Based on an incomplete set of known MAC address to device associations, the presented method can guess correct device and vendor information. In this paper, we propose a lightweight passive network monitoring technique using an efficient Media Access Control (MAC) address-based identification of industrial devices. There are very few publications on lightweight passive scanning methodologies for industrial networks. In such cases, passive network monitoring offers an alternative, which is often used in conjunction with complex deep-packet inspection techniques. Since such additional traffic may lead to an unexpected behavior of devices, active scanning methods should be avoided in critical infrastructure networks. Active scanning, which generates irregular traffic, is a method to get an overview of connected and active devices. For this purpose, scans of networks are crucial. An integral part of an assessment is the creation of a detailed inventory of all connected devices, enabling vulnerability evaluations. Owing to a growing number of attacks, the assessment of Industrial Control Systems (ICSs) has gained in importance. The corresponding paper was presented at the ICS-CSR 2018. The software provided here serves as a PoC implementation. MacDetec - Device Identification by MAC Address
0 kommentar(er)
