# How do I check that our office network cannot reach production controllers?

Test it, then watch it. For the test, take an ordinary office laptop and, with the OT engineer's agreement, try to open a connection to a controller's address and port and to the HMI and SCADA servers; use a simple connection test, never a scanner, against production devices. Review the firewall rules between office and production for broad rules and for old exceptions nobody can explain. Then watch real traffic for a few weeks, because the routes that matter are often the forgotten ones: a PC with one network card in each network, a supplier's VPN that ends inside production, a wireless bridge. From the Pro plan, NetSenX flags traffic that crosses levels of the plant network, such as an office host reaching a controller, so a path that should not exist shows up the first time it is used. A path that exists but is never used stays invisible to any passive sensor.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/how-to-check-the-office-network-cannot-reach-production-controllers

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Can a ransomware attack on office IT stop a production line?](https://netsenx.com/en/faq/can-ransomware-on-office-it-stop-a-production-line)
- [How do we control maintenance laptops that connect to our production network?](https://netsenx.com/en/faq/how-to-control-maintenance-laptops-on-the-production-network)
- [Can we see which controllers a visiting technician's laptop talked to?](https://netsenx.com/en/faq/can-we-see-which-controllers-a-technicians-laptop-talked-to)
- [How should remote access to OT by vendors and integrators be secured?](https://netsenx.com/en/faq/how-should-vendor-remote-access-to-ot-be-secured)
- [Are vendor 4G routers in machine cabinets a security risk?](https://netsenx.com/en/faq/are-vendor-4g-routers-in-machine-cabinets-a-risk)