OT (Operational Technology) Discovery

OT vs IoT

These are different categories. IoT covers connected enterprise/consumer devices (cameras, sensors, smart-building endpoints). OT covers industrial automation and control systems. OT assets appear under the Operational Technology category on the Assets page and can be filtered for there.

OT device types recognised

How OT devices are discovered

Three complementary detection methods, in increasing order of intrusiveness:

1. Passive — from network flow (zero-touch)

If you send NetFlow / sFlow / IPFIX to uControl (see Network Flow Monitoring), it watches for traffic to an OT-protocol port on an IP it doesn’t yet know, and automatically creates an OT asset for it — with no scanning whatsoever. This is the safest way to surface OT devices and is ideal for sensitive plant networks. New OT assets created this way are attributed to a “FLOW” discovery run.

2. Active — safe seed-scan port check (default on)

uControl’s standard seed scan already performs a lightweight TCP connection test to a set of ports. OT protocol ports are included in that test. A plain TCP connect does not speak the OT protocol — it only notes the port is open — so it is safe on OT networks. Combined with the device’s MAC-OUI vendor (Siemens, Schneider, Rockwell, ABB, …) and any SNMP description, this is enough to classify most OT devices.

3. Active — gentle identity probe (opt-in, OFF by default)

For richer detail, uControl can issue a single read-only identity request per device — Modbus “Read Device Identification” or EtherNet/IP “List Identity”. These are standard, read-only discovery commands that never change device state.

When a device answers, uControl records its true vendor, model and firmware revision read directly from the device, and uses them to refine the subtype — for example an ABB ACS880 answering on Modbus is classified as a VFD rather than the generic PLC its open port alone would suggest. Because this identity comes straight from the device’s own protocol response, it takes precedence over the MAC-OUI vendor guess (which on a virtualised or bridged device only reflects the host’s network card).

OT protocols & ports

Enabling & configuring OT detection

Passive flow discovery and the safe seed-scan port check are on by default, so OT devices are surfaced out of the box. The only thing you need to switch on for full vendor / model / firmware detail is the gentle identity probe — and you do that in the UI, no config files to edit.

Turn on the identity probe in the Worker Settings page

1. Open the discovery worker that scans your OT segment and go to Settings.
2. Under Discovery, tick OT active identity probing and click Save settings.
3. The change applies on the next scan — no restart, no file editing. Re-scan the OT range and the vendor, model and firmware fields populate (and drives reclassify to VFD, etc.).

The same Settings page also manages the explicit DNS resolver, network-flow collection (NetFlow/IPFIX ports) and automatic worker updates, so workers can be configured entirely from the UI.

# Opt-in gentle active OT identity probing (default: OFF)
ucontrol.seed-scan.probe-ot=false               # the "OT active identity probing" toggle

# Passive OT discovery from flow (default: on, configured on the control plane)
ucontrol.discovery.ot-flow.enabled=true
ucontrol.discovery.ot-flow.window-hours=24      # how far back in flow to look each cycle
ucontrol.discovery.ot-flow.max-per-run=50       # cap on new OT assets per cycle

Where OT devices appear

On the Assets page, filter the category dropdown to Operational Technology to see all OT assets; the fine subtype (PLC, RTU, …) is shown beneath the category, with the vendor and model alongside. OT assets are flagged as physical/on-premises (never virtual or cloud). If a device is mis-classified, you can reclassify it manually and uControl will not override your choice.

Recommended setup

1. Point a NetFlow/IPFIX exporter at uControl for your OT/plant segments — this surfaces OT devices passively, with zero touch.
2. Leave the safe seed-scan port check on (default) for segments you actively scan.
3. On controlled networks where you want vendor/model/firmware detail, enable OT active identity probing in each worker’s Settings page (Discovery section).