OT / ICS

OT network monitoring without touching the controllers

Passive OT network monitoring means reading industrial traffic from a copy of it, taken at a SPAN port or a network TAP, without sending a single packet to a PLC, RTU or SCADA server. Nothing is installed on the controllers and nothing on them changes, which is why it is the usual way to add visibility to production networks that cannot be patched, rebooted or scanned at will.

The fact to plan around

On 1 December 2023, CISA and partner agencies reported in advisory AA23-335A that IRGC-affiliated actors had compromised Unitronics PLCs used in US water and wastewater facilities. The PLCs were likely reachable from the internet and still used the manufacturer's default password.

Source: CISA and partners — Advisory AA23-335A (IRGC-affiliated actors exploit PLCs in multiple sectors, including US water and wastewater facilities), 1 December 2023

How passive OT monitoring works

The principle is simple: listen to a copy of the traffic, never talk to the devices.

  1. 01Mirror, don't probe

    A SPAN port on the industrial switch, or a passive TAP on the link, sends a copy of the traffic to the sensor. The sensor only listens; it never queries a device, so it cannot disturb a process.

  2. 02Read the industrial protocols

    Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm carry reads, writes and commands in structures a sensor can decode. Reading them shows which station talks to which controller and what it asks for.

  3. 03Watch the boundary between IT and OT

    Many OT incidents start in the office network. Traffic that crosses from IT into the control network, or a controller that suddenly talks to the internet, deserves attention.

  4. 04Keep OT devices out of active scans

    Active vulnerability scans and discovery probes can upset older controllers. Exclude devices classified as OT from them; NetSenX never probes them.

What NetSenX does today

  • From the Pro plan, reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm from passive capture on a SPAN or TAP port. The OT alerts it raises: a write to a controller from a host that is not allowed to write, traffic that crosses Purdue levels, OT activity outside working hours, and S7comm commands.
  • Never actively probes devices classified as OT, so there is no risk to PLCs or SCADA systems.
  • Shows OT traffic in the same dashboard as the IT network, with a plain-language explanation on every alert and NIS2 Article 23 deadline tracking for incidents.
  • Runs as software on a host you choose, connected to the mirror port: there is no NetSenX appliance to buy, and one agent watching a segment counts as one device.

What NetSenX does not do

NetSenX does not change controller configuration, push firmware or block industrial commands, and it is not a safety system: it informs your engineers, it does not act on the process. It reads the five industrial protocols named on this page; ask us before relying on any other. It sees only the segments you mirror to it, and serial fieldbus links that never reach Ethernet are out of its view. There is no separate anomaly alert per industrial protocol.

Questions buyers ask

Can you monitor an OT network without affecting PLCs?

Yes, with passive monitoring: the sensor reads a copy of the traffic from a SPAN port or TAP and never sends anything to the controllers. NetSenX works this way from the Pro plan, and never actively probes devices classified as OT.

Which industrial protocols does NetSenX read?

Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm, from passive capture, on the Pro plan and above.

Do I need a hardware appliance on every site?

No NetSenX appliance is needed: the agent is software that runs on a host you choose. One agent connected to a SPAN or TAP port watches the whole segment and counts as one device.

Does NIS2 cover OT networks?

NIS2 applies to entities in sectors such as energy, transport, drinking water, health and the manufacture of certain products (Annexes I and II of Directive (EU) 2022/2555). Its Article 21 measures concern the network and information systems an entity uses for its operations, which can include OT. Check the scope with your national authority.

Sources

  1. CISA and partners — Advisory AA23-335A (IRGC-affiliated actors exploit PLCs in multiple sectors, including US water and wastewater facilities), 1 December 2023
  2. Directive (EU) 2022/2555 (NIS2), Articles 21, 23 and 41 — EUR-Lex

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

Related pages

Try NetSenX on your own network

Start on the Free plan with up to 3 devices, or book a 20-minute demo.

See pricingBook a demo