTS queued
IIN.1.4	NEED_TIME: device clock needs setting
IIN.1.5	LOCAL: device in local mode; remote control refused
IIN.1.7	RESTART: device restarted since last comms; re-read point map and events
IIN.2.0	NO_FUNC_CODE_SUPPORT: device doesn't support the function you sent
IIN.2.1	OBJECT_UNKNOWN: group/variation not implemented
IIN.2.2	PARAMETER_ERROR: qualifier or index out of range

Support

Email: [email protected]
Product page: /dnp3-explorer/

When reporting a comms issue, attach the exported event log (redact any sensitive PSKs or device IP addresses) and include the source/destination addresses, transport (TCP/serial/UDP), and the device vendor and firmware version.