implementing-ot-network-traffic-analysis-with-nozomi

Connect a Guardian hardware, VM, or container sensor to a network TAP or SPAN port on each monitored OT segment, then manage it through Vantage or the Central Management Console. Validate coverage by comparing discovered assets against your network architecture documentation.

Call the /api/v1/nodes endpoint with a Bearer token to retrieve discovered assets, optionally filtering by node type. The response includes vendor, type, and observed protocols, which you can aggregate for inventory reports.

No, Guardian operates passively by analyzing mirrored SPAN/TAP traffic, so it never sends packets to fragile PLCs. Smart Polling with native protocols is available sparingly for quiet devices, but active vulnerability scans should be avoided.

Missing assets usually stem from SPAN/TAP coverage gaps, oversubscribed mirror ports dropping packets, or devices that rarely transmit. Check sensor packets-per-second counters for drops and verify each segment's coverage against the asset inventory.

Use the Dragos platform when your environment is already standardized on it, since this workflow is specific to Nozomi Guardian, Vantage, and CMC. This skill is also not suited for IT-only network monitoring or active OT vulnerability scanning.