Scanning OT networks

Operational technology (OT) is defined by the National Institute of Standards and Technology (NIST) as programmable systems or devices that interact with the physical environment, or that manage devices which do. Examples include industrial control systems (ICS), computer numerical control systems (CNC), building control systems, transportation systems, and many others. OT systems and devices once ran in isolation on specialized hardware and software. Today they are increasingly interconnected and run industry standard operating systems and network protocols, so organizations need an accurate inventory of their network-connected OT assets.

Who is this playbook for and why?

This playbook is for IT and OT personnel who want to use active scanning as part of their strategy for maintaining a complete OT asset inventory. OT environments deliver critical services and can affect health and safety, so they typically have their own performance and reliability requirements, and active scanning of OT assets calls for a prudent approach.

How will runZero help?

runZero discovers assets on your network with active unauthenticated scanning, and the runZero Explorer is built with sensitive OT assets in mind. The Explorer sends only normal traffic: no malformed packets, and no attempts to exploit vulnerabilities. It probes only the TCP/UDP ports that provide actionable information for fingerprinting a device, and you can set the speed and depth of scanning to fit your environment.

What will I need to do?

To scan your OT environment, runZero recommends these steps:

1. Create a site for OT assets.
2. Deploy a dedicated Explorer.
3. Configure scan templates for OT assets.
4. Run a limited scan and evaluate the results.
5. Run a full scan and evaluate the results.
6. Configure recurring scans.

Prerequisites

To configure scans of your OT environment, you need:

• A list of subnets allocated to your OT network.
• A registered Explorer with appropriate access to your OT network.
• If appropriate, firewall rules allowing Explorer communication through OT firewalls.

You should also know the IP addressing schemes on your OT network, such as patterns repeated across locations or networks. For example, you may want to exclude PLCs from your initial scans to reduce risk further, and that is easier when PLCs follow a consistent addressing scheme or sit on specific VLANs.

Implementation steps

These instructions show you how to scan your OT network safely.

Step 1: Create a site for OT assets

A separate site (or several) for your OT environment is optional, but it lets you define your OT subnets and manage exclusions more clearly.

1. In the appropriate organization, navigate to Sites and select New Site.
2. Give the Site a Name (for example, OT network).
3. Add Registered subnets, with a description and relevant tags for each. runZero includes Registered subnets in the Default scan scope automatically, so you don’t need to define subnets in both places.
4. If appropriate, add Default scan exclusions.
5. Click Save.

Step 2: Deploy dedicated Explorers

runZero recommends dedicated Explorers for OT discovery. How many you deploy depends on your OT network architecture, resource availability, and scanning strategy. Discovery works best when the Explorer sits on the network it scans, with no gateway devices such as firewalls or routers in between: runZero can then obtain the MAC address of each asset and avoid the problems that can occur when scanning through stateful gateways.

Explorers need to reach the console over 443/tcp to send scan data for processing and to obtain software updates. If your OT network is completely isolated from the internet, with no inbound or outbound communication permitted, consider deploying a self-hosted runZero console or an offline scanner inside your OT network so Explorers can reach the console without violating OT policies.

Self-hosting runZero and offline mode configuration cover deploying and updating a self-hosted console. If you go self-hosted, runZero recommends placing the console in the industrial security zone. A proxy or broker service in your industrial DMZ can handle any required communication with your enterprise network.

A few example Explorer deployment strategies follow.

Example 1: Centralized deployment

In a highly distributed environment, where OT lives in 10s or 100s of field locations, a centralized deployment may be more efficient. Explorers in your primary and secondary datacenters are a strong starting point for scanning OT. Firewalls and routers need particular attention in this model: you need rules that give each Explorer visibility into the field locations it scans, and separate Explorers in the industrial DMZ and the industrial zone can limit how much scanning crosses firewalls. You also need a clear picture of the connectivity between your datacenter and field locations so you can tune scans to match (Step 3 covers this in more detail). One trade-off is that layer 2 discovery is less effective from a central location. The Explorer uses several techniques to enumerate MAC addresses, and layer 2 probes are the most effective.

Example 2: Distributed deployment

In a less distributed environment, with larger concentrations of OT at major locations, an Explorer at each location may be the more effective strategy. Layer 2 discovery works better because the Explorer crosses fewer firewalls or routers, if any. Load is spread across your OT network, which eases bandwidth concerns over higher latency connections. Bandwidth still matters, though: each Explorer sends its scan data back to the console, and the amount depends on the number of assets at the location and how often you scan.

