How Switch Mirroring Decisions Create Blind Spots in OT Network Monitoring
Your OT sensor is licensed. It's healthy. The dashboard is full of assets, and the alerts are tuned. And the controller that runs your most critical line may still be invisible to it.
Passive platforms learn only from the packets delivered to them. In most plants, those packets arrive through a switch port mirror (SPAN) or a network TAP, placed by someone who had to decide which links mattered. The switch doesn't care about that decision. It forwards frames according to its MAC address table, and a sensor cannot analyze traffic that never crosses a mirrored link.
From the field.At a discrete manufacturing site, I compared our monitoring platform's inventory against the PLC projects and the switch MAC tables. Under a quarter of the assets were missing, which sounds tolerable until you ask why. Part of the answer was a vendor's cellular remote-access path: a working connection into the...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
