Industrial Monitoring

Operational Technology (OT) refers to computing systems that are used to manage industrial operations. ntopng supports some Industrial Control Systems (ICS), often managed via Supervisory Control and Data Acquisition (SCADA) systems. Via nDPI it can detect protocols such as Modbus, S7Comm, PROFINET, IEC 60870-5-104 and BACnet. In addition to this, ntopng provides an extensive analysis of some of these protocols.

ntopng is a monitoring tool able to detect “generic” and behavioural issues that can disrupt an OT network. They include (but are not limited to):

• New device detection and invalid MAC/IP combinations

• Device traffic behavioural analysis (e.g. traffic misbehaving, peaks in traffic)

• New protocols and services: detect when a device changes the provided services (e.g. an HTTPS server is spawned) or a new protocol is used as client

In addition to the above services, specific protocols are supported in detail. This section lists the main protocols for which ntopng provides advanced monitoring features.

• 1. ModbusTCP
  • 1.1. Flow Information
  • 1.2. Behavioural Checks
• 2. S7Comm
  • 2.1. Flow Information
  • 2.2. Behavioural Checks
• 3. PROFINET
  • 3.1. Flow Information
  • 3.2. Behavioural Checks
• 4. IEC 60870-5-104