OT, ICS, SCADA: IEC 60870-5-104 in ntopng

Posted · Add Comment

What is OT, ICS, SCADA ?

Operational Technology (OT) refers to computing systems that are used to manage industrial operations or process operations, like water treatment, electrical power distribution or wrapping a chocolate in foil. ntopng supports some Industrial control systems (ICS) protocol often managed via a Supervisory Control and Data Acquisition (SCADA) systems. Via nDPI it can detect protocols such as Modbus, IEC 60780 or BACnet. In addition to this, ntopng has extensive detection and monitor capabilitiesfor some protocols OT protocols/

ntopng “Generic” Monitoring

ntopng is a monitoring tool able to detect “generic” and behavioural issues that can disrupt an OT network. They include (but are not limited to):

  • New device detection and invalid MAC/IP combinations
  • Device traffic behavioural analysis (e.e. traffic misbehaving, peaks in traffic)
  • New protocols and services: detect when a devices changes in provided services (i.e. a HTTPS server is spawn) or a new protocol s used as client

In addition to the above services, specific protocols are supported in detail.

IEC 60870-5-104

IEC 60870-5-104 is a protocol used mostly in electrical engineering and power system automation. This protocol is detected by ntopng and dissected overtime by detecting changes in behaviour for each network flow.

For each IEC flow, ntopng dissects flow communications


and reports in realtime traffic statistics. In addition to this, ntopng learns the protocol transitions as configured in preferences, this as each IEC flow has different peculiarities and transitions for which a model is created.

For the specified duration, ntopng builds a model for each flow in order to understand how it behaves overtime. When the learning period for a flow is over, ntopng matches the traffic agains the model and triggers an alert whenever

  • An unexpected transition is detected
  • The transitions number is invalid (C-C > 10 and M-M/M-C/C-< == 0).

You can read more about this in the ntopConf 2022 presentation.