How to Safely Scan Industrial Control Systems Without Disrupting PLCs

Scope and safety

Define the exact IPv4 targets and interface first. Prefer native identity operations such as PROFINET DCP Identify, EtherNet/IP List Identity, S7 identity lists, BACnet ReadProperty, FINS controller data, Niagara Fox hello, and SNMP GET/WALK. Keep requests bounded, disable protocols not approved for a segment, and retain warnings instead of guessing at device identity.

The scanner sends fixed identity requests and does not perform configuration writes, SNMP SET, DCP Set, brute force, exploits, vulnerability scripts, or Modbus requests. It correlates observations by normalized MAC address and requires --ack-authorized on every scan.

Linux scan

1
2
3
4
5
6
7

otserver-scanner scan \
  --target 192.168.1.0/24 \
  --interface eth0 \
  --source-mac 00:11:22:33:44:55 \
  --no-snmp \
  --output ./scan.otserver.json \
  --ack-authorized

The scanner enables supported protocols by default. Use --no-* flags to remove a protocol from a particular authorized run; there is no generic --protocols list or --read-only flag because the fixed read-only protocol behavior is built into the scanner.

Windows scan

1
2
3
4
5
6
7

.\otserver-scanner.exe scan `
  --target 192.168.1.0/24 `
  --interface '<interface name or GUID>' `
  --source-mac 00:11:22:33:44:55 `
  --no-snmp `
  --output .\scan.otserver.json `
  --ack-authorized

The Windows GUI exposes the same target, interface, protocol toggles, output, and authorization controls. Use it for an interactive run when the CLI is not the approved operator workflow.

Verify the result

Run validate, review partial-failure warnings, and import only the export belonging to the intended site. Compare the first run against the plant’s change window and device owner feedback before scheduling repeats.

See the protocol-specific requests or place scanners per production line.