Can network monitoring break our PLCs?
Passive monitoring cannot, because it only listens to a copy of the traffic and never sends anything to the controllers. Active scanning is a different matter: some older PLCs and remote terminal units crash, reboot or drop into a fault state when a discovery tool or vulnerability scanner probes them, which is why many plants keep scanners off the control network. Take the copy from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. port on an industrial switch or from a passive network TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch., and check with the switch vendor that mirroring will not overload an old switch. NetSenX reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm from passive capture, from the Pro plan, and never actively probes devices classified as OTOT: operational technology. The computers that run machines, production lines, building systems and utilities.. Nothing is installed on the controllers and none of their settings change.
Read next
Related questions
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.