Most engineers think…
Most people assume OT asset inventory means running an active network scanner — the kind of thing that crashes PLCs. That mental model is wrong and dangerous.
Nozomi Guardian builds its inventory entirely from mirrored traffic: no packets are sent to OT devices, no risk of crashing a PLC or RTU. The result is a continuously updated record for every device that communicates — with vendor, firmware, open protocols and Purdue level. Smart Polling is the optional, carefully rate-limited add-on for the narrow set of attributes passive DPI cannot reach. That distinction — passive-first, selective-active-only-when-needed — is what makes Nozomi safe in the most fragile Level 0/1 OT environments.
① Why passive OT asset discovery is the foundation of OT security
The fundamental OT security problem is visibility: most plants run hundreds of PLCs, RTUs and HMIs that were never designed to be scanned, and a badly timed ICMP sweep can crash a running process. The result is that most OT environments have asset lists that are months out of date, filled with devices nobody remembers adding. PLCs and RTUs simply must not be disrupted by discovery traffic.
Nozomi Networks solves this with passive discovery: the Guardian sensor connects to a SPAN/mirror port or TAP on an aggregation switch and reads a copy of all traffic. Guardian applies DPI to every conversation it sees. Every device that sends or receives a packet is catalogued automatically — with no packets ever directed at the OT device itself. The inventory is continuously updated in real time as new conversations appear.
This passive-first approach means Guardian can be deployed in a live plant, at Level 0 right up to Level 3, without a maintenance window. Complete inventory is not optional: you cannot detect anomalies, match CVEs or enforce segmentation policy on devices you do not know exist.
Why is passive discovery the preferred approach for OT asset inventory?
② What Guardian captures — the rich attribute record per asset
Every discovered device gets a rich, continuously enriched attribute record. Core network fields are captured immediately: IP address, MAC address, hostname, vendor/manufacturer, device type (PLC, RTU, HMI, engineering workstation, historian, IoT endpoint, switch…), open protocols, communication peers, first-seen and last-seen timestamps. These come from passive DPI without any query to the device.
Protocol-level enrichment
Guardian goes further by parsing industrial protocols — Modbus, DNP3, Siemens S7/S7Plus, EtherNet/IP (CIP), BACnet, Profinet, IEC 60870-5-104, OPC UA and many more. Fields such as firmware version, OS version, device model and Purdue level are extracted from the protocol conversations themselves. A Siemens S7 exchange, for example, reveals exact CPU type and firmware; a BACnet exchange reveals device object descriptors.
The Asset Intelligence subscription from Nozomi Networks Labs adds curated device profiles that further refine classification — reducing false positives and filling in vendor-specific fields. The Arc endpoint sensor can supplement the network-layer record with host context (users, running processes, USB sessions) for assets where deeper endpoint visibility matters.
Nozomi's core network sensor — listens on a SPAN/TAP, runs DPI, discovers every communicating device and builds the live asset inventory with zero OT disruption.
The interactive topology view showing every asset as a node and every communication as an edge. Group by Purdue level, subnet, device type or custom tag.
Optional selective active querying — targeted, rate-limited, protocol-aware queries to specific devices to retrieve attributes passive DPI alone cannot see.
Any device that appears on the OT network without an existing authorised record. Guardian fires a new-asset alert and the map shows its communication edges immediately.
In an interview, always specify where each attribute comes from: IP/MAC from passive network observation; firmware/model/Purdue level from protocol DPI (S7, Modbus, BACnet fields); deeper host context from Arc; refined classification from Asset Intelligence. Saying 'Guardian sees everything' is imprecise — the depth of the attribute depends on which protocols the device uses and whether Smart Polling is enabled.
Which of these asset attributes does Guardian typically extract from industrial protocol traffic (not just IP headers)?
③ The interactive network map — reading nodes, edges and groups
Guardian renders the entire discovered asset set as an interactive network graph: every device is a node and every observed communication link is an edge. The map is live — new devices and new connections appear automatically as Guardian sees traffic. Clicking any node opens its full attribute record, alert history and communication log.
Node grouping lets analysts orient large, complex environments. Devices can be grouped by subnet, Purdue level, zone, device type or custom tags. A power utility might group by substation and then by Purdue level within each substation. This makes the map a practical operations tool, not just a pretty diagram.
What to look for on the map
The map is most powerful for spotting unexpected lateral communications: a PLC initiating a connection to an external IP, a historian talking directly to a field device it should never reach, or an unknown node that appeared in the last hour. Rogue devices appear as new, unclassified nodes. Communication edges to those nodes are immediately visible, showing exactly what the rogue device was talking to before the analyst isolates it.
The Nozomi network map is live — it updates as new traffic is observed. A common mistake is checking it once at deployment and assuming it stays accurate. New devices, new communication links and rogue nodes all appear automatically. Build a habit of reviewing the new-asset alert queue alongside the map, especially after maintenance windows when contractors may have added or connected devices.
▶ Watch a rogue device get discovered and investigated
How Guardian catches an unauthorised device the moment it connects. Press Play for the normal detection path, then Break it to see what happens when the mirror port is misconfigured.
