OT Traffic Baselining Procedures
This guide provides a methodology for capturing the normal communication patterns of the vessel’s OT network, establishing the baseline needed to detect anomalies and configure network protection.
1. The 72-Hour Observation Window
A baseline must cover multiple operational states. For a maritime audit, we recommend a 72-hour capture to include:
High-frequency thruster control and DP traffic.
Consistent navigation (GPS/AIS) and engine telemetry.
Pump control and automated valve sequences.
2. Design Verification (E26 4.2.1.4.1)
Per IACS UR E26, the Systems Integrator must prove that physical data flows match the approved Cyber Security Design Description.
- Validate Intra-Zone Protocols
- Verify Physical Port Mapping
- Confirm “Least Functionality”
- Verify Zone Boundary Device
- Match against Firewall ACLs
- Document Purpose of Data Link
- Identify Outbound Serial/IP
- Verify Physical Segmentation
- Block Unauthorized Telemetry
3. Implementation: Passive Capture
To maintain vessel safety, baselining must be passive. Use the following methods to ingest traffic without introducing latency or risk.
Configure the Managed Switch to duplicate traffic from “Member Ports” (PLCs/Sensors) to a “Destination Port” (Laptop/IDS).
- Best for: Core switches with high CPU overhead.
- Risk: Switch may drop mirror packets if CPU exceeds 80%.
Install a physical “Test Access Point” between critical assets.
- Best for: 100% visibility of full-duplex traffic without switch CPU load.
- Risk: Requires a brief downtime for physical cable insertion.
Wireshark Protocol Dissection
Use these display filters to isolate critical maritime flows from the noise:
| Objective | Display Filter |
|---|---|
| Modbus Writes |
mbtcp.func_code == 5 || mbtcp.func_code == 6
|
| NMEA-over-IP |
udp.port == 10110
|
| S7 CPU Halt |
s7comm.param.func == 0x29
|
4. OT Risk Mitigation & Anomaly Matrix
5. Formal Validation & Sign-off
A baseline is only an audit-valid “Target Profile” if reviewed. The following sign-off is required for the Ship Cyber Security Program:
- Chief Engineer / ETO: Verification that all discovered traffic is operationally necessary.
- Inventory Link: Confirm every talking IP/MAC has a corresponding entry in the Asset Master List.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
