Can we monitor a machine without installing any software on it?
Yes. Anything the machine does on the network can be watched from outside, from a copy of its traffic taken at a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. port or a TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch.. That is the usual approach for controllers, HMIs, test benches, medical devices and any system whose supplier forbids changes or ties the warranty to them. What you see is its behaviour: which hosts it talks to, at what times, how much data and, in the decoded industrial protocols, what it asks the controllers to do. What you do not see is what happens inside it: files, processes and local logins stay hidden, and so does traffic on links that are not mirrored. NetSenX works this way: one agent on a mirror port watches the whole segment and counts as one device. Beaconing, scanning, lateral movement and unusual outbound volume are flagged on every plan; the OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. protocols and OT alerts come with the Pro plan.
Read next
Related questions
- Should the OT network be separated from the office network?
- What is the Purdue model, and why does cross-level traffic matter?
- How do I check that our office network cannot reach production controllers?
- Can a ransomware attack on office IT stop a production line?
- How do we control maintenance laptops that connect to our production network?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.