// service · Assessment Technology
Passive OT network capture and analysis
Read the plant network without touching it
Passive SPAN capture turned into a device inventory, flow matrix, and boundary audit. About 81 industrial protocols parsed offline, nothing installed.
// how the engagement runs
- 01
Tap point selection
We choose capture points from the architecture, such as the core switch, distribution, firewall interfaces, and IDMZ boundary, for what they prove.
- 02
Passive capture
A SPAN or port mirror feeds a passive collector with no address on the monitored interface. Capture windows are sized to production cycles.
- 03
Protocol parsing
Zeek with ICS protocol analyzers parses the captures against a catalog of about 81 industrial protocols.
- 04
Entity and flow resolution
We resolve devices, join them to host and firewall evidence by site and address, and classify each flow by the zone boundary it crosses.
// who does the work
Led by senior OT practitioners
-
Engagement lead
-
Lead assessor
-
Security engineer and architect
-
Analyst
Port mirroring tells you the truth about what talks on a plant network. It also produces a pile of capture files that sit unread, and visibility projects stall in the gap between capture and answer.
We work the analysis side. Captures come off your SPAN ports, and we return a device list, a flow map, and a boundary audit. Every finding carries the capture segment and timestamp behind it.
Limits we state up front
- A capture is a snapshot. A line that was not running during the window does not appear, and the report says which windows we covered.
- All analysis runs offline, on an analyst workstation, from files your team hands over.
- We scope deep protocol inspection to what your environment needs. For infrastructure questions, we keep the scope smaller.
Start with two tap points and a 72-hour window to prove the method on one plant. Passive capture is one of four evidence sources in OT asset discovery and network visibility. Joined to a firewall policy and log analysis, it shows observed flows that no permit rule allows. Book a consultation to plan the taps.
// after the engagement
The findings keep moving
Clients who want help running the fixes can put the findings in Resilion, the platform we use to run programs. Each fix gets a named owner at a named site, and the evidence lands as it closes.
See how Resilion works
// FAQ
Questions about Passive OT network capture and analysis
- Do you install anything on our switches?
- No. Your team creates a SPAN or port mirror session, and the collector listens with no IP address on the monitored interface. It originates no frames, and the SPAN session is yours to remove.
- Which industrial protocols do you parse?
- We use Zeek with ICS protocol analyzers, backed by a research catalog of about 81 industrial protocols, including EtherNet/IP and CIP, S7, Modbus, DNP3, and PROFINET.
- How long is the capture window?
- We size it to your production cycles. A pilot usually uses two tap points, one core switch and one boundary, over 72 hours. A line that was not running during the window will not appear, and the report lists which windows were covered.
Talk to the people who do this work
Thirty minutes with a senior OT security practitioner. We confirm fit, plant scope, and who should be in the room. If it is not a match, we say so.