Observe without becoming a polling dependency.
Passive deep packet inspection starts with a copy of the traffic, delivered through an engineered SPAN session or network TAP. The sensor does not answer a controller or sit in the polling path. That arrangement avoids adding a sensor processing hop to the production exchange. It does not remove the need to validate the switching change, link capacity, capture visibility, and physical installation before commissioning.
MSS Works Industrial Security develops the baseline with controls engineers and operators. We identify clients, servers, device roles, normal communication periods, and expected changes during maintenance. A new instruction can be more informative than an increase in packet volume. Capture loss and asymmetric visibility must also generate engineering attention; a quiet sensor is not evidence of a quiet process if its mirror feed has failed.
Modbus TCP: put meaning around the register.
Modbus TCP commonly uses port 502, but a port allowance cannot distinguish a routine read from a consequential write. A review considers unit identifiers, function codes, register ranges, permitted clients, and operating state. Function 03 reads holding registers; functions 06 and 16 write them. The correct policy depends on the approved application, including legitimate supervisory actions and carefully controlled engineering exceptions.
Register addressing conventions differ between documentation and packet representations. We reconcile the vendor map with the on-wire offset before proposing a rule. A read-only baseline is useful for a reporting client, while an authorized control client may require specific writes. Unknown ranges, unexpected writers, and changes outside a maintenance window deserve investigation. Register values alone do not reveal the complete safety meaning of an action.
PROFINET and DNP3 need protocol-aware context.
PROFINET includes Ethernet-based discovery, configuration, and real-time exchanges that cannot be summarized by one TCP port. Sensor placement must expose the relevant Layer 2 traffic, and any enforcement device must suit the actual communication profile. We review device naming, controller relationships, and engineering changes rather than treating every unfamiliar frame as hostile. Timing-sensitive paths require measured acceptance criteria and product-specific validation.
DNP3 inspection considers masters, outstations, object groups, event behavior, and control operations. Select and operate sequences need the context of the approved control application. An unexpected master or a change in command behavior can be a useful signal. TCP port 20000 is a common transport choice, but other deployments exist; discovery and documentation must establish the actual transport before the policy is written.
OPC-UA visibility has a trust boundary.
For OPC-UA, we review endpoint trust, application certificates, security policy, user authorization, and permitted operations such as browse, read, subscribe, and write. Port 4840 is a common starting point, not an exhaustive discovery method. Encrypted sessions limit what a passive sensor can decode. Server audit records, approved endpoint information, and certificate events may supply context that network observation cannot provide.
We do not weaken a production security policy simply to make packet contents visible. Instead, the monitoring design states which behaviors are observable and where application evidence is needed. Certificate renewal, rejected sessions, and changed endpoints deserve operational ownership. A monitoring diagram should show its blind spots as clearly as its sensors, especially when a team expects visibility into individual encrypted write requests.
Detection and prevention are separate decisions.
A passive sensor can flag an unauthorized write; it cannot stop that packet from its copied feed. Prevention belongs to a validated inline industrial firewall, application authorization, or another suitable enforcement control. Those controls may affect latency and availability, so we test them against process requirements before enabling blocking. The result is a defensible division of responsibility: observe without adding a polling hop, investigate with context, and enforce only where the design has been proven.