passive-ot-network-discoverylisted

## When to Use - Initial assessment of an unfamiliar OT network where no asset list exists. - Baseline capture before an active assessment or a firewall rule review. - Investigating anomalous PLC or historian behavior reported by operators. - Validating an existing inventory against observed traffic. - Rogue device hunt. Rogue devices appear as unknown MACs, unknown IPs, or duplicate IPs. ## Prerequisites - tshark 4.x. Verify with `tshark --version`. - zeek 5.x. Verify with `zeek --version`. - scapy 2.5 or newer. Verify with `python -c "import scapy; print(scapy.__version__)"`. - SPAN port or network TAP on the target segment. Without a TAP the capture is incomplete. - Capture storage. Budget 1 GB per hour per 100 Mbps of span utilization. - Root or Administrator rights on the capture host. Required to open the interface. - Credentials: none for the capture itself. - Authorization: written approval from the segment owner before the first frame is captured. - Upstream skills: none. - nmap 7.94 or newer with NSE OT scripts. Only required for the gated identity confirmation step. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Captures and inspects traffic. Sends no packets. Safe to run during normal operations. ## Workflow 1. Verify the capture interface and the span: `ip link show <iface>` `tcpdump -i <iface> -c 10 -nn` If tcpdump prints nothing after 30 seconds, the SPAN or TAP is not delivering frames.