TREN
Schedule a MeetingSchedule a Meeting

OT and ICS Security

OT Asset and Communication Discovery

We map the devices on your control network and their communications without interacting with the devices.

Schedule a MeetingAll services in this area

What it is

Passive discovery listens to traffic copied by port mirroring (SPAN) on a network switch. It decodes industrial protocols to determine which device communicates with which. No queries are sent to devices, so production is not affected. In industrial environments, passive methods are the standard approach for this work.

Scope

  • Listening to network traffic collected via port mirroring (SPAN)
  • Inventory of IP-addressable assets, including PLCs, RTUs, HMIs, and SCADA servers
  • Map of which device communicates with which, and over which protocol
  • Identification of industrial protocols such as Modbus, DNP3, and OPC UA
  • Flagging unexpected internet and external connections on the control network

The need

When organizations need it

  • When the devices on the control network of an acquired plant are unknown.
  • When the production network will be connected to the corporate network or cloud and the current state must be mapped first.
  • When an audit or internal review requests an asset inventory and network map.

Method

How we work

  1. Listening point

    With your operations team, we select port mirroring points on the switches. We only listen to the traffic.

  2. Decoding

    We separate industrial protocols from the collected traffic and identify each device and the direction of each communication.

  3. Map

    We produce the asset inventory and communication matrix and flag unexpected connections.

Outcome

What you have at the end

An inventory listing every device on your control network and a communication map showing their interactions. This map forms the basis for your segmentation and monitoring decisions.

Frequently asked questions

Can discovery affect production?

No. The work only listens to copied traffic. No queries are sent to devices, so controllers do not receive unexpected requests.

Does passive listening miss anything?

The passive method only detects devices that communicate. For silent devices, we supplement with interviews with your operations team and a configuration review.

OT and ICS Security

Other services in this area

Let's talk about this service.

Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.

Schedule a Meeting