# How do I detect attacks on PLCs in a small factory?

Watch the traffic to and from the controllers, because a programmable logic controller (PLC) keeps almost no security log of its own. The useful signals are simple: a write or a program download from a computer that is not your engineering station, a stop or start command nobody planned, office machines talking directly to controllers, and activity at night or at weekends when nobody works on the line. Begin with the free steps: list which stations may program each PLC, check that the office network cannot reach the control network, and leave the controllers' key switches in run mode where your hardware has them. From the Pro plan, NetSenX reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm from a SPAN or TAP port and raises four kinds of OT alert: unauthorised writes, traffic crossing plant network levels, off-hours OT activity and S7comm commands. It never probes the controllers, and it does not see serial links or segments you do not mirror.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/how-to-detect-attacks-on-plcs-in-a-small-factory

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Why is Modbus considered insecure?](https://netsenx.com/en/faq/why-is-modbus-insecure)
- [How do I know if an unauthorised computer writes to our PLC?](https://netsenx.com/en/faq/how-to-know-if-an-unauthorised-computer-writes-to-a-plc)
- [Which OT alerts matter most for a small factory?](https://netsenx.com/en/faq/which-ot-alerts-matter-most-for-a-small-factory)
- [How do I detect a PLC program change outside working hours?](https://netsenx.com/en/faq/how-to-detect-a-plc-program-change-outside-working-hours)
- [Can network monitoring see an S7 PLC being stopped?](https://netsenx.com/en/faq/can-network-monitoring-see-an-s7-plc-being-stopped)