Chapter 6: Packet Deep Dive
Previously, we discussed what Switch Port Analyzer (SPAN)/Mirror and Test Access Point (TAP) are and how to configure a mirror port in our lab environment using Wireshark, Tcpdump, and TShark to listen to the traffic communicating between the engineering software and our Koyo Click Programmable Logic Controller (PLC). We also reviewed how intrusion detection system (IDS) technology utilizes SPAN/Mirror and TAP to perform deep packet inspection on industrial network traffic. Additionally, we touched on some methods and tactics that we can use to bypass IDS monitoring during a pentesting engagement.
In this chapter, we are going to take a closer look at the communication pathway between the software and the PLC, and ...
Get Pentesting Industrial Control Systems now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
