Chapter 11 — Networks and protocols
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Observation points"]
N2["11.2 Ports are not semantics"]
N3["11.3 Denies are coverage"]
N4["Practice note"]
N5["11.1b Protocol families in the work permit"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Observation points"]
N2["11.2 Ports are not semantics"]
N3["11.3 Denies are coverage"]
N4["Practice note"]
N5["11.1b Protocol families in the work permit"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Observation points]
|
v
[11.2 Ports are not semantics]
|
v
[11.3 Denies are coverage]
|
v
[Practice note]
|
v
[11.1b Protocol families in the work permit]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) describe what an authorized observer can learn from OT protocols without attacking them; (2) define function-code and register scope; (3) treat protocol denies as successful controls.
11.1 Observation points
Serial monitors see Modbus RTU on the wire; SPAN ports see Ethernet/IP or Modbus TCP; application logs see HMI actions. An assessment that only has HMI screenshots should not claim fieldbus visibility. State the vantage in the method section of every finding.
Lena writes the vantage point into each finding's method field, so readers know what could and could not be seen. At ABP, a serial monitor on the RS-485 trunk to PLC-A gives fieldbus visibility, while the HMI's own logs show operator actions. Findings based only on one of these say so, because each can miss what the other sees.
11.2 Ports are not semantics
TCP 502 often means Modbus TCP, but the meaningful scope is which function codes and which register ranges each station may use. Port 502 open is incomplete without the allow-list status and the stations observed. Chapter 4's permit function is the right abstraction.
Lena's findings about open ports always add which stations were seen using which function codes, so the reader knows whether the port matters. At ABP, the allow-list states that HMI-1 may write only registers 40001 to 40010 and that the historian may only read. A port scan alone would show none of that.
11.3 Denies are coverage
A firewall that blocks office-to-SCADA, or a monitor that drops function 16 from HIST-1, is evidence that a control worked for that probe. Coverage boards should count planned checks that were denied as completed checks, not as failures to get in.
"""Lab: Modbus function-code allow-list on synthetic, already-decoded requests (no network)."""
ALLOW = {("HMI-1", 3), ("HMI-1", 6), ("HIST-1", 3), ("HIST-1", 4)} # (source, function code)
WRITE_REGS = {("HMI-1", 6): range(40001, 40011)} # HMI may write setpoints only
reqs = [("HMI-1", 3, 40001), ("HMI-1", 6, 40003), ("HMI-1", 6, 40050),
("HIST-1", 3, 30001), ("HIST-1", 16, 40001), ("ENG-WS", 8, 0), ("HIST-1", 4, 30010)]
for src, fc, reg in reqs:
if (src, fc) not in ALLOW:
d = "BLOCK fc-not-allowed"
elif (src, fc) in WRITE_REGS and reg not in WRITE_REGS[(src, fc)]:
d = "BLOCK register-out-of-range"
else:
d = "PASS"
print(f"{src:7} fc={fc:2} reg={reg:5} -> {d}")
Expected output:
HMI-1 fc= 3 reg=40001 -> PASS
HMI-1 fc= 6 reg=40003 -> PASS
HMI-1 fc= 6 reg=40050 -> BLOCK register-out-of-range
HIST-1 fc= 3 reg=30001 -> PASS
HIST-1 fc=16 reg=40001 -> BLOCK fc-not-allowed
ENG-WS fc= 8 reg= 0 -> BLOCK fc-not-allowed
HIST-1 fc= 4 reg=30010 -> PASS
Synthetic case — Ashford Batch Plant. The CNHP coverage board lists HIST-1 cannot write as a planned check. The lab's BLOCK on function 16 is a green result for that check, not a red test failed.
Lena's board shows each planned check with its expected result.
11.4 Errors and limits
Banner grabs lie; confirm with application-level or decoded-frame evidence. Course environments never scan live plants.
Lena treats a device banner as a hint and confirms the product from the engineering project export or from decoded frames before recording it in the inventory. Banners can be outdated after a firmware update or deliberately generic. The confirmation step also prevents a common error where a gateway's banner is mistaken for the controller behind it. In the course, all such checks run on captured or synthetic data, never on a live plant network.
Practice note
Keep a one-page protocol inventory: trunk, baud rate, stations, function codes in use, allow-list owner. Update it when a vendor adds a station. Most mystery traffic is an undocumented engineering laptop.
11.1b Protocol families in the work permit
Work permits should name protocol families explicitly: Modbus TCP with function codes 3/4/6 on registers 40001-40010 is clearer than port 502. If write codes are forbidden from assessment stations, say so. If only listen-only taps are authorized, say so. Ambiguity here becomes an argument during the window when someone wants to try a diagnostic function just to see. When the permit names function codes, the monitor's allow-list for that window should name the same codes, so the permission and the evidence can be compared line by line.
At ABP, Lena's permit for serial verification says listen-only on the RS-485 trunk to PLC-A, names HMI-1's allowed writes, and forbids diagnostic function codes from the assessment laptop. During window W-17 a vendor's request to try a diagnostic was declined for exactly this reason, and evaluated later under its own permit.
Exercises
- EX031 — Vantage. Match three evidence types to the minimum vantage. Rubric: 3 = correct mapping (e.g. RTU CRC errors to serial; Modbus TCP FC to IP decode; setpoint change attribution to HMI/app log); 2 = two; 1 = one; 0 = none.
- EX032 — Scope. Rewrite "test Modbus on PLC-A" as a scoped method card line. Rubric: 3 = codes, registers, stations, read-only, window; 2 = partial; 1 = port only; 0 = none.
- EX033 — Lab. Why does HMI-1 fc=6 reg=40050 block while 40003 passes? Rubric: 3 = register-out-of-range vs in WRITE_REGS; 2 = one side; 1 = vague; 0 = wrong.
Synthesis
Scope OT protocols by semantics (codes, registers, stations); celebrate denies that match the plan.
Continue studying — chapter 11 of 50
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →