ot-ics

Use a passive-first approach: capture traffic via SPAN or mirror ports, analyze it with Wireshark industrial protocol dissectors, and audit configurations offline. Only perform low-rate active probing during approved maintenance windows with explicit written authorization.

Common protocols include Modbus/TCP on port 502, S7comm on port 102, EtherNet/IP on port 44818, and DNP3 on port 20000. These protocols often lack authentication, so exposure should be documented as a finding rather than exploited.

No, not by default. Writing coils or registers to a PLC is prohibited unless the written authorization explicitly permits it, because misoperation in industrial environments can cause physical harm. Read-only function codes are the default.

Wireshark with industrial dissectors handles passive protocol parsing, Nmap NSE scripts allow restricted identification, and vendor engineering software supports offline configuration audits. For firmware, binwalk and Ghidra enable offline image analysis without flashing devices.

Avoid high-rate scanning of production OT networks and any interaction with safety instrumented system paths. Active techniques are only acceptable within authorized segments, at low rates, and during agreed maintenance windows with rollback plans.