diff --git a/conpot/core/attack_session.py b/conpot/core/attack_session.py
index b0cbdc96..adad3080 100644
--- a/conpot/core/attack_session.py
+++ b/conpot/core/attack_session.py
@@ -23,9 +23,16 @@
 logger = logging.getLogger(__name__)
 
 
-# one instance per connection
+NEW_CONNECTION = "NEW_CONNECTION"
+CONNECTION_LOST = "CONNECTION_LOST"
+CONNECTION_CLOSED = "CONNECTION_CLOSED"
+CONNECTION_FAILED = "CONNECTION_FAILED"
+CONNECTION_TERMINATED = "CONNECTION_TERMINATED"
+CONNECTION_QUIT = "CONNECTION_QUIT"
+CONNECTION_TIMEOUT = "CONNECTION_TIMEOUT"
 
 
+# one instance per connection
 class AttackSession(object):
     def __init__(
         self,
diff --git a/conpot/protocols/IEC104/IEC104_server.py b/conpot/protocols/IEC104/IEC104_server.py
index d66761ab..da45affd 100644
--- a/conpot/protocols/IEC104/IEC104_server.py
+++ b/conpot/protocols/IEC104/IEC104_server.py
@@ -19,6 +19,7 @@
 from .frames import struct, TESTFR_act, socket, errno
 import logging
 import conpot.core as conpot_core
+from conpot.core import attack_session
 from gevent.server import StreamServer
 import gevent
 from .errors import Timeout_t3
@@ -52,7 +53,7 @@ def handle(self, sock, address):
             address[1],
             session.id,
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
         iec104_handler = IEC104(self.device_data_controller, sock, address, session.id)
         try:
             while True:
@@ -65,7 +66,7 @@ def handle(self, sock, address):
                         request = sock.recv(6)
                         if not request:
                             logger.info("IEC104 Station disconnected. (%s)", session.id)
-                            session.add_event({"type": "CONNECTION_LOST"})
+                            session.add_event({"type": attack.session.CONNECTION_LOST})
                             iec104_handler.disconnect()
                             break
                         while request and len(request) < 2:
@@ -122,18 +123,18 @@ def handle(self, sock, address):
                 except gevent.Timeout:
                     logger.warning("T1 timed out. (%s)", session.id)
                     logger.info("IEC104 Station disconnected. (%s)", session.id)
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                     iec104_handler.disconnect()
                     break
         except socket.timeout:
             logger.debug("Socket timeout, remote: %s. (%s)", address[0], session.id)
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
         except socket.error as err:
             if isinstance(err.args, tuple):
                 if err.errno == errno.EPIPE:
                     # remote peer disconnected
                     logger.info("IEC104 Station disconnected. (%s)", session.id)
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                 else:
                     # determine and handle different error
                     pass
diff --git a/conpot/protocols/bacnet/bacnet_server.py b/conpot/protocols/bacnet/bacnet_server.py
index 5ce34cc4..1d829125 100644
--- a/conpot/protocols/bacnet/bacnet_server.py
+++ b/conpot/protocols/bacnet/bacnet_server.py
@@ -28,6 +28,7 @@
 import conpot.core as conpot_core
 from conpot.protocols.bacnet.bacnet_app import BACnetApp
 from conpot.core.protocol_wrapper import conpot_protocol
+from conpot.core import attack_session
 from conpot.utils.networking import get_interface_ip
 import logging
 
@@ -69,7 +70,7 @@ def handle(self, data, address):
         logger.info(
             "New Bacnet connection from %s:%d. (%s)", address[0], address[1], session.id
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
         # I'm not sure if gevent DatagramServer handles issues where the
         # received data is over the MTU -> fragmentation
         if data:
diff --git a/conpot/protocols/enip/enip_server.py b/conpot/protocols/enip/enip_server.py
index 97d570ef..d3be4e2c 100644
--- a/conpot/protocols/enip/enip_server.py
+++ b/conpot/protocols/enip/enip_server.py
@@ -29,6 +29,7 @@
 from cpppo.server.enip import parser
 from cpppo.server.enip import device
 from conpot.core.protocol_wrapper import conpot_protocol
+from conpot.core import attack_session
 import conpot.core as conpot_core
 
