# WHATPORT(20000)

## NAME

port 20000 — DNP3 / Usermin — Two unrelated things share this port: DNP3, the electric-utility SCADA protocol, and Usermin's HTTPS admin interface.

Protocol: TCP/UDP

## DESCRIPTION

IANA registers 20000 as 'dnp' for DNP3, the master/outstation protocol used between substation computers, RTUs and IEDs in electric utilities, water systems, and oil and gas; it is standardised as IEEE 1815 and DNP3-over-IP runs on TCP 20000. Independently, Usermin — the end-user companion to Webmin — defaults to HTTPS on 20000, so a scan hit is very often a Unix box offering webmail and password changes rather than a substation. The two are trivially told apart: Usermin answers a TLS handshake and serves HTML, DNP3 does not. On a general-purpose server assume Usermin; on an OT network assume DNP3.

## EXPOSURE

**Do not expose.** DNP3 has no authentication or encryption in its base form and speaks directly to physical plant. Usermin is a user-facing admin plane. Neither belongs on a public IP — put both behind a VPN.

## CHECK

```sh
nmap -Pn -sV -p 20000 --reason TARGET
```

## SEE ALSO

- docs — [DNP Users Group — Overview of DNP3](https://www.dnp.org/About/Overview-of-DNP3-Protocol) (dnp.org)
- spec — [IEEE Std 1815 — Electric Power Systems Communications (DNP3)](https://standards.ieee.org/ieee/1815/5414/) (standards.ieee.org)
- docs — [Usermin — official documentation](https://webmin.com/usermin/) (webmin.com)
- source — [Usermin source repository](https://github.com/webmin/usermin) (github.com)

---

HTML: <https://whatport.net/20000/> · JSON: <https://whatport.net/20000.json> · full dataset: <https://whatport.net/ports.json>