Chapter 6: Packet Deep Dive

Previously, we discussed what Switch Port Analyzer (SPAN)/Mirror and Test Access Point (TAP) are and how to configure a mirror port in our lab environment using Wireshark, Tcpdump, and TShark to listen to the traffic communicating between the engineering software and our Koyo Click Programmable Logic Controller (PLC). We also reviewed how intrusion detection system (IDS) technology utilizes SPAN/Mirror and TAP to perform deep packet inspection on industrial network traffic. Additionally, we touched on some methods and tactics that we can use to bypass IDS monitoring during a pentesting engagement.

In this chapter, we are going to take a closer look at the communication pathway between the software and the PLC, and we will be using Wireshark in greater detail to analyze these packets. During a pentest, capturing and analyzing traffic is crucial for success, as mentioned in the last chapter. Additionally, an understanding of the environment, assets, activities...