As you can see, the TAP is just in the middle of the Fortigate switch and the PLC. In the picture below you can identify different devices, such as Fortinet Fortigate Rugged 90D, Fortinet Fortiswitch 112D-PoE, Siemens PLC S7-1200, Siemens HMI, Siemens TAP 104 and a laptop.

You can find the article clicking here.ДЇollowing the concept of the previous picture, this time, I have replicated this scenario in small testbed. I wrote about it more than a year and half. The traffic will be gathered by Grassmarlin tool that can be downloaded from here. For example, we can be interested to identify issues between the HMI and the S7-1500 PLC. One use case can be as the picture below shows. It operates in a fault-free mode even when the power is off. Two to connect the segments that we want to monitor and two more to connect the systems to collect the frames. The TAP device does not affect to the communication that pass through it. Once the collected frames are stored, we can visualize them with a network analyzer tool to identify the information that we are looking for. Siemens TAP 104 is a hardware device that can be installed between two devices to gather a copy of data traffic on Ethernet based networks. However, as I said several times, we must use specialized equipment for these environments, in particular industrial ones. But port mirroring is not the only one, we can use TAP devices. There are a lot of reasons to use it, such as identify communications, troubleshooting tasks, use of IDS/IPS systems, and so on.

You can access to the article clicking here. Few months ago, I wrote about how port mirroring is an allied to capture and analyze network traffic.

Estructura siemens simatic s7-1200