What does "never actively probed" mean for our controllers?

It means the sensor never sends a packet to a device classified as OTOT: operational technology. The computers that run machines, production lines, building systems and utilities.: no discovery scan, no port scan, no protocol query, no login attempt. It only reads a copy of the traffic your own systems already exchange, taken at a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. port or a network TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch.. Active tools work differently: they ask each device questions, and some older PLCs, RTUs and HMIs react badly to unexpected requests, from slow responses to crashes. For a plant manager, the practical meaning is that switching on NetSenX adds no traffic to the control network and cannot change a controller's state, so nothing on the controllers needs a maintenance window. The trade-off is that a passive sensor only knows what devices say: a controller that never communicates on a mirrored segment is not seen. OT monitoring is available from the Pro plan.

← All 50 questions on OT and IoTAll topics