Passive Monitoring

What is Passive Monitoring?

Passive monitoring is a method of observing and analysing network traffic through a copy of that traffic, without sending any packets to the monitored systems or interfering with their communication. It gives you visibility into devices, connections and abnormal behaviour without disrupting the production process. Passive monitoring is a form of Monitoring that has become the default in OT environments, because many systems are legacy, fragile or Real-time and do not cope well with active scans.

🧠 Why is passive monitoring important in OT?

In office IT it is normal to scan networks actively with ping sweeps, port scans or agents on endpoints. In a factory or utility, that can go wrong. Older PLCs, RTUs and HMIs often have a limited network stack and react unpredictably to unexpected packets. A widely cited incident from 1998 describes how a ping sweep on a production network caused a nine-foot robotic arm to leave standby and swing 180 degrees. In another documented case, a penetration tester at a gas utility accidentally reached the SCADA network, the system locked up and no gas could be moved through the pipelines for four hours.

Passive monitoring avoids that risk because the sensor only listens. It also addresses several typical OT problems:

🔧 How does passive monitoring work technically?

A passive solution has three parts: a way to copy traffic, a sensor that dissects that traffic, and a central console for analysis and alerting.

1. Copy the traffic - through a SPAN port (port mirroring) on a managed switch or through a hardware TAP that physically taps the cable.
2. Dissect the protocols - the sensor uses deep packet inspection to understand industrial protocols such as Modbus, S7 Comm, OPC UA, ProfiNET, Ethernet IP, DNP3, IEC 61850 and BACnet. The sensor therefore sees not just that there is traffic, but also which function code, which register and which value.
3. Learn a baseline - the sensor builds a picture of normal communication: who talks to whom, how often and with which commands.
4. Report deviations - using anomaly detection and known attack patterns (IDS signatures), the solution flags new devices, unknown connections or unusual write operations.

The sensor usually has no IP address on its monitoring interface and sends nothing there. Only a separate management interface communicates with the central console.

What is monitored?

🔄 What is the difference between SPAN, TAP and active scanning?

The choice of capture method determines how complete the picture is. A SPAN port is cheap and quick to set up, but copies traffic at low priority. If you mirror both directions of a fully loaded 1 Gbit/s link, up to 2 Gbit/s may be sent to a single monitor port, and packets that do not fit are silently dropped. Damaged frames are usually not mirrored either. A TAP copies everything in hardware, including errored frames. A copper TAP is only truly passive up to 100 Mbit/s. Gigabit copper requires active electronics, so a fail-safe relay matters to keep the link up during a power loss.

The biggest drawback of a purely passive approach: a device that never communicates stays invisible. Vendors such as Nozomi, Claroty, Tenable OT and Dragos therefore offer additional, controlled active queries in the device’s own protocol. Nozomi, for example, calls this Smart Polling. That is different from generic vulnerability scanning and should always be agreed with the person responsible for the process.

🔐 What security insights does passive monitoring provide?

These insights are especially valuable in OT because attackers often use legitimate engineering commands. A “stop CPU” or a new logic download is technically normal traffic; only the context makes it suspicious. Passive sensors that understand the protocol can make that distinction, which is why passive monitoring is a core part of OT security.

📏 Which standards and guidelines call for network monitoring?

• IEC 62443 - IEC 62443-3-3 contains, under Foundational Requirement 6 (Timely response to events), system requirement SR 6.2 for continuous monitoring of security-relevant events. In OT, passive monitoring is the usual way to meet it.
• NIST SP 800-82 - Revision 3 (September 2023) explicitly warns against active scanning on operational OT networks because of device sensitivity.
• SANS ICS Five Critical Controls - control 3, ICS Network Visibility Monitoring, calls for continuous, protocol-aware monitoring of the ICS network.
• NIS2 and the Dutch Cybersecurity Act - the Dutch Cyberbeveiligingswet has applied since 15 August 2026. Organisations must take appropriate measures and report significant incidents quickly. Without visibility into the OT network, recognising an incident in time is difficult.

The Netherlands has its own footprint in this market. Eindhoven-based SecurityMatters, a spin-off of the University of Twente, developed the passive OT monitoring solution SilentDefense and was acquired by Forescout in November 2018 for around 113 million US dollars. In 2020 Microsoft acquired the US company CyberX, whose agentless technology forms the basis of Microsoft Defender for IoT.

🛠️ How do you set up passive monitoring step by step?

1. Define the scope - start with segments containing critical assets and use the Purdue Model and your zone layout to decide where visibility adds most value: usually the controller layer (levels 1–2) and the transitions to the IDMZ.
2. Choose the capture points - use a TAP on critical links and SPAN where that is sufficient. Watch the capacity of the monitor port.
3. Place the sensors - per zone or site, with the monitoring interface without an IP address and a separate management connection.
4. Let the baseline learn - at least one full production cycle, including batch changes and maintenance, so that normal exceptions do not come back as alarms.
5. Populate the inventory - link the discovered assets to your Asset Inventory and use them for vulnerability management.
6. Connect to detection and response - send alerts and logs to a SIEM, an OT SOC or an existing SOC, and record in the Incident Response Plan who does what.
7. Operate and review - also monitor during maintenance windows and set out roles and responsibilities in the monitoring policy.

Open-source alternatives exist too. Wireshark is suitable for ad hoc analysis. For structural use, the US Idaho National Laboratory, together with CISA, developed the free Malcolm toolset and the ICSNPP protocol parsers for Zeek, which support BACnet, EtherNet/IP and S7comm, among others.

❓ Frequently asked questions

Can passive monitoring disrupt a production process?

Passive monitoring sends no packets to the monitored devices, so it cannot disrupt the process over the network. The only physical risk lies in the capture point: installing a TAP requires a brief cable interruption, and an active TAP must be fail-safe. Configuring a SPAN port is done on the switch itself.

Does passive monitoring see every device on the network?

Passive monitoring only sees devices that communicate on a network segment that is being copied. Silent devices or segments without SPAN or TAP remain invisible. That is why many organisations combine passive monitoring with targeted, controlled active queries.

What is the difference between passive monitoring and an IDS?

Passive monitoring is the way traffic is collected: listening without interfering. An IDS is a function that checks that traffic for attacks. Modern OT monitoring platforms combine both with asset discovery and vulnerability insight.

How long does it take to learn a baseline?

The learning period for passive monitoring should cover at least one full production cycle, including batch changes, maintenance and any weekend operation. If the period is too short, normal but rare behaviour later produces false alarms. After changes to the installation, the baseline needs to be updated.

Does passive monitoring work with encrypted traffic?

With encrypted traffic, such as OPC UA with encryption, passive monitoring still sees who communicates with whom, how often and how much data, but no longer the content of commands. Detection then relies more on connection patterns and metadata. Many classic industrial protocols, however, are still unencrypted.

Is passive monitoring mandatory under the Dutch Cybersecurity Act?

The Dutch Cybersecurity Act does not prescribe a specific technique such as passive monitoring. It does require essential and important entities to take appropriate measures and to report significant incidents in time. For OT networks, passive monitoring is a common way to make that detection and reporting possible.

📌 In summary

Passive monitoring gives you safe visibility into OT networks by analysing a copy of the traffic, without sending anything to the installation itself. With SPAN or TAP, protocol-aware sensors, a well-learned baseline and integration with a SIEM or SOC, it is a core part of Defense in Depth and of monitoring in line with IEC 62443, supplemented by controlled active queries where needed.