Why there are 65520 dnp3 source addresses instead of 65536?

Question

DNP3 link-layer source and destination addresses are 16 bits each. It means it can have 2^16 = 65536 total different addresses. Based on official DNP3 docs, there are 65536 destination addresses, which I understand. But there are only 65520 source addresses, why is that? What are other remaining 16 addresses for?

On what I said above, you can read from any dnp3 docs or this link also works: https://www.ixiacom.com/company/blog/scada-distributed-network-protocol-dnp3

Answer 1

I'm not familiar with DNP3, but I found a specification for a DNP3 link layer protocol implementation at https://library.e.abb.com/public/06e4e2267fd04c3884515a0360210068/1MRK511380-UUS_-_en_Point_list_manual__DNP_650_series_2.1.pdf. See page 36:

1.4.1 Data Link Address: Indicates if the link address is configurable over the entire valid range of 0 to 65,519. Data link addresses 0xFFF0 through 0xFFFF are reserved for broadcast or other special purposes.

While the source doesn't indicate what these 16 addresses are reserved for (possibly as a precaution for future needs), it does indicate that they are reserved.