OT/ICS Security Scanner

01Overview

Active network scanning is genuinely dangerous in operational technology. A single unexpected probe can crash a PLC, trip a protection relay, or break a single-master SCADA session and disrupt a live control loop. This project takes the opposite approach: it is a set of purely passive OT/ICS security scanners that never transmit a single packet. Everything is derived offline from captured traffic (PCAP / PCAPNG) collected via TAPs, SPAN ports, or existing IDS/NDR sensors, making it safe to run against production plants, substations, and refineries.

The flagship is the Unified OT Scanner (v2.0, ~22,700 lines) that merges and extends two earlier single-purpose tools into one pipeline. From a capture alone it discovers industrial assets, fingerprints vendors and firmware, decodes 20 industrial protocols, maps the network to the Purdue model, matches known ICS CVEs, detects ICS malware behavior, scores composite risk, and reconstructs multi-hop attack paths from IT entry points to safety-critical devices. Two legacy scanners (PLC-focused and RTU/IED-focused) remain in the repo for reference.

The tool is built for OT/ICS security engineers, SOC analysts covering industrial networks, and asset owners in energy, manufacturing, utilities, and building automation who cannot risk active scanning. Its output is broad and operational: interactive HTML and GraphML topology, SIEM-ready CEF/LEEF/STIX/ECS/Splunk feeds, ServiceNow CMDB import, auto-generated Palo Alto / Fortinet / Cisco firewall policy, and NERC CIP / IEC 62443 / NIST 800-82 compliance reports.

It is notably self-contained and honest about its footprint: stdlib-only Python (only scapy/dpkt/colorama), graceful degradation when optional engines are missing, 76 offline unit tests, and a GitHub Actions matrix across Python 3.8/3.10/3.12. A CISA KEV auto-refresh importer keeps the 'actively exploited' and EPSS data current from authoritative sources instead of hand curation.

02Key Capabilities

03Architecture

A single PCAP-analysis engine (PCAPAnalyzer in core.py) reads frames through a dual scapy/dpkt backend, dispatches them to Layer-2 and IP protocol analyzers, and builds a per-device registry and communication-flow table. A finalization pipeline then runs fingerprinting, vulnerability checks, CVE matching, topology mapping, risk scoring, threat detection, and access auditing before nine analysis engines and a reporting/export layer render the results. Every sub-engine is loaded via try/except ImportError for graceful degradation.

04Project Structure

05Security Controls

06Technology Stack

Language

Python 3.8+ (stdlib-only core)

Packet parsing

scapy >= 2.5.0 (primary) or dpkt >= 1.9.8 (fallback backend)

Optional

colorama >= 0.4.6 for colored terminal output

Data modeling

Python dataclasses (20+ domain types with to_dict())

Testing

pytest >= 7.0 - 76 offline unit tests across 11 files

CI

GitHub Actions matrix on Python 3.8, 3.10, 3.12

Reporting

Self-contained HTML (Catppuccin Mocha), GraphML, CSV, JSON

License

MIT

07Quick Start

$ cd ot_scanner && pip install -r requirements.txt
$ python ot_scanner.py capture.pcap -o reports/ -f all
$ python ot_scanner.py capture.pcap --project-dir /path/to/tia_projects/ -o reports/
$ python ot_scanner.py capture.pcap --policy policies/
$ python ot_scanner.py capture.pcap --splunk-hec events.ndjson --elastic-ecs ecs.ndjson
$ python ot_scanner.py capture.pcap -v --severity high   # exit code 1 on CRITICAL/HIGH for CI gating

08Compliance & Frameworks

09Integrations & Outputs