historian-data-flow-mappinglisted

## When to Use - Identifying which devices feed which historian. - Reviewing cross-zone links from L3 historians into L1 and L2 zones. - Pre-change review before a historian replacement or interface migration. ## Prerequisites - tshark 4.x. Verify with `tshark --version`. - zeek 5.x. Verify with `zeek --version`. - SPAN port or network TAP on the historian subnet and the source subnets. - Credentials: none for passive flow analysis. - Authorization: operations sign-off to place a TAP at L3. - Upstream skills: `passive-ot-network-discovery` for role placement. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. ## Workflow 1. Extract flow pairs: `tshark -r capture.pcapng -T fields -e ip.src -e ip.dst -e tcp.dstport -e udp.dstport -E separator=, | sort -u > flow_pairs.csv` 2. Summarize the TCP and UDP conversations: `tshark -r capture.pcapng -q -z conv,tcp | head -80` `tshark -r capture.pcapng -q -z conv,udp | head -40` 3. Cross-check protocol split with zeek: `zeek -C -r capture.pcapng` `zeek-cut id.orig_h id.resp_h service conn.log | sort | uniq -c | sort -rn > zeek_services.txt` 4. Run the bundled aggregation script: `sh scripts/flow_report.sh capture.pcapng` Output file `flows.txt` lists src-dst-protocol/port pairs sorted by packet count. 5. Identify historians. A host that receives sustained 502, 20000, 4481