Adversaries may perform multicast discovery requests which is when one system or device sends messages to all systems and devices in a pre-defined group on a network (or subnet) and then waits for a response. If a response is received that means the system or device that responded is live and can communicate over that protocol. Multicast discovery tends to be stealthier than broadcast discovery because every system or device on the network (or subnet) is not being messaged. One common OT protocol that has a multicast discovery mechanism is the Process Field Network (PROFINET) Discovery and Configuration Protocol (DCP) with its Identify All requests.(Citation: Cisco Active Discovery)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Safety Controller
is related to Remote Terminal Unit (RTU)
is related to Programmable Logic Controller (PLC)
is related to Application Server
is related to Virtual Private Network (VPN) Server
is related to Data Gateway
is related to Intelligent Electronic Device (IED)
is related to Jump Host
is related to Firewall
is related to Workstation
is related to Routers
is related to Control Server
is related to Switch
is related to Data Historian
is related to Human-Machine Interface (HMI)
is related to Programmable Automation Controller (PAC)
is related to Distributed Control System (DCS) Controller
is blocked by Static Network Configuration
is blocked by Network Segmentation
is blocked by Detection of Multicast Discovery
Impressum Deutsch Englisch