PRODUCT PAGE
Full, real-time visibility into what's actually happening on your control system communication links — without installing agents on your RTUs or making any changes to your network.
CAPABILITIES
Passive sniffer or transparent proxy mode decodes traffic in real time across all three protocols — with no impact on network timing or RTU operation.
An LSTM neural network detects unusual traffic sequences in real time. Ensemble scoring combines multiple detectors to reduce false positives and surface only actionable alerts.
Out-of-the-box detection of known attack patterns and protocol violations — no tuning required before first use.
Complete map of every Information Object Address on every RTU. Instantly spot unexpected datapoints, unauthorized writes, or new addresses that were never commissioned.
Every measurement value and control command logged with millisecond timestamps, ready for incident documentation and regulatory reporting.
Auto-discovers RTUs, MTUs, and HMIs and builds a live network map with per-node event logs and traffic statistics.
DEPLOYMENT MODEL
Runs on a standard Windows host with Npcap for packet capture. No taps, no spans required for basic deployments — plug into the existing switch mirror port and start capturing immediately.
Replay captured CSV sessions offline, retrain ML detectors on historical traffic, and compare normal versus anomalous baselines for post-incident investigation.
Extend NetMapper with custom protocol decoders without modifying the core engine. Detectors and analyzers are independently loadable modules.
The LSTM and ensemble detectors ship with generic baselines but are designed to be retrained on site-specific traffic for the lowest false-positive rate possible.
PRODUCT VISUALS
RESOURCES
IEC 60870-5-104 (all 58 type IDs), Modbus TCP/RTU, and OPC-UA — covering the protocols used in the vast majority of SCADA and substation automation networks.
Windows 10/11 with Npcap for passive capture. Mirror port or TAP access to the OT network segment. No agents, no changes to RTU firmware or PLC configuration.
IOA dictionary, node inventory, baseline anomaly model, alert threshold documentation, and SOE export templates for your reporting workflow.
CONTACT
Share your protocol mix, approximate node count, and the network segments you want to cover. SDAQ will propose the right capture topology and detector configuration for your site.