# What does an MSP need to monitor a client's PLCs passively?

A copy of the production network's traffic, a host for the sensor, the plant's permission, and a plan that does not touch the controllers. Find a managed switch in the production network that supports port mirroring, or use a network TAP on the link between the controllers and their engineering station or HMI. Connect a Linux host running the NetSenX agent to that mirror port, on a client tenant with the Pro plan or higher. Agree a maintenance window with the plant manager, even though passive monitoring sends nothing to the PLCs. Record which segments are covered and which are not. Then review the first weeks of OT alerts with the client's engineers, who know which writes and commands are expected.

FAQ: [MSPs and MSSPs](https://netsenx.com/en/faq/msp) · https://netsenx.com/en/faq/what-does-an-msp-need-to-monitor-a-clients-plcs-passively

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/partners

## Related questions

- [What happens to a client's security data when they change MSP, and can they export or delete it?](https://netsenx.com/en/faq/what-happens-to-a-clients-security-data-when-they-change-msp)
- [What is the difference between an MSP and an MSSP?](https://netsenx.com/en/faq/what-is-the-difference-between-an-msp-and-an-mssp)
- [Can an MSP use NetSenX for several customers?](https://netsenx.com/en/faq/can-an-msp-use-netsenx-for-several-customers)
- [Can an MSP manage many client networks in one NetSenX account?](https://netsenx.com/en/faq/can-an-msp-manage-many-client-networks-in-one-netsenx-account)
- [How are MSP clients kept separate in a multi-tenant security tool?](https://netsenx.com/en/faq/how-are-msp-clients-kept-separate-in-a-multi-tenant-security-tool)