Why Passive-First Assessments Are the Safe Way to Look at OT Networks
Most people who have worked around control systems for long enough have heard a version of the same story: someone ran a routine network scan, and a controller on the plant floor stopped responding. Nobody intended harm, and the tool did exactly what it does on an office network. That is why the first rule of looking at an operational technology (OT) network is simple: watch first, touch later, and only touch with care.
Why active scanning is risky in OT
Office IT networks are full of devices built to handle unexpected traffic. Laptops, servers and switches get probed constantly and shrug it off. Many industrial devices were never built with that expectation. A programmable logic controller (PLC), remote terminal unit or older protection relay may have a small network stack, limited memory and firmware written years ago for a closed, predictable environment.
When a standard IT scanner sweeps a subnet, it can send malformed packets, open many connections at once or query services in ways the device does not expect. The industry has a long list of well-known accounts of what happens next:
Controllers dropping into a fault or stop state and needing a manual restart
Legacy devices locking up their communication modules while the logic keeps running blind
Human-machine interface (HMI) stations losing their connection to the process
Older serial-to-Ethernet gateways rebooting and interrupting data to the control room
Even when nothing visibly breaks, aggressive scanning can add latency to time-sensitive traffic. In a process that depends on reliable communication, a short disruption can have physical consequences, from lost product to a safety system trip. The risk is rarely worth it when there are safer ways to get the same answers.
What "passive" actually means
A passive assessment learns about the network without sending traffic to the devices on it. The main techniques are:
SPAN or mirror ports: a managed switch is configured to copy traffic to a monitoring port, where a sensor or laptop records it. This is usually a small, well-understood change, but it should still go through the site's change process.
Network TAPs: a test access point is a hardware device placed inline that copies traffic without the monitoring equipment being able to transmit back onto the link. Installing one usually needs a brief outage, so it is planned around operations.
Configuration review: firewall rule sets, switch and router configurations, and controller project files reveal how the network was intended to work.
Interviews: operators, controls staff, IT and vendors each hold part of the picture. A short conversation often explains a mystery connection faster than any tool.
Walkdowns: physically visiting control rooms, cabinets and remote sites finds the unmanaged switch, the forgotten cellular modem or the laptop permanently plugged into a panel.
Together, these give a detailed picture of the environment while leaving the process undisturbed.
What you learn from passive data
Industrial protocols are chatty and, in many cases, unencrypted. A few days of captured traffic can tell you a great deal:
Assets: which devices are talking, often including vendor, model and firmware version where the protocol reveals them
Protocols: Modbus, EtherNet/IP, DNP3, S7, OPC and others, plus IT protocols that may not belong on the control network
Communication flows: who talks to whom, how often and in which direction, which is the raw material for segmentation
Cleartext credentials: passwords sent in plain text by older services such as Telnet, FTP or unencrypted web interfaces
Unexpected connections: traffic heading to the internet, to the corporate network or to remote access tools nobody remembered installing
These findings are often the most valuable part of an assessment, because they describe how the network really behaves rather than how the drawings say it should.
When careful active queries are acceptable
Passive-first does not mean passive-only. Some information, such as exact firmware versions on quiet devices, is hard to get from traffic alone. Careful active techniques have a place when the right conditions are met:
Coordinated with operations: the people responsible for the process know exactly what will happen, when and to which devices.
Vendor-approved: the device or system vendor has confirmed the method is supported, or the method is one the vendor's own tools already use.
Scheduled in a maintenance window: ideally when the process is down or in a state where a device restart would not cause harm.
Using native protocol queries: asking a controller for its identity using the same industrial protocol its programming software uses, rather than blasting it with a generic port scan.
Targeted and rate-limited: one device at a time, with someone watching, and a clear stop condition.
Testing on a spare device or a lab replica first is the best option where one exists.
How a passive-first assessment typically runs
While every site is different, the general shape is consistent:
Scoping and safety planning: agree on objectives, the sites and networks in scope, the rules of engagement and who must approve any change.
Document collection: gather network drawings, firewall configurations, asset lists and remote access arrangements.
Capture setup: identify suitable switches for SPAN ports or locations for TAPs, then set them up through the site's change process.
Collection period: record traffic over a period long enough to see normal cycles, often several days to a few weeks, including shift changes and batch runs where relevant.
Interviews and walkdowns: run in parallel with collection to fill gaps and explain anomalies.
Analysis: build the asset list and communication map, then compare them against the documentation and good practice such as the IEC 62443 series.
Reporting: deliver prioritized, practical findings that operations can act on without putting production at risk.
The result is a clear, evidence-based view of the network, gained without anyone having to explain to the plant manager why a line went down during a security exercise.
How QBits Networks can help
Our OT security assessments are passive-first by default, built around SPAN or TAP capture, configuration review, interviews and walkdowns. For teams that want a quicker look, an OT visibility snapshot provides a time-boxed passive capture that shows what is on the network and how it communicates. Tell us what you need through our contact page and we'll scope it with you.