Discover the factory
Turn a small industrial traffic sample into an asset and communication inventory.
By Abdul Khadir Mahamed · Updated 3 November 2026
Independent guided exercise using synthetic evidence. No live industrial systems are connected.
Your scenario
You are reviewing a packaging cell before deploying passive monitoring. Use the synthetic observations to distinguish devices from assumptions.
Evidence to examine
10.20.1.10 → 10.20.1.20 TCP/502 periodic reads 10.20.1.30 → 10.20.1.20 TCP/44818 maintenance window 10.20.1.40 → 10.20.2.10 TCP/4840 periodic session
Your investigation tasks
- List observed source and destination addresses, services, and communication relationships.
- Identify likely device roles and clearly label them as hypotheses.
- Describe what additional evidence would confirm ownership and firmware.
Debrief
Review the reasoning after completing the tasks
Port 502 suggests Modbus TCP, 44818 suggests EtherNet/IP, and 4840 commonly supports OPC UA. Ports alone do not prove device identity. Confirm using protocol details, configuration records, and asset owners; use passive evidence first.
Take it back to the process
Separate observed facts from assumptions. Explain the operational consequence of your decision, name the evidence still needed, and identify who must approve or validate a real-world change.