profinet-anomaly-detectionlisted

## When to Use - Monitoring a PROFINET segment for device rename or IP reassignment attacks. - Hunting for duplicate device names or rogue IO devices on Layer 2. - Investigating cycle time disruption or missing RT frames reported as network glitches. - Detecting ARP spoofing between controllers and IO devices. ## Prerequisites - Zeek 5.x. Verify with `zeek --version`. - SPAN of the PROFINET VLAN. PROFINET RT and DCP are Layer 2. The span must carry full Ethernet frames, not just IP. - Device name and MAC inventory from `profinet-device-inventory`. - Packet capture of at least one full production cycle window for baseline statistics. - tshark 4.x for capture analysis. - Credentials: none. Layer 2 detection reads frames. - Authorization: network owner sign-off for policy deployment. - Upstream skills: `profinet-device-inventory` for the device name and MAC baseline. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Deploys a Zeek policy and analyzes captures. Safe to run during normal operations. ## Workflow 1. Capture the baseline on the PROFINET VLAN: `sudo tshark -i <iface> -Y "pn_rt or pn_dcp" -w pn-baseline.pcapng -b filesize:1048576 -a duration:1800` 2. Extract the device name announcements and MACs: `tshark -r pn-baseline.pcapng -Y "pn_dcp && pn_dcp.service_id == 5" -T fields -e eth.src -e pn_dcp.device_name | sort -u > dcp-names.txt` DCP service ID 5 is Identify. Every legitimate device announces her