Example 3: Hybrid deployment

A hybrid model puts Explorers in the datacenter and at field locations. If you have too many field locations to deploy an Explorer to each, set criteria for which locations warrant one. Criteria may differ by organization; they could be based on asset count, criticality to operations, or even revenue generation. This model helps you get the most complete and accurate data at your highest priority locations while relying on the centralized Explorers for the lower priority ones.

Step 3: Configure scan templates for OT assets

You can run many scans over time across different OT networks and sites, and scan templates simplify scheduling and help keep each scan on a consistent configuration. Consistency is especially important when scanning OT. We recommend two templates: an OT Limited Scan template and an OT Full Scan template. The limited scan performs initial discovery with limited probing, so you can assess the effect of scanning on your OT network and assets before you move to full discovery scans.

These instructions don’t explain each configuration item. Discovering assets covers scan configuration in detail.

Step 3a: Create an OT limited scan template

This template finds what is alive on your OT network while keeping traffic volume low and avoiding proprietary or ICS ports during initial scanning. It also lets you evaluate the effect of scanning on your OT network before you move on to full scans. Treat it as guidance and adjust it to the needs and risk tolerance of your organization.

1. Add a template: select Tasks > Task library in the side navigation, then click Add template.
2. Enter a Name for the template (for example, OT Limited Scan Template).
3. Set the Scan rate to a maximum of 500 packets per second.
4. Open the Advanced configuration tab.
5. Set the Included TCP ports to 21,22,23,69,80,123,135,137,161,179,443,445,3389,5040,5900,7547,8080,8443,62078,65535.
6. Set the Maximum host rate to 20.
7. Set the Max group size to 2048.
8. Set the Max TTL to 64.
9. Toggle Limit scans to pingable hosts to Yes.
10. Open the Probes and SNMP configuration tab.
11. Click the Disable all button under Disable all probes.
12. Toggle each of these probes to Yes:
    • ECHO
    • LAYER2
    • NETBIOS
    • NTP
    • SNMP
    • SSH
    • SYN TCP port scan
    • TFTP
13. Open the Credentials configuration tab.
14. Select the appropriate SNMPv2 or SNMPv3 credentials.
15. Save the template.

Step 3b: Create an OT full scan template

This template performs full discovery and fingerprinting on the OT network while staying conservative about the volume of traffic it generates. Treat it as guidance and adjust it to the needs and risk tolerance of your organization; for example, you may want to exclude ports known to be used by legacy technology.

1. Add a template: select Tasks > Task library in the side navigation, then click Add template.
2. Enter a Name for the template (for example, OT Full Scan Template).
3. Set the Scan rate to a maximum of 500 packets per second.
4. Open the Advanced configuration tab.
5. Set the Maximum host rate to 20.
6. Set the Max group size to 2048.
7. Set the Max TTL to 64.
8. Add relevant DNS nameservers for your OT network.
9. Open the Probes and SNMP configuration tab.
10. Click the Disable all button under Disable all probes.
11. Toggle each of these probes to Yes:
    Probes (click to expand)

    • BACNET
    • DAHUA-DHIP
    • DNS
    • DTLS
    • IKE
    • IPMI
    • KERBEROS
    • KNXNET
    • L2T
    • L2TP
    • LANTRONIX
    • LAYER2
    • LDAP
    • MSSQL
    • NETBIOS
    • NTP
    • OPENVPN
    • PCA
    • SIP
    • SSDP
    • SNMP
    • SSH
    • SYN TCP port scan
    • TFTP
    • UBNT
    • VMWARE
    • WEBMIN
12. If you are comfortable doing so and it is safe in your environment, you may also want to enable these OT protocol probes by toggling them to Yes. Fifteen of them also enumerate downstream devices behind a gateway and report each as its own sub-asset. Protocol gateways has the full list and shows how to query the results.
    Probes (click to expand)