 logger = logging.getLogger(__name__)
@@ -133,7 +134,7 @@ def handle(self, conn, address, enip_process=None, delay=None, **kwds):
             "enip", host, port, conn.getsockname()[0], conn.getsockname()[1]
         )
         logger.debug("ENIP server %s begins serving client %s", name, address)
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
 
         tcp = conn.family == socket.AF_INET and conn.type == socket.SOCK_STREAM
         udp = conn.family == socket.AF_INET and conn.type == socket.SOCK_DGRAM
@@ -332,7 +333,7 @@ def handle_tcp(
                             cpppo.timer() - begun,
                             delayseconds,
                         )
-                        session.add_event({"type": "CONNECTION_CLOSED"})
+                        session.add_event({"type": attack_session.CONNECTION_CLOSED})
                     except:
                         logger.error("Failed request: %s", parser.enip_format(data))
                         enip_process(address, data=cpppo.dotdict())  # Terminate.
@@ -491,7 +492,7 @@ def handle_udp(self, conn, name, enip_process, session, **kwds):
                     logger.debug(
                         "Transaction complete after %7.3fs", cpppo.timer() - begun
                     )
-                    session.add_event({"type": "CONNECTION_CLOSED"})
+                    session.add_event({"type": attack_session.CONNECTION_CLOSED})
                     stats["processed"] = source.sent
                 except:
                     # Parsing failure.  Suck out some remaining input to give us some context, but don't re-raise
@@ -512,7 +513,7 @@ def handle_udp(self, conn, name, enip_process, session, **kwds):
                         where,
                         "".join(traceback.format_exception(*sys.exc_info())),
                     )
-                    session.add_event({"type": "CONNECTION_FAILED"})
+                    session.add_event({"type": attack_session.CONNECTION_FAILED})
 
     def set_tags(self):
         typenames = {
diff --git a/conpot/protocols/ftp/ftp_base_handler.py b/conpot/protocols/ftp/ftp_base_handler.py
index a93268a4..ce2f39f0 100644
--- a/conpot/protocols/ftp/ftp_base_handler.py
+++ b/conpot/protocols/ftp/ftp_base_handler.py
@@ -19,6 +19,7 @@
 import gevent
 import conpot.core as conpot_core
 from conpot.core.filesystem import FilesystemError
+from conpot.core import attack_session
 import logging
 import errno
 import time
@@ -236,7 +237,7 @@ def setup(self):
                 self.client_address[0], self.client_address[1], self.session.id
             )
         )
-        self.session.add_event({"type": "NEW_CONNECTION"})
+        self.session.add_event({"type": attack_session.NEW_CONNECTION})
         # send 200 + banner -- new client has connected!
         self.respond(b"200 " + self.config.banner.encode())
         #  Is there a delay in command response? < gevent.sleep(0.5) ?
@@ -292,7 +293,7 @@ def handle_cmd_channel(self):
                         self.client_address, self.session.id
                     )
                 )
-                self.session.add_event({"type": "CONNECTION_LOST"})
+                self.session.add_event({"type": attack_session.CONNECTION_LOST})
                 self.finish()
                 return
             socket_read, socket_write, _ = gevent.select.select(
@@ -349,7 +350,7 @@ def handle_cmd_channel(self):
                         self.client_address, self.session.id, se
                     )
                 )
-                self.session.add_event({"type": "CONNECTION_LOST"})
+                self.session.add_event({"type": attack_session.CONNECTION_LOST})
                 self.finish()
 
     def respond(self, response):
diff --git a/conpot/protocols/ftp/ftp_handler.py b/conpot/protocols/ftp/ftp_handler.py
index fe1ed488..c85f2e3f 100644
--- a/conpot/protocols/ftp/ftp_handler.py
+++ b/conpot/protocols/ftp/ftp_handler.py
@@ -12,6 +12,7 @@
 import gevent
 from gevent import socket
 from conpot.core.filesystem import FilesystemError, FSOperationNotPermitted
+from conpot.core import attack_session
 from conpot.protocols.ftp.ftp_utils import FTPPrivilegeException, get_data_from_iter
 
 logger = logging.getLogger(__name__)
@@ -113,7 +114,7 @@ def do_SYST(self, arg):
 
