ICS / OT · MIT · documentation

Nmap for ICS/OT Security

Install Nmap and run authorized industrial exposure discovery for Modbus, EtherNet/IP, Siemens S7, DNP3, BACnet, IEC 104, and related protocols — with conservative timing, identity-oriented NSE, and remediation-focused reporting.

View on GitHub Example walkthrough Review map

In the guide

Install Linux, macOS, and Windows · verify NSE scripts
OT-safe defaults Slow timing and rate limits · avoid -A / -T4 on live OT
Protocol commands Modbus, ENIP, S7, OMRON, Fox, IEC 104, BACnet, DNP3
Report and troubleshoot Example engagement, output reading, quick card

With ICS OT Protector

Use this guide for Nmap options and protocol identity. Use ICS OT Protector for sector port catalogs, shared scan engines, and JSON/CSV reporting across water, energy, BAS, and rail.

Is

Documentation for authorized exposure discovery. An open port is a lead for zoning and hardening.

Is not

Exploit payloads, credential attacks, or DoS recipes against production ICS/OT devices.

Authorized defensive use only. SpinfoSecurity