    • ETHERNETIP: EtherNet/IP / CIP (sub-asset enumeration)
    • MODBUS: Modbus/TCP (sub-asset enumeration)
    • S7COMM: Siemens S7 (sub-asset enumeration)
    • PROFINET: PROFINET (sub-asset enumeration)
    • ETHERCAT: EtherCAT (sub-asset enumeration)
    • FINS: Omron FINS (sub-asset enumeration)
    • MELSECQ: Mitsubishi MELSEC-Q (sub-asset enumeration)
    • HARTIP: HART-IP multiplexers (sub-asset enumeration)
    • IEC104: IEC 60870-5-104 (sub-asset enumeration)
    • MMS: IEC 61850 MMS (sub-asset enumeration)
    • ADS: Beckhoff ADS / TwinCAT (sub-asset enumeration)
    • C37118: IEEE C37.118 Synchrophasor (sub-asset enumeration)
    • DNP3: DNP3 (sub-asset enumeration). Some outstations communicate with only one master at a time, so probing can interrupt active sessions. Test before a broad rollout.
    • OPCUA: OPC UA
    • ATG: Veeder-Root Automatic Tank Gauge
    • BSAP-IP: Emerson BSAP/IP
    • C12.22: ANSI C12.22 utility AMI
    • CSPV4: Allen-Bradley CSPv4 / PCCC
    • DOIP: Diagnostics over IP (in-vehicle ECUs)
    • FOCAS: Fanuc FOCAS CNC / robots
    • HSMS: SEMI HSMS / SECS-GEM
    • MBUS-TCP: M-Bus over TCP
13. Check that the tuning parameters for each probe suit your environment. These include, among others:
    Probes (click to expand)

    • MODBUS: the modbus-identification-level option may need tuning to match the capabilities of the MODBUS devices in your environment
    • S7COMM: you can set the s7comm-request-extended-information option to true to gather more information, if the devices in your environment support it
    • DNP3: you can set the banner-address-discovery option to require or prefer DNP3 address discovery through unsolicited messages sent by the probed outstation. The explorer-address option takes a decimal number for the DNP3 address the Explorer uses when communicating with DNP3 devices.
14. Open the Credentials configuration tab.
15. Select the appropriate SNMPv2 or SNMPv3 credentials.
16. Save the template.

Step 4: Conduct limited scans

With the templates in place, start scanning a small subset of your OT network: one or two /24 networks, or a low priority field location. Leave critical assets and high priority locations for later. Inform the appropriate personnel before you start so they can monitor the health of the network and the relevant OT devices, and schedule the scan for a predetermined date and time.

1. Go to Tasks > Scan > Template scan.
2. Type OT Limited Scan Template into the search box and select the radio button for the template.
3. Click Continue to scan configuration.
4. Select the Site configured in Step 1.
5. Select an Explorer deployed in your OT environment.
6. Add one or more subnets to the Deployment scope.
7. Set a Start time for the scan.
8. Click Initialize Scan.

When the initial scan completes, evaluate the scan data and the state of the OT networks you just scanned. Work through the checks on the Running initial scans page, then these:

• Ask the network personnel to check the health of every network you scanned, including any routers, switches, or firewalls that were in the initial discovery scope or that the scan traversed.
• Ask the OT personnel to check the health of any OT devices in the initial discovery scope.
• Check bandwidth use during the scan at any remote locations in the initial discovery scope.

If the initial scans cause problems, adjust the OT Limited Scan Template and rerun them until you are comfortable with the results. Then extend limited scanning to the wider OT network, still in phases: OT networks can be very diverse, and a different part of the network may not respond the way your first scans did. Keep the appropriate personnel informed of scanning activity, and keep a log of everything you do so you have a record if issues occur.

Step 5: Conduct full scans

Once limited scanning is complete, move on to full scans of your OT networks.

1. Go to Tasks > Scan > Template scan.
2. Type OT Full Scan Template into the search box and select the radio button for the template.
3. Click Continue to scan configuration.
4. Select the Site configured in Step 1.
5. Select an Explorer deployed in your OT environment.
6. Add one or more subnets to the Deployment scope.
7. Set a Start time for the scan.
8. Click Initialize Scan.

Full scanning should follow a similar process to limited scanning. Work through the steps in Step 4: keep the appropriate personnel informed of scanning activity and check network and OT device health after each scan. If problems arise, adjust the OT Full Scan Template and repeat the scans until they succeed.

