Network Monitoring

What is network monitoring?

Network monitoring is the continuous observation of network traffic, devices and performance so that faults, anomalies and cyber threats are detected and resolved quickly. A monitoring system collects status data, log messages and copies of traffic, compares them with what is normal and raises an alert as soon as something deviates. In OT environments this is crucial for business continuity, safety and visibility of the industrial communication between PLCs, SCADA, HMIs and field devices.

A production network you cannot see is a network you cannot manage or defend. Network monitoring makes the communication on the plant floor visible, both to the maintenance department and to the security team.

🧠 How does network monitoring work?

Network monitoring runs through four steps that repeat continuously:

1. Data collection via:

• SNMP (status and performance data from switches, routers and devices)
• Syslog (log messages from network components, firewalls and servers)
• SPAN ports or TAPs (a copy of the traffic for analysis)
• ICMP or active ping checks (is a device reachable?)

2. Analysis of status, traffic and behaviour via tools or dashboards, often with deep packet inspection of industrial protocols
3. Alerts on anomalies, outages or policy violations
4. Logging and Trending for historical insight, capacity planning and forensic investigation

Monitoring tools present the results in dashboards, graphs and topology maps with threshold values, giving an operator or administrator real-time insight into where things are going wrong.

🔧 Which data sources and protocols does network monitoring use?

Each source answers a different question. A mature monitoring set-up combines several of them.

In ProfiNET networks much of this information is available out of the box: devices from conformance class A support LLDP for neighbour detection, and class B adds network diagnostics via SNMP. A monitoring tool can therefore read the topology and port status of a machine network without installing extra agents.

🔄 What is the difference between active and passive monitoring?

Active monitoring sends its own traffic into the network: pings, SNMP requests or scans. Passive monitoring only listens through a SPAN port or TAP and transmits nothing. In OT this distinction matters, because older PLCs and field devices sometimes hang on unexpected traffic such as a port scan.

Choosing between SPAN and TAP is mostly a practical matter. A SPAN port costs nothing and can be configured remotely, but mirrored traffic has the lowest priority inside the switch: a fully loaded 1 Gbit/s full-duplex link can produce 2 Gbit/s of mirrored traffic, more than the monitor port can carry. A SPAN port also does not forward damaged frames. A TAP costs hardware and a brief interruption to install, but delivers a complete copy. For critical links, such as the uplink from a control network to the DMZ, organisations therefore often choose a TAP.

🏭 How is network monitoring applied in OT networks?

• Detection of failed devices - a PLC, drive or switch that stops responding is noticed immediately
• Visualisation of network performance, communication paths and the current topology
• Real-time alerts on suspicious traffic or ARP Spoofing
• Historical analysis of Modbus TCP traffic during faults, for example to find out which station wrote a register value
• Performance monitoring - rising latency, jitter or packet loss reveals a faulty cable or overloaded switch before production stops
• Integration with SIEM platforms for Security Monitoring and correlation with IT alerts
• Monitoring of remote connections via VPN or Remote Access, so you can see when a supplier logs in

Network monitoring thus supports troubleshooting, preventive maintenance and cyber resilience. The same data serves two teams: maintenance sees error counters and outages, security sees new connections and unusual commands.

🔍 What is the difference between network monitoring and network security?

In practice the boundary is fluid: a network IDS uses the same SPAN or TAP data as a monitoring tool and is effectively a form of monitoring with security rules. Monitoring itself blocks nothing; it provides the evidence on which an OT SOC or administrator acts.

🛠️ How do you set up network monitoring in an OT environment?

A step-by-step approach prevents you from building dashboards blindly or disturbing the process:

1. Map the network - start with a topology drawing and an asset inventory; passive sensors help you find devices that are missing from it.
2. Choose the measurement points - place sensors at the transitions in the Purdue Model, especially between the control network, the SCADA level and the DMZ, and on the core switches of every zone in your network segmentation.
3. Synchronise time - without correct time via NTP, logs from different devices cannot be correlated.
4. Learn normal behaviour - OT traffic is predictable and repetitive; a baseline of a few weeks makes every new connection stand out later.
5. Set thresholds and alarms - common rules of thumb are a reachability check every 30 to 60 seconds and SNMP polling of port statistics every 1 to 5 minutes; alert on what requires action, not on every deviation.
6. Link alerts to follow-up - define who picks up an alarm, and forward security alerts to a SIEM or SOC with a working incident response process.

