Mapping a plant without touching production

"Nothing gets plugged into the production network." That is the first sentence you hear on an industrial site, and it is perfectly legitimate. Which is exactly why mapping is done by passive listening: the probe talks to nothing - it observes a copy of the traffic.

The principle: listen to a copy, never the network itself

Industrial and office switches can duplicate the traffic of one or several ports to a dedicated one: the mirror port (SPAN), or its hardware equivalent, the TAP. The UMX Explorer probe plugs into that copy. It has no address on the monitored network, emits no packet, queries no device. If the mirror port fails, production does not even notice.

Where a classic IT scanner "queries" machines - which can disturb older PLCs - passive listening simply reads what already flows: Modbus requests, S7 sessions, OPC UA exchanges, SCADA frames, discovery protocols. That traffic is enough to reconstruct the essentials.

What the map reveals

• The real inventory: PLCs, HMIs, SCADA stations, historians, drives, gateways, network equipment - with vendor and role inferred from traffic.
• The layered architecture: the map organises itself along the Purdue model, from sensors (level 0) to business systems (levels 4-5), including subnets and communication channels.
• Cross-level flows: who talks to whom, over which protocol - and above all the flows that should not exist: an office workstation reaching a PLC, an industrial protocol crossing the DMZ, a forgotten always-on remote-maintenance link.

The experience repeats from site to site: the real map never quite matches the architecture diagram. Devices nobody had listed, links inherited from a past project, IT/OT bridges installed "temporarily". It is nobody's fault - a plant network lives twenty years and changes hands. But you cannot protect what you cannot see.

How it goes in practice

• Half a day on site to configure the mirror port with your electrician or integrator, plug the probe in and check the capture.
• A few days to a few weeks of listening, to cover real production cycles - some links only speak once per shift, or per batch.
• A debrief: the annotated map, the inventory, segmentation findings and priorities - in operator language, no jargon.

The site walks away with its map - and a sound basis for what follows: segmentation, IEC 62443 risk analysis, answers to insurance questionnaires or principals' requirements.