     def do_QUIT(self, arg):
         self.respond(b"221 Bye.")
-        self.session.add_event({"type": "CONNECTION_TERMINATED"})
+        self.session.add_event({"type": attack_session.CONNECTION_TERMINATED})
         self.disconnect_client = True
 
     def do_SITE_HELP(self, line):
@@ -878,7 +879,7 @@ def _process_command(self, cmd, *args, **kwargs):
         if self.invalid_login_attempt >= self.max_login_attempts:
             self.respond(b"421 Too many connections. Service temporarily unavailable.")
             self.disconnect_client = True
-            self.session.add_event({"type": "CONNECTION_TERMINATED"})
+            self.session.add_event({"type": attack_session.CONNECTION_TERMINATED})
         else:
             try:
                 method = getattr(self, "do_" + cmd.replace(" ", "_"))
@@ -936,7 +937,9 @@ def process_ftp_command(self):
                         )
                         # TODO: what to respond here? For now just terminate the session
                         self.disconnect_client = True
-                        self.session.add_event({"type": "CONNECTION_TERMINATED"})
+                        self.session.add_event(
+                            {"type": attack_session.CONNECTION_TERMINATED}
+                        )
             elif not (self.metrics.timeout() < self.config.timeout) and (
                 not self._data_channel
             ):
@@ -945,7 +948,7 @@ def process_ftp_command(self):
                         self.client_address, self.session.id
                     )
                 )
-                self.session.add_event({"type": "CONNECTION_TIMEOUT"})
+                self.session.add_event({"type": attack_session.CONNECTION_TIMEOUT})
                 self.respond(b"421 Timeout.")
                 self.disconnect_client = True
             else:
diff --git a/conpot/protocols/guardian_ast/guardian_ast_server.py b/conpot/protocols/guardian_ast/guardian_ast_server.py
index 296642cc..8af109f8 100644
--- a/conpot/protocols/guardian_ast/guardian_ast_server.py
+++ b/conpot/protocols/guardian_ast/guardian_ast_server.py
@@ -25,6 +25,7 @@
 import logging
 import random
 import conpot.core as conpot_core
+from conpot.core import attack_session
 from conpot.core.protocol_wrapper import conpot_protocol
 from conpot.utils.networking import str_to_bytes
 
@@ -55,7 +56,7 @@ def handle(self, sock, addr):
         logger.info(
             "New GuardianAST connection from %s:%d. (%s)", addr[0], addr[1], session.id
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
         current_time = datetime.datetime.utcnow()
         fill_start = self.fill_offset_time - datetime.timedelta(minutes=313)
         fill_stop = self.fill_offset_time - datetime.timedelta(minutes=303)
@@ -507,7 +508,7 @@ def I20500():
         logger.info(
             "GuardianAST client disconnected %s:%d. (%s)", addr[0], addr[1], session.id
         )
-        session.add_event({"type": "CONNECTION_LOST"})
+        session.add_event({"type": attack_session.CONNECTION_LOST})
 
     def start(self, host, port):
         connection = (host, port)
diff --git a/conpot/protocols/kamstrup_management/kamstrup_management_server.py b/conpot/protocols/kamstrup_management/kamstrup_management_server.py
index 17cf93c3..80746ea0 100644
--- a/conpot/protocols/kamstrup_management/kamstrup_management_server.py
+++ b/conpot/protocols/kamstrup_management/kamstrup_management_server.py
@@ -21,6 +21,7 @@
 import conpot.core as conpot_core
 from .command_responder import CommandResponder
 from conpot.core.protocol_wrapper import conpot_protocol
+from conpot.core import attack_session
 from conpot.utils.networking import str_to_bytes
 
 logger = logging.getLogger(__name__)
@@ -48,7 +49,7 @@ def handle(self, sock, address):
             address[1],
             session.id,
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
 
         try:
             sock.send(
@@ -63,7 +64,7 @@ def handle(self, sock, address):
                 data = sock.recv(1024)
                 if not data:
                     logger.info("Kamstrup client disconnected. (%s)", session.id)
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                     break
                 request = data.decode()
                 logdata = {"request": request}
@@ -79,7 +80,7 @@ def handle(self, sock, address):
                 gevent.sleep(0.25)  # TODO measure delay and/or RTT
 
                 if response is None:
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                     break
                 # encode data before sending
                 reply = str_to_bytes(response)
@@ -87,7 +88,7 @@ def handle(self, sock, address):
 
