PLCscanners

PLCscanners are software tools or hardware devices designed to enumerate and assess Programmable Logic Controllers (PLCs) within industrial networks. They are used by asset owners and security professionals to build inventories, verify configurations, and evaluate exposure of control systems.

Functionality typically includes network discovery on defined ranges, protocol-aware fingerprinting to identify vendor and model, and collection of non-sensitive configuration details such as firmware versions, device role, and perceived network topology. Some scanners can detect open interfaces, running services, and, where accessible, web UI endpoints.

Operation can be active, sending crafted requests to PLC services, or passive, monitoring traffic without directly interacting with devices. Many tools support modules for common PLC families and protocols such as Modbus TCP, Siemens S7, and Allen-Bradley EtherNet/IP, with others for Schneider, Omron, and Mitsubishi devices.

Applications include asset management, baseline configuration audits, vulnerability assessments, and incident response planning. Use requires authorization and adherence to legal and safety guidelines, as unauthorized scanning can disrupt operations, expose sensitive data, or violate regulations.

Limitations include incomplete protocol coverage, variability in PLC configurations, potential disruption of control networks, and protections that block or anonymize responses. The term PLCscanner is generic and encompasses both open-source projects and commercial products that perform PLC discovery and assessment.