Electroshock
6 kV substation. DNP3 and IEC 104. Operate a breaker, then check what the IDS saw.
Electroshock is the primary lab of the Firegate zone, built around an operable 6 kV substation running the two protocols used to control power, water, and infrastructure: DNP3 and IEC 60870-5-104.
The environment contains RTUs, SCADA, feeders, breakers, disconnectors, and industrial routing, with network detection watching the traffic between them. Unlike a packet capture or a protocol diagram, every element is live: commands execute, breakers change state, and telemetry returns.
The lab is organised around a single control chain that can be followed end to end. SCADA sends a command, the RTU processes it, the breaker changes state, telemetry returns, the IDS observes the traffic, and the operator sees the process impact. Each transition is a distinct security question.
Users capture live protocol sessions, read protocol fields, map addresses and points, operate approved commands through Select-Before-Operate, test what happens when communication degrades, and validate whether detection fires against genuine activity rather than a replayed capture.
Firegate sits where the transmission line meets the district feeders, and it has been switching load since long before anyone thought to ask what was on the wire.
The substation speaks two languages. DNP3 answers the master with events it has been holding since the last poll. IEC 104 carries commands in the other direction, each one a small instruction with a large physical consequence.
Substation Warden Aldric has watched engineers arrive knowing that DNP3 uses SELECT then OPERATE. He has watched considerably fewer of them send a SELECT, wait for the outstation to validate it, send the OPERATE, and then walk to the IDS to find out whether anything noticed.
That second walk is what Firegate exists to teach.
"A valid command and an authorised command are not the same thing. The breaker cannot tell the difference. You have to."