I want to implement an IDS for our SCADA network to detect potential cyberattacks or misconfigurations. However, some of our protocols like Modbus and Profinet are very sensitive to jitter. Will passive monitoring tools cause any interference with the real-time performance of our industrial control loops? What tools do you recommend?
3 answers
You must use "Passive" monitoring. Unlike IT where you might use active scanning (like Nmap), active scans in OT can actually crash older PLCs because they can't handle the unexpected traffic volume. Passive tools like Nozomi Networks, Claroty, or Dragos work by tapping into a SPAN port or a network TAP on your switch. They just "listen" to a copy of the traffic. Because they don't inject any packets into the stream, they have zero impact on latency or jitter. This allows you to build a baseline of what "normal" communication looks like so the system can alert you if a controller suddenly starts talking to an unknown external IP.
Do these passive tools support proprietary industrial protocols, or do they only work with common ones like Modbus TCP and Ethernet/IP?
Passive monitoring is a game changer. It’s like having a security camera for your network that doesn't slow down the people walking through the hallway.
Perfect analogy, Thomas. It’s the only way to get deep visibility into the "black box" of industrial traffic without risking a production halt due to a network lag.
Richard, the top-tier OT tools have massive libraries for proprietary stuff like S7 Comm or BACnet. To answer your question, they can usually parse the "payload" of the packets to see if a "Write" command was sent to a PLC, which is a huge step up from just seeing basic connection data.