OT Secure Systems — Passive OT/ICS Network Analysis

What it does

From a capture file to a finished security assessment.

Every stage below runs from the same pipeline — asset discovery, protocol parsing, classification, detection, and reporting stay in sync because they're the same run, not separate tools stitched together.

01

Asset discovery & classification

Automatically identifies PLCs, HMIs, SCADA servers, and engineering workstations from observed traffic — no manual asset inventory to keep up to date.

02

Deep protocol parsing

Purpose-built parsers across the major industrial protocols and PLC vendors — Modbus, EtherNet/IP (CIP), DNP3, IEC 60870-5-104, S7comm, PROFINET DCP, OPC UA, BACnet/IP, MMS/IEC 61850, Mitsubishi SLMP, Omron FINS, Beckhoff ADS, GE SRTP, CODESYS — plus the surrounding IT protocols (ARP, DNS, SNMP, TLS, HTTP, FTP, SMB) that show up on the same segments.

03

30+ security rules

Checks for insecure legacy protocols reaching control assets, cleartext credentials, unexpected control masters, weak segmentation, default community strings, and more.

04

Automatic topology mapping

Builds the network diagram from the traffic itself — segments, assets, and the relationships between them — so the map reflects what's actually on the wire.

05

Actionable findings, not raw alerts

Every finding ships with the evidence behind it and a concrete remediation step — written for someone running a plant, not sifting through a SOC queue.

06

Client-ready output

A formatted PDF report and an offline interactive topology view are generated on every run — ready to hand to a plant manager or attach to an audit.

Real output, not a mockup

This is an actual topology view from a real capture.

308 assets across 9 network segments, mapped automatically from a single packet capture — no manual diagramming, no live access to the network it describes. Open the full version to pan, zoom, and click into it yourself.

308

Assets identified

259

CIP devices (EtherNet/IP)

9

Network segments

605

Mapped relationships

topology.html — generated offline, fully self-contained Open full sample ↗

OT Analyzer topology view — role-based layout showing SCADA server, operator/HMI, and DNS infrastructure groupings

Sample findings

What a run actually surfaces.

Every finding is tied to real evidence — a specific flow, protocol, and pair of assets — not a generic vulnerability score.

OT-003 Info

Direct industrial-control communication observed

Engineering workstation ENG-WS-04 initiated industrial-protocol traffic directly to PLC-104, bypassing SCADA-SRV's usual fan-out pattern — reported as an architecture observation, not inherently a problem.

Modbus/TCP

OT-004 Medium

Insecure HTTP traffic to a PLC

Unencrypted management traffic reached a control asset — credentials and commands travel in the clear. The same rule also flags Telnet and FTP to a PLC.

HTTP

OT-006 High

Cleartext credentials observed in FTP traffic

An FTP PASS command was captured on the wire. Credential values are never included in the report itself.

FTP

OT-007 High

Remote administration to internal endpoint(s)

An RDP session reached a device classified as a PLC — severity escalates to High specifically because the endpoint is a control-system asset, not just because it's remote administration.

RDP

OT-011 Low

SMB traffic directed at a PLC

File-sharing traffic reached a device classified as a PLC — worth confirming this is expected engineering activity.

SMB

OT-014 Low

External NTP communication observed

An internal OT asset is time-syncing against a server outside the network.

NTP

Why it's different

Built for how OT networks actually behave — not adapted from IT security.

Most tools in this space either need agents on hardware you can't touch, or bolt ICS support onto an IT product. OT Analyzer starts from a capture file and a rules engine designed around real plant-floor traffic.

Fully passive, no agents

Point it at a packet capture from a SPAN or mirror port you already have — nothing gets installed on a PLC, HMI, or engineering workstation, and nothing touches the OT network live.

Deterministic, testable rules engine

Every asset and flow is evaluated against fixed, explainable logic — the same capture always produces the same findings. No black-box scoring, no opaque model deciding what's a risk.

Engineered against real capture artifacts

Mirrored traffic misbehaves — RSPAN re-tags frames with its own VLAN ID as they cross the network. OT Analyzer checks each VLAN's device subnets for that pattern automatically, instead of reporting a false segmentation problem.

Deliverables that don't need the cloud

A client-ready PDF report and a self-contained, interactive topology map — zero external scripts, zero CDN calls. Opens offline, which matters when the environment you're reporting on is air-gapped.

Beyond asset discovery

It also identifies what SCADA software is actually running.

Every SCADA server and workstation gets fingerprinted from its own service-port behavior — never from a single generic industrial port alone. It currently recognizes:

Inductive Automation Ignition AVEVA System Platform / Wonderware AVEVA Plant SCADA / Citect GE Proficy iFIX GE Vernova CIMPLICITY Schneider EcoStruxure Geo SCADA Expert / ClearSCADA COPA-DATA zenon ICONICS GENESIS64 Siemens WinCC Open Architecture Siemens WinCC Unified Siemens WinCC Professional Rockwell FactoryTalk View SE VTScada

Real example — from the capture above

AVEVA Plant SCADA / Citect

Confidence: High

Identified because the SCADA server exposed 3 or more of the Citect/Plant SCADA runtime-family TCP ports (2080, 2082, 2084, 2085, 5482) — a distinctive multi-port cluster, not a single generic port. A single match would only earn Medium confidence; this one cleared the High bar.

Asset classification

It won't force a device into a role the evidence doesn't support.