         except socket.timeout:
             logger.debug("Socket timeout, remote: %s. (%s)", address[0], session.id)
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
 
         sock.close()
 
diff --git a/conpot/protocols/kamstrup_meter/kamstrup_server.py b/conpot/protocols/kamstrup_meter/kamstrup_server.py
index d5779641..df565eab 100644
--- a/conpot/protocols/kamstrup_meter/kamstrup_server.py
+++ b/conpot/protocols/kamstrup_meter/kamstrup_server.py
@@ -26,6 +26,7 @@
 from .request_parser import KamstrupRequestParser
 from .command_responder import CommandResponder
 from conpot.core.protocol_wrapper import conpot_protocol
+from conpot.core import attack_session
 
 logger = logging.getLogger(__name__)
 
@@ -64,7 +65,7 @@ def handle(self, sock, address):
             address[1],
             session.id,
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
 
         self.server_active = True
 
@@ -75,7 +76,7 @@ def handle(self, sock, address):
 
                 if not raw_request:
                     logger.info("Kamstrup client disconnected. (%s)", session.id)
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                     break
 
                 for x in raw_request:
@@ -84,7 +85,7 @@ def handle(self, sock, address):
                 while True:
                     request = parser.get_request()
                     if not request:
-                        session.add_event({"type": "CONNECTION_LOST"})
+                        session.add_event({"type": attack_session.CONNECTION_LOST})
                         break
                     else:
                         logdata = {
@@ -112,7 +113,7 @@ def handle(self, sock, address):
 
         except socket.timeout:
             logger.debug("Socket timeout, remote: %s. (%s)", address[0], session.id)
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
 
         sock.close()
 
diff --git a/conpot/protocols/modbus/modbus_server.py b/conpot/protocols/modbus/modbus_server.py
index 5400b105..93d61834 100644
--- a/conpot/protocols/modbus/modbus_server.py
+++ b/conpot/protocols/modbus/modbus_server.py
@@ -17,6 +17,7 @@
 from conpot.core.protocol_wrapper import conpot_protocol
 from conpot.protocols.modbus import slave_db
 import conpot.core as conpot_core
+from conpot.core import attack_session
 
 logger = logging.getLogger(__name__)
 
@@ -105,7 +106,7 @@ def handle(self, sock, address):
         logger.info(
             "New Modbus connection from %s:%s. (%s)", address[0], address[1], session.id
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
 
         try:
             while True:
@@ -121,17 +122,17 @@ def handle(self, sock, address):
 
                 if not request:
                     logger.info("Modbus client disconnected. (%s)", session.id)
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                     break
                 if request.strip().lower() == "quit.":
                     logger.info("Modbus client quit. (%s)", session.id)
-                    session.add_event({"type": "CONNECTION_QUIT"})
+                    session.add_event({"type": attack_session.CONNECTION_QUIT})
                     break
                 if len(request) < 7:
                     logger.info(
                         "Modbus client provided data {} but invalid.".format(session.id)
                     )
-                    session.add_event({"type": "CONNECTION_TERMINATED"})
+                    session.add_event({"type": attack_session.CONNECTION_TERMINATED})
                     break
                 _, _, length = struct.unpack(">HHH", request[:6])
                 while len(request) < (length + 6):
@@ -169,7 +170,9 @@ def handle(self, sock, address):
                         logger.info(
                             "Modbus connection terminated with client %s.", address[0]
                         )
-                        session.add_event({"type": "CONNECTION_TERMINATED"})
+                        session.add_event(
+                            {"type": attack_session.CONNECTION_TERMINATED}
+                        )
                         sock.shutdown(socket.SHUT_RDWR)
                         sock.close()
                         break
@@ -179,13 +182,15 @@ def handle(self, sock, address):
                             "Modbus client ignored due to invalid addressing." " (%s)",
                             session.id,
                         )
-                        session.add_event({"type": "CONNECTION_TERMINATED"})
+                        session.add_event(
+                            {"type": attack_session.CONNECTION_TERMINATED}
+                        )
                         sock.shutdown(socket.SHUT_RDWR)
                         sock.close()
                         break
         except socket.timeout:
             logger.debug("Socket timeout, remote: %s. (%s)", address[0], session.id)
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
 
     def start(self, host, port):
         self.host = host
diff --git a/conpot/protocols/s7comm/s7_server.py b/conpot/protocols/s7comm/s7_server.py
index a815e0f0..da89166f 100644
--- a/conpot/protocols/s7comm/s7_server.py
+++ b/conpot/protocols/s7comm/s7_server.py
@@ -27,6 +27,7 @@
 from conpot.protocols.s7comm.cotp import COTP_ConnectionConfirm
 from conpot.protocols.s7comm.s7 import S7
 import conpot.core as conpot_core
+from conpot.core import attack_session
 from conpot.core.protocol_wrapper import conpot_protocol
 from lxml import etree
 
