# How do I know if an unauthorised computer writes to our PLC?

You need something that reads the industrial protocol on the wire and knows which hosts may write, because the PLC will normally accept the write without complaint and log nothing. First write down which stations should ever change a setting: usually one or two engineering workstations and the SCADA or HMI servers. Then make the network enforce it where you can, with firewall rules that let only those hosts reach the controllers. Monitoring covers what the rules miss: a laptop plugged into the line, an office PC with a forgotten route, malware on an allowed station. From the Pro plan, NetSenX reads write requests from passive capture on a SPAN or TAP port and raises an alert when a write comes from a host that is not allowed to write, naming the source, the controller, the function and the time. It does not record the value written or which person was at the keyboard.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/how-to-know-if-an-unauthorised-computer-writes-to-a-plc

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Which OT alerts matter most for a small factory?](https://netsenx.com/en/faq/which-ot-alerts-matter-most-for-a-small-factory)
- [How do I detect a PLC program change outside working hours?](https://netsenx.com/en/faq/how-to-detect-a-plc-program-change-outside-working-hours)
- [Can network monitoring see an S7 PLC being stopped?](https://netsenx.com/en/faq/can-network-monitoring-see-an-s7-plc-being-stopped)
- [Can network monitoring show who changed a PLC setpoint?](https://netsenx.com/en/faq/can-network-monitoring-show-who-changed-a-plc-setpoint)
- [Does NetSenX record the values written to our controllers?](https://netsenx.com/en/faq/does-netsenx-record-the-values-written-to-controllers)