An analyst opens the Nozomi network map and sees an unclassified node connecting to a PLC on port 502. What is the first thing the map tells them — before any external check?
④ Smart Polling & rogue-asset detection — completing the picture
Passive DPI captures the majority of asset attributes from observed traffic. But some fields — certain firmware registers in Modbus devices, SNMP system descriptions, BACnet object lists — are only available if you ask for them. Smart Polling is Nozomi's optional selective active querying add-on that fills these gaps.
Smart Polling is not a network scan. Queries are targeted to specific devices and specific protocols, rate-limited to OT-safe intervals, and protocol-aware — so a Modbus device is queried with valid Modbus read requests, not generic probes. You can enable Smart Polling per device, per protocol or per network segment. The enriched attributes flow back into the same asset record, giving a more complete picture than passive alone can achieve.
Rogue and unmanaged asset alerting
Any device that appears on the network for the first time generates a new-asset alert in Guardian. Analysts see the alert, open the map, examine the new node's attributes and communication edges, and cross-check the change-management log. If the device has no approved change request, it is treated as a rogue device. Guardian continuously compares the live asset set against the known-good baseline, so any drift — a new PLC, a new wireless access point, a contractor laptop — is caught in minutes rather than months.
Deepa at an Indian power utility faces this
During a routine review in Nozomi Vantage, Deepa Krishnan — OT Security Analyst at IndoPower Grid Pvt. Ltd. in Hyderabad — notices a new unclassified MAC address in a substation LAN that was first seen 30 minutes ago and is communicating with the substation engineering workstation on port 502.
A contractor plugged a personal laptop into the substation switch to download a relay configuration file, bypassing the formal change-management process.
Guardian fired a new-asset alert automatically. The network map shows the rogue node and its Modbus edge to the engineering workstation. No approved change request exists in the CMDB for today.
Vantage ▸ Assets ▸ New & Unmanaged ▸ Network Map nodeDeepa contacts the field team; the contractor is asked to disconnect the laptop immediately. The device is logged as a policy violation and a formal change request is opened for future authorised access.
After disconnection, the rogue node disappears from the Guardian map; the unmanaged asset alert clears; the asset count returns to the authorised baseline.
When Guardian fires a new-asset alert, the first verification step is the change-management log — not an assumption that the device is malicious. Many new-asset alerts are authorised additions that bypassed the process. Cross-check before isolating: confirm no approved change request exists, then treat it as rogue. Document the outcome either way to refine the known-good baseline.
A site engineer wants to enable Smart Polling to get firmware versions from Modbus devices. What is the key constraint they must respect?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is passive discovery safer than active scanning in OT environments? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Guardian
- Nozomi's core passive OT/IoT network sensor — performs DPI on mirrored traffic for asset discovery, network visualisation and threat detection, with zero traffic sent to OT devices.
- Passive DPI
- Deep packet inspection performed on mirrored or tapped network traffic — reads every protocol conversation without injecting any packets into the OT network.
- SPAN / mirror port
- A switch feature that sends a copy of selected port or VLAN traffic to a monitoring port — how Guardian receives traffic without being inline.
- Smart Polling
- Optional selective active querying add-on in Nozomi — targeted, protocol-aware, rate-limited queries to specific devices to retrieve attributes that passive DPI alone cannot see.
- Network map / graph
- The interactive topology view in Guardian and Vantage showing every discovered device as a node and every observed communication link as an edge, updated live.
- Rogue / unmanaged device
- Any device that appears on the OT network without a prior authorised record — Guardian fires a new-asset alert and shows its communication edges on the map.
- Asset Intelligence
- A subscription feed from Nozomi Networks Labs containing curated device profiles and behaviour templates that improve classification accuracy and reduce false positives.
- Purdue model
- Reference architecture for ICS/OT networks organising devices into Levels 0 (field) through 5 (enterprise); Guardian auto-maps each asset to its Purdue level.
- Arc
- Nozomi's lightweight endpoint sensor that adds host-context attributes (users, processes, USB sessions) to complement the network-layer inventory Guardian builds.
📚 Sources
- Nozomi Networks — Guardian sensor datasheet: passive OT/IoT network monitoring & asset discovery. nozominetworks.com/products/guardian
- Nozomi Networks — Vantage: cloud-native SaaS platform for multi-site OT/IoT visibility. nozominetworks.com/products/vantage
- Nozomi Networks — Asset Intelligence subscription feed. nozominetworks.com/products/asset-intelligence
- Nozomi Networks — Smart Polling: selective active enrichment for OT asset attributes. nozominetworks.com
- Nozomi Networks Labs — OT/IoT Security Report 2026. nozominetworks.com/labs
- CISA — ICS asset management and inventory best practices. cisa.gov/ics
What's next?
Got the inventory? Next, learn how Nozomi's hybrid detection engine — behavioural anomaly baseline plus signatures plus threat intelligence — uses that same asset graph to catch zero-days and known threats across your OT network.