Standards and legislation ask for this too. IEC 62443-3-3 requires continuous monitoring in SR 6.2 from security level 2 and audit log accessibility in SR 6.1. The SANS ICS Five Critical Controls list network visibility and monitoring as control 3, and NIST SP 800-82 Rev. 3 (September 2023) treats monitoring as a core measure for OT. In the Netherlands, the Cybersecurity Act (Cyberbeveiligingswet), the Dutch transposition of NIS2, has applied since 15 August 2026: its duty of care and its obligation to report significant incidents are hard to meet in practice without detection. The Cybersecurity Decree (Cyberbeveiligingsbesluit) makes this concrete: Article 8 (incident handling) calls for the detection, analysis and logging of security-relevant events. Detailed EU requirements for monitoring and logging are set out in Implementing Regulation (EU) 2024/2690, but these apply only to digital service providers such as cloud and data centre providers and managed service providers, not to the average factory.

🔐 How do you secure the monitoring itself?

• Encrypt management traffic - SNMPv1 and v2c send the community string in cleartext; use SNMPv3 with authentication and privacy, and TLS for syslog
• Read-only access - disable SNMP write access (SET) on OT equipment
• Separate the monitoring traffic - use a dedicated VLAN or management network; a sensor’s capture interface has no IP address and traffic only flows towards the collector
• Restrict access to monitoring tools via RBAC and firewall rules
• Centralise - connect monitoring to a SIEM for correlation and retention of logs
• Include monitoring portals in your Audit and compliance policy, because a monitoring platform knows the complete network map and is therefore valuable to an attacker

❓ Frequently asked questions

Is network monitoring safe for old PLCs?

Passive network monitoring via a SPAN port or TAP is safe for old PLCs, because the sensor does not send a single packet to the devices. Active scans, including the optional active querying that many OT platforms offer, can however disrupt fragile devices. Enable active methods only selectively, after testing them in a test environment or during a shutdown.

Which is better for network monitoring: a SPAN port or a TAP?

A TAP delivers a complete copy of a link, including errored frames, and is independent of switch load. A SPAN port is cheaper and more flexible, but can drop packets under high load. For critical uplinks in OT networks a TAP is preferred; elsewhere SPAN is usually sufficient.

Which tools are used for network monitoring in OT?

SNMP pollers and dashboards, for example built with Grafana, are used for availability and performance. For security monitoring there are specialised OT platforms such as Nozomi, Claroty, Dragos and Tenable OT that understand industrial protocols like Modbus and PROFINET. Wireshark is the standard tool for detailed analysis of captured traffic.

Is network monitoring mandatory?

Network monitoring is not literally prescribed by law, but organisations under the Dutch Cybersecurity Act must take appropriate measures and report significant incidents, and Article 8 of the Dutch Cybersecurity Decree explicitly calls for detection and logging. IEC 62443-3-3 requires continuous monitoring from security level 2. In practice, network monitoring is therefore indispensable for essential and important entities.

What is the difference between network monitoring and a SIEM?

Network monitoring collects and analyses data about traffic, devices and performance. A SIEM collects alerts from many sources, including network monitoring, and correlates them into security incidents. Network monitoring is therefore an important source for a SIEM, not a replacement for it.

How much traffic does an OT monitoring sensor need to handle?

OT networks usually carry a low and stable load, often far below the capacity of 100 Mbit/s or 1 Gbit/s links. The sensor must, however, handle the sum of all mirrored ports, including both directions of full-duplex links. Size it for the combined peak load of all measurement points, not for the average.

📌 In summary

Network monitoring provides continuous visibility of the performance, availability and anomalies of industrial networks, with passive traffic analysis via SPAN ports or TAPs as the safe foundation in OT. It combines SNMP, syslog, flow data and traffic analysis, supports requirements from IEC 62443 and the Dutch Cybersecurity Act, and forms the foundation of fast incident response, process continuity and cyber hygiene in modern OT environments.