PacketSafari
Log in

OT

Review packet-linked industrial evidence, coverage, semantic mappings, and timelines for supported OT protocols.

The OT tab is PacketSafari's industrial-protocol workspace. It starts with deterministic protocol behavior extracted from the capture, then adds optional site and process context through editable signal mapping and semantic reanalysis.

Supported OT protocols

The current OT workflow is designed around protocols such as:

  • GOOSE
  • Modbus / Modbus TCP
  • DNP3
  • MMS
  • CIP / EtherNet-IP
  • OPC UA

What you can do

  • Review grouped protocol operations, writes, controls, endpoints, assets, and exact frame evidence when exposed by the result
  • Use View packets to open the filter behind an evidence group
  • Build or edit shared per-PCAP signal mappings
  • Import SCL data when available
  • Seed starter mappings from the capture
  • Save the mapping and run Refresh OT for semantic reanalysis

Understand OT evidence coverage

The capture summary keeps two evidence layers separate:

  • Protocol behavior describes deterministic operations and anomalies extracted from supported protocol fields.
  • Site / process semantics describes optional mappings from protocol values to customer-specific assets, signals, and operational meaning.

Each layer can be Complete, Partial, Not applicable, Optional context absent, or Unavailable. The summary explains why a layer is limited and can show how many rows were examined. A complete protocol layer does not imply that site/process mappings exist, and an absent optional mapping does not erase the underlying packet evidence.

Result views

  • State timeline for post-index semantic transitions
  • Event story for OT-relevant events and severity filtering
  • Protocol risk summaries across detected OT protocols
  • GOOSE live diff when GOOSE traffic is present

Risk labels and event severity are investigation signals, not proof of unsafe process state or malicious activity. Confirm material conclusions against the packet pivots, capture viewpoint, expected control logic, and site knowledge.

Use this view when packet-level decoding is not enough and you need asset, signal, or industrial-process context without losing the underlying packet evidence or its coverage boundary.