Do we need to change anything on our PLCs to monitor them?
No. Passive monitoring needs no software, configuration or firmware change on the PLCs, HMIs or drives. The change happens on the network: a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. (mirror) port on a managed switch, or a passive TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. on a cable, sends a copy of the traffic to a small computer that runs the sensor. Plan that change like any other on the production network: agree it with the OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. engineer, check that the switch can mirror the ports you need without overload, and make it in a maintenance window if your rules require one. Then decide where the sensor host sits and how it sends alerts out, ideally through a firewall rule that allows only that. With NetSenX, the agent runs on a Linux host you choose and reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm from the Pro plan; one agent on a mirror port counts as one device.
Read next
Related questions
- What if our production switch has no SPAN port?
- Can we monitor a machine without installing any software on it?
- Should the OT network be separated from the office network?
- What is the Purdue model, and why does cross-level traffic matter?
- How do I check that our office network cannot reach production controllers?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.