Add DNP3 protocol analyzer #8
Description
Summary
Implement a DNP3 (Distributed Network Protocol 3) analyzer for ICS/OT forensics.
Requirements
- Detect DNP3 on port 20000 (TCP/UDP)
- Parse DNP3 data link layer header (start bytes 0x0564, length, control, destination, source)
- Parse transport and application layer function codes
- Track: reads vs writes, direct operate commands, cold/warm restarts
- Detect anomalies: unauthorized control commands, broadcast messages, unsolicited responses
- Map to MITRE ICS: T0855, T0803 (Block Command Message)
Acceptance Criteria
- `Dnp3Analyzer` implements `ProtocolAnalyzer`
- Tests with crafted DNP3 packets
- Summarize: function code distribution, control operation counts
- Findings for unauthorized control operations