Monitoring OT networks safely: passive monitoring and asset discovery
In short: OT monitoring watches industrial network traffic without touching the devices. Copies of traffic from SPAN ports or TAPs feed sensors that decode industrial protocols, build an asset inventory and learn normal behaviour. Alerts on new devices, program changes and unusual commands give early warning of attacks and mistakes.
Why OT monitoring is different
In IT you install agents on endpoints and scan the network on a schedule. In OT, controllers rarely support agents, and active scans can freeze older devices. Yet visibility is the foundation of every other control: you cannot protect assets you do not know about. The answer is passive monitoring, which observes copies of network traffic and never sends anything to the devices.
Getting the traffic
- SPAN (Switched Port Analyzer), or port mirroring, copies traffic from chosen ports or VLANs to a monitoring port. It is cheap and uses existing switches, but a busy switch may drop mirrored packets.
- Network TAP (test access point) is a hardware device placed in a link that copies every packet. It is more reliable and cannot inject traffic, but needs a brief outage to install.
- Placement: start at the IT/OT boundary and the links between level 2 and level 1, where commands to controllers pass.
Use a dedicated, receive-only interface on the sensor with no IP address, so it cannot be used as a path into OT.
# Cisco-style switch: mirror the controller VLAN to the sensor port
monitor session 1 source vlan 31 both
monitor session 1 destination interface GigabitEthernet1/0/24
# On the Linux sensor: capture a baseline, then analyse it with Zeek
sudo ip link set eth1 up promisc on
sudo tcpdump -i eth1 -w ot-baseline.pcap
zeek -C -r ot-baseline.pcapAsset discovery and baselining
A sensor that understands industrial protocols can identify vendors, models and often firmware versions from normal traffic, building an inventory automatically. Over days or weeks it learns a baseline: which hosts talk to which, on what protocols and function codes, and how often. Industrial networks are predictable, so deviations stand out far more clearly than in IT.
| Alert on | Why it matters |
|---|---|
| New device or new talker | Unauthorised laptop, rogue access point or attacker foothold |
| PLC program download or mode change | Logic change, legitimate or malicious; should match a change ticket |
| Write commands from an unexpected host | Only the SCADA server or engineering workstation should write |
| IT protocols in OT (RDP, SMB from outside) | Possible lateral movement from the business network |
| Internet-bound connections from OT | Malware command-and-control or misconfiguration |
| Firmware update traffic | Should only happen in planned maintenance windows |
Tools and integration with the SOC
Open-source options include Zeek and Suricata, which have parsers or rules for several industrial protocols, and Malcolm, a free network analysis suite published by the Idaho National Laboratory with CISA support that bundles these tools. Commercial OT security platforms add deep protocol coverage, vulnerability matching and vendor-specific knowledge. Whatever you use, send alerts to the SOC (security operations centre), but make sure analysts have OT playbooks: the right response to a suspicious PLC write is to call the control room, not to isolate the controller.
- Agree scope, tap points and responsibilities with operations and engineering.
- Deploy sensors passively and let them learn for a few weeks.
- Review the discovered inventory with engineers and correct it.
- Tune alerts so each one is meaningful and has an owner.
- Write joint IT/OT response playbooks and test them in tabletop exercises.
Tip: only monitor networks you are authorised to monitor. Even passive capture of industrial traffic needs written approval from the asset owner, and captures may contain sensitive process data, so store them securely.
Practice
Why is a network TAP often preferred over SPAN for OT monitoring?
Your sensor alerts on a PLC program download at 02:00. What should happen first?
Why does baselining work well in OT?
Key takeaways
- Passive monitoring sees OT traffic without touching fragile devices.
- Use SPAN or, preferably, TAPs at the IT/OT boundary and controller links.
- Protocol-aware sensors build an asset inventory and learn a baseline.
- Alert on new devices, program changes, unexpected writes and internet traffic.
- Feed alerts to the SOC with OT-specific playbooks and engineering involvement.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.