# Do we need to change anything on our PLCs to monitor them?

No. Passive monitoring needs no software, configuration or firmware change on the PLCs, HMIs or drives. The change happens on the network: a SPAN (mirror) port on a managed switch, or a passive TAP on a cable, sends a copy of the traffic to a small computer that runs the sensor. Plan that change like any other on the production network: agree it with the OT engineer, check that the switch can mirror the ports you need without overload, and make it in a maintenance window if your rules require one. Then decide where the sensor host sits and how it sends alerts out, ideally through a firewall rule that allows only that. With NetSenX, the agent runs on a Linux host you choose and reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm from the Pro plan; one agent on a mirror port counts as one device.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/do-we-need-to-change-anything-on-our-plcs-to-monitor-them

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [What if our production switch has no SPAN port?](https://netsenx.com/en/faq/what-if-the-production-switch-has-no-span-port)
- [Can we monitor a machine without installing any software on it?](https://netsenx.com/en/faq/can-we-monitor-a-machine-without-installing-software-on-it)
- [Should the OT network be separated from the office network?](https://netsenx.com/en/faq/should-ot-be-separated-from-the-it-network)
- [What is the Purdue model, and why does cross-level traffic matter?](https://netsenx.com/en/faq/what-is-the-purdue-model)
- [How do I check that our office network cannot reach production controllers?](https://netsenx.com/en/faq/how-to-check-the-office-network-cannot-reach-production-controllers)