@@ -82,14 +83,14 @@ def handle(self, sock, address):
                 address[0], address[1], session.id
             )
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
 
         try:
             while True:
 
                 data = sock.recv(4, socket.MSG_WAITALL)
                 if len(data) == 0:
-                    session.add_event({"type": "CONNECTION_LOST"})
+                    session.add_event({"type": attack_session.CONNECTION_LOST})
                     break
 
                 _, _, length = unpack("!BBH", data[:4])
@@ -283,12 +284,12 @@ def handle(self, sock, address):
                     )
 
         except socket.timeout:
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
             logger.debug(
                 "Socket timeout, remote: {0}. ({1})".format(address[0], session.id)
             )
         except socket.error:
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
             logger.debug(
                 "Connection reset by peer, remote: {0}. ({1})".format(
                     address[0], session.id
diff --git a/conpot/protocols/tftp/tftp_server.py b/conpot/protocols/tftp/tftp_server.py
index c5a0aaf2..fa20b592 100644
--- a/conpot/protocols/tftp/tftp_server.py
+++ b/conpot/protocols/tftp/tftp_server.py
@@ -24,6 +24,7 @@
 from conpot.protocols.tftp import tftp_handler
 from gevent.server import DatagramServer
 import conpot.core as conpot_core
+from conpot.core import attack_session
 from conpot.core.protocol_wrapper import conpot_protocol
 from conpot.utils.networking import get_interface_ip
 from tftpy import TftpException, TftpTimeout
@@ -116,7 +117,7 @@ def handle(self, buffer, client_addr):
                 client_addr[0], client_addr[1]
             )
         )
-        session.add_event({"type": "NEW_CONNECTION"})
+        session.add_event({"type": attack_session.NEW_CONNECTION})
         logger.debug("Read %d bytes", len(buffer))
         context = tftp_handler.TFTPContextServer(
             client_addr[0], client_addr[1], self.timeout, self.root, None, None
@@ -124,13 +125,13 @@ def handle(self, buffer, client_addr):
         context.vfs, context.data_fs = self.vfs, self.data_fs
         if self.shutdown:
             logger.info("Shutting down now. Disconnecting {}".format(client_addr))
-            session.add_event({"type": "CONNECTION_TERMINATED"})
+            session.add_event({"type": attack_session.CONNECTION_TERMINATED})
         try:
             context.start(buffer)
             context.cycle()
         except TftpTimeout as err:
             logger.info("Timeout occurred %s: %s" % (context, str(err)))
-            session.add_event({"type": "CONNECTION_TIMEOUT"})
+            session.add_event({"type": attack_session.CONNECTION_TIMEOUT})
             context.retry_count += 1
             # TODO: We should accept retries from the user.
             if context.retry_count >= self.TIMEOUT_RETRIES:
@@ -148,7 +149,7 @@ def handle(self, buffer, client_addr):
                     context, str(err)
                 )
             )
-            session.add_event({"type": "CONNECTION_LOST"})
+            session.add_event({"type": attack_session.CONNECTION_LOST})
         logger.info("TFTP: terminating connection: {}".format(context))
         session.set_ended()
         context.end()
diff --git a/conpot/protocols/triconex/triconex.xsd b/conpot/protocols/triconex/triconex.xsd
new file mode 100644
index 00000000..98bdc39e
--- /dev/null
+++ b/conpot/protocols/triconex/triconex.xsd
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" attributeFormDefault="qualified" elementFormDefault="qualified">
+    <xs:simpleType name="slot" final="restriction">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="empty" />
+            <xs:enumeration value="com" />
+            <xs:enumeration value="do" />
+            <xs:enumeration value="di" />
+            <xs:enumeration value="him" />
