DENIS

Solution · OT monitoring

Passive OT network monitoring from a SPAN port or TAP

Watch what happens on a control network without adding traffic to it. DENIS listens to a mirrored copy of the traffic, decodes the industrial protocols and tells you about new paths, control commands and behaviour that differs from normal.

SPAN and TAP guideIndustrial network security

Listening only

With the OT profile DENIS sends nothing on the network it watches: no ARP sweep, no ping, no port scan. It builds its picture from a copy of the traffic, so it cannot disturb a controller. Use a capture interface without an IP address of its own where you can.

  1. Your networkPCs · servers · cameras · PLCs · HMIs
  2. SPAN / mirror port or TAPread-only copy
  3. one way
  4. DENISdecodes, does not transmit on the mirror
A mirror port or tap gives DENIS a copy of the traffic. DENIS listens on it and sends nothing back into it.

SPAN or TAP

  • A SPAN (mirror) port is configured on a managed switch and copies the traffic of chosen ports or VLANs to one port. It costs nothing extra, but a busy switch may drop mirrored frames, and the mirror only carries what passes that switch.
  • A network tap is a device in a cable that copies everything on that link. It sees the link completely, including errors, and needs a short interruption to install.
  • Mirrors carried over a VLAN (RSPAN) are read like a local mirror. Mirrors delivered inside ERSPAN, GRE, VXLAN or Geneve tunnels can be read too (opt-in); that has been verified on hand-built frames and public sample captures, not yet on real switches.
  • One DENIS machine can read several mirror ports at once, for example one per cell, next to its normal interface.
$ denis run --profile ot --iface eth0 --mirror-iface eth1 --mirror-subnet 10.20.50.0/24

Where to mirror

Industrial conversations are only visible where they cross the mirrored port. Mirror the switch that carries the cell or area traffic, and the link between levels you care about (for example the cell uplink towards supervisory systems). Layer-2 traffic stays local: to see GOOSE publishers, mirror a station-bus switch; for PROFINET real-time traffic, mirror the cell switch.

What it watches for

  • Suspicious commands: PLC stop and start, program download, restart and operate, where they are visible on the wire.
  • Unexpected communication: a new client, server and protocol path after the learning period, and industrial traffic to or from outside the local network.
  • Behaviour changes: per-device baselines of destinations, ports, volume and active hours, with alerts when a device leaves its usual pattern.
  • Your own rules: allow-lists of the devices that may talk to a controller, and alerts when a chosen command reaches a chosen device.

The learning period

For the first 24 hours by default DENIS records the normal paths without alerting. Control commands are never held back by the learning period. Run it through a representative production period, including maintenance windows when engineers download programs, before relying on new-path alerts.

The What DENIS cannot see page on demo data: dropped packets, packets arriving twice from the mirror, a silent VLAN and one-way traffic, each with what to do
Know whether your mirror delivers what you think: drops, duplicates and silent VLANs, with what to change.
Settings, Capture: capture and mirror interfaces, monitored networks (office, production hall and branch office) with port scan and ping switched off for the production hall, and the active probing switches
Capture settings on the demo network: the production hall is listened to and never scanned.

Limitations

  • Not yet run against live traffic at a real industrial site; plan a trial period.
  • Duplicate packets from overlapping SPAN sessions or several taps can be counted or removed (new in 4.3), and the page What DENIS cannot see shows how many arrive twice. Mirroring each link once is still the better setup.
  • A mirror sees only what passes the mirrored switch or link. A switch under load may drop mirrored frames.
  • Decoding is per segment with bounded reassembly; it does not reassemble TCP streams in general, and it does not read written values.
  • Encrypted protocols show metadata only. HSR frames are not unwrapped.
  • An organisation may evaluate the Community edition free for 30 days from its first installation, on up to 100 devices, for evaluation and demonstration only; running its operations on DENIS needs a commercial license from the author, in the tiers DENIS 500, DENIS 5000 and DENIS 20000 (above 20,000 devices individually). See information for organisations.