Every asset gets a Primary Role once the evidence is strong enough to justify it. When it isn't, OT Analyzer reports a confidence-based Possible Role instead of guessing — or leaves the asset Unknown rather than forcing an identification it can't back up.

Primary roles — confirmed by strong evidence

Unknown

Insufficient evidence was observed to reliably determine a specific asset role. OT Analyzer keeps the asset unclassified rather than forcing an unsupported identification.

Industrial Control Initiator

An asset observed initiating industrial communications with one or more OT endpoints — may be a SCADA server, HMI, engineering workstation, gateway, or another control system.

CIP Device

An endpoint observed participating as a device in CIP/EtherNet/IP communications. CIP participation alone does not establish that the asset is a PLC.

PLC/Controller

An industrial controller identified through sufficiently strong evidence, such as explicit device identity information or protocol behavior specifically consistent with a programmable controller.

Remote I/O Adapter

An industrial device identified as providing remote I/O functionality and exchanging process I/O data with a controller.

CIP Communications Adapter

A CIP device whose evidence indicates an industrial communications or network-adapter function rather than a PLC/controller function.

Modbus Device

An endpoint observed operating as a device/server in Modbus communications. Modbus participation alone does not identify it as a PLC, RTU, or other specific hardware type.

UPS / Power Device (Modbus)

A Modbus device whose observed characteristics are consistent with a UPS, power-management device, or related electrical infrastructure.

DNP3 Outstation

An endpoint observed operating as a DNP3 outstation, typically responding to communications initiated by a DNP3 master or control system.

IEC-104 Device

An endpoint observed participating as a field/server-side device in IEC 60870-5-104 communications — may be an RTU, IED, or another IEC-104 endpoint.

S7 Device

An endpoint observed participating as a device in S7 communications. S7 participation alone does not automatically establish the physical device as a PLC.

PROFINET Device

An industrial asset identified through PROFINET communications or discovery behavior and observed participating as a device on a PROFINET network.

OPC UA Server

An asset observed providing OPC UA services to other systems — potentially supplying or brokering industrial data for SCADA systems, HMIs, historians, or other clients.

BACnet BBMD

An asset observed performing BACnet Broadcast Management Device functions used to distribute BACnet broadcast communications across IP networks.

SCADA Server

An asset with sufficient evidence to infer a SCADA server function based on industrial communication patterns combined with additional platform, service, or architectural evidence.

SCADA Client/Workstation

An asset whose observed behavior is consistent with a SCADA client, operator workstation, or engineering workstation.

DNS Server

An asset observed providing Domain Name System services to other devices on the network.

NAS / File Server

An asset whose observed network behavior is consistent with network-attached storage or file-serving functionality.

Possible roles — confidence-based, hover for details

These fill the gap when evidence points toward a function but isn't strong enough to promote the asset to a definitive Primary Role.

Industrial Control Endpoint Probable PLC / RTU Probable PLC/Controller Probable RTU / IED Probable Remote I/O Adapter CIP I/O Device S7comm Client / PG-OP Station IEC-104 Client / Master OPC UA Client BACnet Device BACnet Foreign Device Possible NAS / Storage Appliance Server/storage infrastructure

How it works

One pipeline, five stages.

Capture your traffic once. Everything downstream — assets, findings, diagrams, and the report — comes from that same run.

STAGE 1

Capture

Bring a .pcap from an existing SPAN/mirror port. No new hardware, no live traffic injection.

STAGE 2

Parse

Protocol-aware parsers reconstruct flows, device identities, and industrial-protocol activity.

STAGE 3

Classify

Assets are assigned roles — PLC, HMI, SCADA server, workstation — from how they actually behave.

STAGE 4

Detect

The rules engine evaluates every asset and flow against 30+ OT-specific security checks.

STAGE 5

Report

A PDF report and an offline interactive topology map are written out automatically.

Getting a capture

Don't have a capture file yet? Here's how to get one.

You don't need new hardware or a live connection to the OT network — just a copy of traffic that's already crossing a switch you control.

01

Ask for a SPAN or mirror port

Most managed switches near your PLCs, HMIs, or SCADA server support port mirroring. Ask whoever manages that switch to mirror the relevant port(s) to a spare one — production traffic is untouched.

02

Connect a laptop, not a new device

Plug a laptop running Wireshark or tcpdump into the mirror port. Nothing is installed on the PLCs, HMIs, or workstations, and nothing sends traffic back into the OT network.

03

Record a normal working window

Capture for at least 30–60 minutes during regular operation — long enough to see typical polling cycles, HMI-to-PLC traffic, and any periodic maintenance or backup jobs.

04

Save it as a standard .pcap or .pcapng file

No special export or conversion step — this is the same file Wireshark or tcpdump already produce.

Get a demo

Try it yourself, on your own capture.

We'll send you a demo version of OT Analyzer so you can run it against your own environment — the demo version analyzes a limited number of packets per capture. If you'd rather see it run live first, we're happy to walk you through it.

› Demo version, limited packets per capture, no obligation.

› Run it yourself, on your own environment, at your own pace.

› Want a live walkthrough instead? We'll set one up.

Full name

Work email

Company

Role

Site / industry

What are you hoping to see? (optional)

We'll only use this to schedule your demo.

✓

Request received

Thanks — someone from OT Secure Systems will reach out within one business day with your demo version.

See exactly what's talking to your PLCs — before someone else finds out first.