+            <xs:enumeration value="ddo" />
+        </xs:restriction>
+    </xs:simpleType>
+    <xs:element name="triconex">
+        <xs:complexType>
+            <xs:sequence>
+                <xs:element name="slots">
+                    <xs:complexType>
+                        <xs:sequence>
+                            <xs:element type="slot" name="slot1" default="empty"/>
+                            <xs:element type="slot" name="slot2" default="empty"/>
+                            <xs:element type="slot" name="slot3" default="empty"/>
+                            <xs:element type="slot" name="slot4" default="empty"/>
+                        </xs:sequence>
+                    </xs:complexType>
+                </xs:element>
+            </xs:sequence>
+            <xs:attribute type="xs:string" name="enabled" use="required"/>
+            <xs:attribute type="xs:string" name="host" use="required"/>
+            <xs:attribute type="xs:short" name="port" use="required"/>
+        </xs:complexType>
+    </xs:element>
+</xs:schema>
diff --git a/conpot/protocols/triconex/triconex_server.py b/conpot/protocols/triconex/triconex_server.py
new file mode 100644
index 00000000..93ba646c
--- /dev/null
+++ b/conpot/protocols/triconex/triconex_server.py
@@ -0,0 +1,363 @@
+# BSD 3-Clause License
+#
+# Copyright (c) 2018, Nozomi Networks
+# Copyright (c) 2020, MushMush
+#
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import socket
+import struct
+from lxml import etree
+from gevent.server import DatagramServer
+import conpot.core as conpot_core
+from conpot.utils.networking import get_interface_ip
+from conpot.core.protocol_wrapper import conpot_protocol
+from conpot.core import attack_session
+import crcmod
+import time
+import logging
+
+logger = logging.getLogger(__name__)
+cf = crcmod.mkCrcFun(0x18005, rev=True, initCrc=0, xorOut=0)
+
+
+def build_slot(leds0, leds1, model, color):
+    slotfmt = "<" + 32 * "B"
+    return struct.pack(
+        slotfmt,
+        leds0,
+        leds1,
+        model,
+        color,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+    )
+
+
+# Construct slots
+mps = {
+    "active": build_slot(0x15, 0x21, 0xF0, 0x01),
+    "passive": build_slot(0x02, 0x01, 0xF0, 0x02),
+}
+
+slotsdesc = {
+    "empty": build_slot(0, 0, 0, 0),
+    "com": build_slot(5, 33, 55, 1),
+    "do": build_slot(5, 16, 20, 1),
+    "di": build_slot(5, 32, 11, 1),
+    "him": build_slot(5, 22, 53, 1),
+    "ddo": build_slot(0x4F, 0x21, 0x5C, 0x2),
+}
+
+
+def build_chassis_status_response(
+    triconId=0,
+    seq=0,
+    node=2,
+    projname="FIRSTPROJ",
+    activemp=0,
+    mpmodel=1,
+    slots=["com"],
+):
+    # Project segment
+    data = struct.pack(
+        "<HBBHHHIIIHIIccccccccccI",
+        2,
+        0xFF,
+        0x00,
+        1,
+        4,
+        3,
+        int(time.time() - 24 * 3600),
+        200,
+        200,
+        181,
+        0,
+        1,
+        projname[0],
+        projname[1],
+        projname[2],
+        projname[3],
+        projname[4],
+        projname[5],
+        projname[6],
+        projname[7],
+        projname[8],
+        "\0",
+        int(time.time()),
+    )
+
+    # Memory segment
+    data += struct.pack(
+        "<BBBBIIII", 0x56, 0x02, 0x00, 0x00, 8340703, 8251952, 0x1B, 0x32
+    )
+
+    # MPS segment
+    for i in range(3):
+        data += mps["active" if i == activemp else "passive"]
+
+    # Unknown segment
+    data += struct.pack("<HH", 0xA6, 1024)
+
+    # Slots segment
+    for i in range(3):
+        data += mps["active" if i == activemp else "passive"]
+    for s in slots:
+        data += slotsdesc[s] if s in slotsdesc else build_slot(*s)
+    for i in range(13 - len(slots)):
+        data += slotsdesc["empty"]
+
+    return build_packet(triconId, 119, seq, data)
+
+
+def build_CP_status_response(triconId=0, seq=0):
+    """
+    # Collapsed structure