Step 6: Configure recurring scans

Once full scans complete with no adverse effect on the health of your OT environment, schedule recurring scans to keep your asset inventory current. Consult the appropriate OT personnel on the timing and frequency, and keep monitoring the scans over time. To set one up, repeat Step 4 or Step 5 and set the Scan frequency in the scan configuration.

Step 7: Triage with category and function

Once OT scans are flowing, use the runZero asset taxonomy to slice the inventory by purpose rather than by IP. runZero assigns every fingerprinted asset a category (IT, OT, or IoT) and one or more functions (Process Control, Safety, Engineering, Human Interface, Monitoring, Networking, Communications, Environmental, Physical Security, Cyber Security, Data Management, Power Management, Remote Access, Management). Understanding assets has the full taxonomy.

A few queries to start with:

category:OT                                   # everything OT
category:OT AND function:"Safety"             # SIS / safety controllers
category:OT AND function:"Process Control"    # PLCs, DCS controllers, RTUs
category:OT AND multi_homed:t                 # OT pivots between zones
category:OT AND has_public:t                  # OT exposed to public IPs
category:OT AND hops_from_public:<=2          # OT within two hops of the internet
is:gateway                                    # protocol gateways themselves
is:child                                      # downstream sub-assets behind any gateway
gateway_kind:modbus                           # Modbus/TCP gateways
child_kind:cip                                # sub-assets behind EtherNet/IP gateways

Pin these as saved queries, build a Goal around category:OT coverage, and add the OT-Risk panel to your dashboard so the inventory keeps up with the OT environment as it changes.

Using the CLI scanner for OT environments

If you use the runZero CLI scanner, configuration files can replicate the OT scan templates above.

Two example configurations follow. Save them as JSON files and pass them with the --config flag.

OT limited scan (CLI)

Filename: ot_limited_config.json

{
  "rate": 500,
  "max-host-rate": 20,
  "max-group-size": 2048,
  "max-ttl": 64,
  "tcp-ports": "21,22,23,69,80,123,135,137,161,179,443,445,3389,5040,5900,7547,8080,8443,62078,65535",
  "host-ping": true,
  "probes": "layer2,netbios,ntp,snmp,ssh,syn,tftp",
  "snmp-comms": "public,private"
}

OT full scan (CLI)

Filename: ot_full_config.json

{
  "rate": 500,
  "max-host-rate": 20,
  "max-group-size": 2048,
  "max-ttl": 64,
  "probes": "defaults",
  "snmp-comms": "public,private"
}

SNMPv3 credential example (optional)

If you use SNMPv3, add these fields to either config:

{
  "snmp-v3-username": "readonly",
  "snmp-v3-auth-passphrase": "exampleAuthPass",
  "snmp-v3-auth-protocol": "sha256",
  "snmp-v3-privacy-passphrase": "examplePrivPass",
  "snmp-v3-privacy-protocol": "aes256",
  "snmp-v3-context": ""
}

Running the scan

sudo runzero scan --config ot_limited_config.json 10.10.0.0/24 -o ./ot-limited-scan

Replace the config file, target subnet(s), and output directory as needed. You can also use --upload and --upload-site to send results directly to the runZero Console.

Additional considerations

• If your OT network is completely isolated from the internet, with no outbound communication permitted, consider deploying a self-hosted runZero console or an offline scanner inside your OT network so Explorers can communicate freely with the console. Self-hosting runZero and Offline mode configuration cover deploying and updating a self-hosted console.

• runZero discovers common OT/ICS ports and may actively probe those protocols, for example modbus (502/tcp) and EtherNet/IP (44818/tcp). You can disable these probes individually if you don’t want to scan those protocols actively.

• IPv6 scanning is a native feature of the runZero Explorer. An Explorer with an IPv6-enabled interface performs IPv6 neighbor discovery and runs a full scan on any newly discovered assets. You can also put IPv6 addresses and DNS AAAA records in the scan discovery scope.

• Both the OT Limited Scan Template and the OT Full Scan Template example templates use conservative scan rates, and a slower scan rate means longer scans. If you raise the rate, do it in small increments; going from 500 packets per second to 1000 packets per second is a reasonable step. Test each new configuration on a small subset of your OT network before extending it to the whole OT network.

Relevant runZero resources

• Scanning IoT and OT
• Ports scanned by runZero
• [Blog] How to actively scan industrial control systems safely
• [Blog] Finding Moxa MXview instances