Building an OT Asset Inventory Without Active Scanning

You can build a usable OT inventory without sending a single packet at a controller. Combine passive traffic monitoring, switch MAC and port tables, the engineering project files, and a physical walk-down, then reconcile them in one list. Each source misses things the others catch.

An inventory comes first because you cannot segment, patch, or monitor what you cannot name. The zones and conduits worked example assumes you have one.

Why active scanning is a risk

An IT vulnerability scanner sends many probes to many ports quickly. Some older PLCs, drives, and embedded devices have small network stacks and may respond badly to unexpected packets. Effects range from a slowed scan cycle and dropped connections to a device fault. NIST SP 800-82 Rev. 3 notes that active scans may cause device instability or interfere with the device process state. The outcome depends on the device and firmware, so the safe default is not to test it on production.

Active methods are not forbidden. They are something you choose, with a test unit, a window, and the vendor’s agreement.

Method 1, passive monitoring

Connect a monitoring sensor to a SPAN port or a network tap on the switch that carries control traffic. It listens only. Over days it learns which addresses talk and which protocols they use, and often the vendor, model, and firmware from the protocol exchanges themselves.

Known protocol ports help you recognize what you are seeing.

Place the sensor where the traffic passes. A sensor on the wrong switch sees nothing, and a single sensor at the top will not see traffic between two devices on the same access switch.

Method 2, switch tables

Managed switches already know who is plugged in. The MAC address table, the ARP table on a router or layer 3 switch, and LLDP neighbour data give you addresses, port numbers, and sometimes device names. A read-only query to your own switch is far gentler than probing the end devices. Match the MAC prefix to a vendor and you have a first guess at what the device is.

Method 3, engineering project files

PLC and HMI project files list I/O modules, network configuration, device IP addresses, and the other controllers each program talks to. They are some of the best inventory sources you have, and they cost nothing to read. Copy them offline and open them on the engineering workstation or a test machine. This also tells you whether a current backup exists, which is a finding on its own.

Method 4, the walk-down

Walk the plant with a clipboard or tablet. Photograph nameplates, record serial numbers and firmware shown on the display, note unmanaged switches in cabinets, and look for the cellular router, the USB stick, and the laptop that was left plugged in. Passive tools do not see a device that is powered but silent, or a serial link with no Ethernet at all.

Reconcile into one list

1. Start with the project files, since they say what should exist.
2. Add what passive monitoring and switch tables show.
3. Walk down and resolve the differences.
4. Flag unknown devices and ask the operators about them before you assume the worst.
5. Assign an owner to every line.

The fields to record are in the FAQ above. Add the zone each device belongs to once the design exists. CISA’s asset inventory guidance and ISA/IEC 62443 both treat an up-to-date inventory as a basis for the rest of the program.

What to do with it

Use it to find end-of-life devices, plan a patch or compensating control, spot paths into the plant such as vendor remote links, and compare the network against the layers in The Purdue model in practice versus on paper. It also gives you the baseline that passive monitoring alerts against.

More background is on industrial OT networks and in the OT and IT convergence advisory. The monitoring lesson is in the free OT networks course, and the hands-on version is Hardening Control Networks.

If you would like a hand building the first inventory, see /book/.