Monitoring for industrial and SCADA networks through port mirroring or a TAP: the inventory of equipment that communicates, write commands and program downloads to PLCs, every new device and every remote access. No action on the process.
Schedule a 60–90 day pilotHow it worksIP and MAC addresses, vendor, services and ICS protocols for every device seen in traffic — without a single packet sent by us.
Modbus writes, DNP3 select/operate, STOP, S7 program downloads and uploads, IEC-104 and CIP commands: who, when, from which workstation.
Any new address in the process network and any link to the outside or from the outside into ICS, flagged immediately.
In standard mode the sensor receives a copy of the traffic from a mirrored switch port (SPAN) or a TAP: it is not on the data path. Inline (an IP-less bridge between router and switch) is available for evaluations, with the client's written consent, because a power loss or a sensor failure interrupts the link.
Traffic is copied to the sensor. The process notices nothing, whatever happens to the sensor.
Software bridge without an IP address; forwarded traffic never touches the packet filters. Measured at our office: 0 frames emitted by the sensor in 120 s, 0 packets dropped, ports at 1000/full.
The sensor is managed only through its own 4G modem and a dedicated encrypted tunnel; it asks nothing from the client's network.
Versions and services read from traffic (SSH, HTTP, TLS, SMB, SNMP, ENIP identity, LLDP) → correlated offline with known CVEs, no active scanning.
Modbus (write, diagnostics, identity), DNP3 (select, operate, direct operate, restart, stop), S7 (STOP, write, program download/upload, PI), IEC-104 (commands, reset), CIP (write, reset).
Any new address in the process network, remote access from outside, ICS → Internet links, Telnet and clear-text protocols.