+    data = struct.pack('<' + 186*'B',
+            0x00, 0x01, 0x00, 0x00, 0x0d, 0x00, 0x01, 0x01,
+            0x01, 0x00, 0x00, 0x50, 0x80, 0x00, 0x00, 0x00,
+            0x80, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
+            0x60, 0x00, 0x00, 0x50, 0xfe, 0x00, 0xff, 0xaf,
+            0xff, 0x00, 0x00, 0x20, 0x00, 0x20, 0x00, 0x20,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x1b,
+            0x00, 0x00, 0xc8, 0x00, 0xc8, 0x00, 0xba, 0x00,
+            0x5c, 0x98, 0x00, 0x00, 0x35, 0x00, 0x4f, 0xb6,
+            0xe1, 0x5a, 0x45, 0x4d, 0x50, 0x54, 0x59, 0x00,
+            0xad, 0x05, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x00,
+            0x02, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0xf0, 0x0f, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x4d, 0x61, 0x6e, 0x61,
+            0x67, 0x65, 0x72, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00
+            )
+    return build_packet(triconId, 108, seq, data)
+    """
+
+    data = struct.pack(
+        "<HBBBBBBB",
+        1,
+        0x0,  # loadIn
+        0x0,  # modIn
+        0xD,  # loadState
+        0x0,  # singleScan
+        0x1,  # cpValid
+        0x1,  # keyState
+        0x1,  # runState
+    )
+
+    data += struct.pack("<BBBBB", 0x0, 0x0, 0x50, 0x80, 0x0)
+
+    data += struct.pack(
+        "<IIIII",
+        0x00800000,  # my: 8388608
+        0x00400000,  # us: 4194304
+        0x00600000,  # ds: 6291456
+        0x00FE5000,  # heap_min: 16666624
+        0x00FFAFFF,  # heap_max: 16756735
+    )
+
+    data += struct.pack(
+        "<BBBBBBBBBBBB", 0x0, 0x20, 0x0, 0x20, 0x0, 0x20, 0x0, 0x0, 0x0, 0x00, 0x0, 0x0
+    )
+    data += struct.pack(
+        "<BBBBBBBBBBBB",
+        0x14,
+        0x1B,
+        0x00,
+        0x00,
+        0xC8,
+        0x00,
+        0xC8,
+        0x00,
+        0xBA,
+        0x00,
+        0x5C,
+        0x98,
+    )
+
+    data += struct.pack("<HH", 4, 3)  # Minor, major
+    data += struct.pack("<I", time.time())  # Timestamp
+    data += struct.pack(
+        "<cccccccccc", "E", "C", "C", "E", "C", "C", "A", "H", "H", "\0"
+    )
+
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+    data += struct.pack("<BBBBBB", 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+
+    return build_packet(triconId, 108, seq, data)
+
+
+def build_packet(triconId, funccode, seq, data):
+    # Subheader without checksum
+    datalength = len(data) + 10
+    subheader = struct.pack("<BBBBHHH", 1, 0, funccode, seq, 0, 0, datalength)
+
+    # Compute checksum
+    checksum = datalength
+    for c in subheader:
+        checksum += ord(c)
+    for c in data:
+        checksum += ord(c)
+
+    # Header and subheader with checksum
+    header = struct.pack("<BBH", 5, triconId, datalength)
+    subheader = struct.pack("<BBBBHHH", 1, 0, funccode, seq, 0, checksum, datalength)
+
+    # Entire packet, except CRC
+    packet = header + subheader + data
+
+    # Compute CRC
+    crc = cf(packet)
+    packet += struct.pack("<H", crc)
+
+    return packet
+
+
+def build_tricon_attached(triconId=0, seq=0, string="\x03\x00\x33\x0a\x04\x00"):
+    return build_packet(triconId, 0x6A, seq, string)
+
+
+@conpot_protocol
+class TriconexServer(object):
+    def __init__(self, template, template_directory, args):
+        self.dom = etree.parse(template)
+        self.slots = {}
+        self.get_slots()
+
+    def get_slots(self):
+        slots = self.dom.xpath("//triconex/slots/*")
+        for slot in slots:
+            print(slot)
+
+    def handle(self, data, addr):
+        session = conpot_core.get_session(
+            "triconex",
+            addr[0],
+            addr[1],
+            get_interface_ip(addr[0]),
+            self.server._socket.getsockname()[1],
+        )
+        # mcode, chan, dlen, crc16 = struct.unpack("<BBHH", data[0:6])
+        mcode, _, _, _ = struct.unpack("<BBHH", data[0:6])
+
