Monitoring network activity is key to securing any production environment. Keeping tabs on the activities of the users, applications and the devices enables operators to ensure expected and normal operations. Monitoring also allows problems to be detected and corrected before damage can occur.
However, not all networks are created equal. Monitoring industrial control system activity is difficult for two reasons. First, they use different protocols than IT networks. Second, separate protocols are used for performing data-plane and control-plane activities:
