ICS Deep Packet Inspection (DPI)
Definition
ICS Deep Packet Inspection decodes industrial protocols at the application layer to validate semantics, enforce command policy, and detect unsafe or unauthorized operations—far beyond simple port/IP filtering.
Examples
- An inline sensor blocks a Modbus write command to a PLC because the function code and register range aren’t on the approved allowlist for that device.
- A passive sensor flags an IEC-104 control command from an unexpected source and outside the normal polling window.
Discover 🔎
Generic firewalls and IDS see ports and IPs; ICS DPI understands the language of the plant. By parsing protocols like Modbus, DNP3, IEC 60870-5-104, IEC 61850 MMS/GOOSE, EtherNet/IP (CIP), PROFINET, OPC UA, BACnet, and Siemens S7, DPI can tell reads from writes, validate command parameters, and enforce policy tied to the process. Done well, DPI provides high-fidelity detection and precise control with minimal disruption to deterministic traffic.
Tip: The interactive version includes progress tracking, decks, and premium deep dives.