drop pcap with dnp3 · parse outstation reads + control operates · runs locally
drop pcap with dnp3 · local only
heuristic screener · vendor schema varies · not definitive proof