+        # CONNECT REQUEST
+        if mcode == 0x1:
+            logger.info("CONNECT REQUEST")
+            session.add_event({"type": attack_session.NEW_CONNECTION})
+            # CONNECT REPLY
+            self.server.sendto("\x02\x00\x00\x00\x01\xb8", addr)
+
+        # COMMAND REPLY
+        elif mcode == 0x5:
+            # Get the function code
+            fcode, pseq = struct.unpack("<BB", data[6:8])
+            if fcode == 0xD:
+                logger.info("ATTACH REQUEST")
+                self.server.sendto(build_tricon_attached(), addr)
+            elif fcode == 0x13:
+                # time.sleep(5)
+                logger.info("GET CP STATUS")
+                self.server.sendto(build_CP_status_response(seq=pseq), addr)
+            elif fcode == 0x18:
+                logger.info("GET CHASSIS STATUS")
+                self.server.sendto(
+                    build_chassis_status_response(
+                        seq=pseq,
+                        mpmodel=0,
+                        activemp=2,
+                        slots=[
+                            "com",
+                            self.slots["slot1"],
+                            "empty",
+                            self.slots["slot2"],
+                            "empty",
+                            self.slots["slot3"],
+                            "empty",
+                            self.slots["slot4"],
+                        ],
+                    ),
+                    addr,
+                )
+            else:
+                logger.info("UNKNOWN: %s" % hex(fcode))
+
+    def stop(self):
+        self.server.stop()
+
+    def start(self, host, port):
+        self.server = DatagramServer((host, port), self.handle)
+        self.server.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        logger.info("Triconex server started on: {}:{}".format(host, port))
+        self.server.serve_forever()
diff --git a/conpot/templates/triconex/template.xml b/conpot/templates/triconex/template.xml
new file mode 100644
index 00000000..298c5f49
--- /dev/null
+++ b/conpot/templates/triconex/template.xml
@@ -0,0 +1,13 @@
+<core>
+    <template>
+        <entity name="unit">Triconex</entity>
+        <entity name="vendor">Schneider</entity>
+        <entity name="description">Triconex system</entity>
+        <entity name="protocols">triconex</entity>
+        <entity name="creator">the conpot team</entity>
+    </template>
+    <databus>
+        <key_value_mappings>
+        </key_value_mappings>
+    </databus>
+</core>
diff --git a/conpot/templates/triconex/triconex/triconex.xml b/conpot/templates/triconex/triconex/triconex.xml
new file mode 100644
index 00000000..829b77bc
--- /dev/null
+++ b/conpot/templates/triconex/triconex/triconex.xml
@@ -0,0 +1,8 @@
+<triconex enabled="True" host="0.0.0.0" port="1502">
+  <slots>
+    <slot1>empty</slot1>
+    <slot2>empty</slot2>
+    <slot3>empty</slot3>
+    <slot4>empty</slot4>
+  </slots>
+</triconex>
\ No newline at end of file
diff --git a/conpot/tests/test_triconex.py b/conpot/tests/test_triconex.py
new file mode 100644
index 00000000..ee599634
--- /dev/null
+++ b/conpot/tests/test_triconex.py
@@ -0,0 +1,18 @@
+import unittest
+
+from conpot.utils.greenlet import spawn_test_server, teardown_test_server
+from conpot.protocols.triconex.triconex_server import TriconexServer
+
+
+class TestTriconexServer(unittest.TestCase):
+    def setUp(self):
+        self.triconex_server, self.greenlet = spawn_test_server(
+            TriconexServer, template="default", protocol="triconex"
+        )
+
+    def tearDown(self):
+        teardown_test_server(self.triconex_server, self.greenlet)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/requirements.txt b/requirements.txt
index 7b729187..7dbd94a8 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -27,4 +27,5 @@ freezegun!=0.3.13
 pytest
 pycrypto
 sphinx_rtd_theme
+crcmod==1.7
 psutil