You cannot respond to what you cannot see. OT networks are typically monitored far less than IT networks — many plants discover an intrusion months after it happened, or never. OT network monitoring is the practice of watching the control network for security and operational anomalies: new devices, unexpected connections, protocol misuse, and communication failures. Modern OT monitoring is built on passive observation — no agents on the controllers — which makes it safe for the systems it protects.
What OT Monitoring Must Detect
- New or unexpected devices — an unknown MAC/IP appearing on the OT network is the classic first sign of an intrusion or an unmanaged addition.
- Unexpected connections — a workstation suddenly talking to a controller it has never addressed; a device reaching out to the internet; lateral movement between zones.
- Protocol anomalies — malformed packets, out-of-sequence commands, writes to addresses that are normally read-only, engineering-tool activity outside maintenance windows.
- Baseline violations — behavior that deviates from the learned normal: new command types, changed polling patterns, new users or privileges.
- Operational anomalies — communication losses, controller restarts, and alarming — the same data serves reliability and security.
Passive Monitoring Architecture
The safe architecture is passive: network taps or SPAN ports feed traffic to a monitoring appliance that inspects without touching the production path:
- Sensor placement — at the zone boundaries (between OT and IT, at the DMZ), at the core switch, and at the critical subnets; the monitoring sees traffic without inline risk.
- No agents — industrial protocols (Modbus, OPC, PROFINET, EtherNet/IP) are inspected at the packet level; the controllers and HMIs are untouched — the key advantage over IT-style endpoint agents.
- Protocol-aware parsing — OT IDS/NDR products decode the industrial protocols themselves, so "write to coil register 40001" means something to the analyzer, unlike a generic IT IDS.
- Asset identification — passive fingerprinting builds the asset inventory (what is out there, running what) — often the first accurate inventory the plant has ever had.
Baseline, Then Detect
OT monitoring works in two phases. First, learn the baseline: weeks of observation establish who talks to whom, which protocols, which ports, at what times. Then detect deviation: the system alerts on changes against the baseline. This design suits OT perfectly — normal behavior in a plant is far more regular than in IT, so deviation detection has a low false-alarm rate when configured with the plant's shift patterns and maintenance windows. The tuning work is real: every planned change (new machine, new HMI) becomes a baseline update, and the alert review process must be staffed — an unmonitored monitoring system is decoration.
Integrating with the Security Operations
OT monitoring feeds the incident response process (see the incident response article): alerts are triaged with the plant's OT team, correlated with IT monitoring where the DMZ connects, and escalated per the OT incident procedure. Practical integration points: a joint SIEM that receives both OT and IT alerts; a weekly review of the OT alert log by the automation team; and the alarm philosophy applied to security alerts — too many alerts produce ignored alerts, so severity levels and throttling must be designed, not defaulted.
Operational Considerations
- Network design first — monitoring needs the network segmented enough to be observable (VLANs, zones); a flat network is hard to monitor meaningfully and is a finding in itself.
- Encryption blind spots — encrypted traffic (increasing on modern protocols) hides content from passive sensors; the response is to monitor the endpoints' behavior (connections, timing) and the plaintext control protocols that remain.
- Performance impact — SPAN ports and taps must handle peak traffic; an oversubscribed monitor drops packets exactly when it matters most.
- Data retention — retain the flow and alert records per the security program (typically 6–12 months) — post-incident forensics depend on them.
Summary
OT network monitoring gives the plant eyes on its control traffic: passive sensors, protocol-aware analysis, baseline-based anomaly detection, and integration with the incident process. Deploy at zone boundaries, learn the baseline, staff the alert review, and feed the findings into the risk and change processes. The first intrusion that is caught because the monitoring showed "a laptop joined the control network at 02:13" pays for the entire program.