<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing ICS Asset Inventory — API & Tool Reference

> Quick reference for tools, commands, and APIs used in performing-ics-asset-inventory.

## Tools

### `zeek`

Passive ICS protocol identification and device discovery.

**Usage:**
```bash
zeek -r <pcap> local modbus dnp3 s7comm
```

**Key Outputs:**
  - `conn.log`: connection records with service identification
  - `modbus.log`: Modbus device communication pairs
  - `dnp3.log`: DNP3 outstation addresses

---

### `nmap`

Active ICS service discovery with NSE scripts.

**Usage:**
```bash
nmap -sV -p 102,502,20000,44818,4840,47808 <target>
```

**Key NSE Scripts:**
  - `modbus-discover`: Modbus device enumeration
  - `s7-info`: Siemens S7 device information
  - `dnp3-info`: DNP3 outstation identification
  - `bacnet-info`: BACnet device discovery
  - `enip-info`: EtherNet/IP device identification

---

### `p0f`

Passive OS fingerprinting for non-intrusive device identification.

**Usage:**
```bash
p0f -i eth1 -o results.txt
```

---

### `arp-scan`

Layer 2 device discovery on local network segments.

**Usage:**
```bash
arp-scan --interface=eth1 --localnet
```

---

## Integration Notes

- Passive techniques are safe for production OT networks
- Active scanning can crash PLCs — lab or explicit authorization required
- MAC vendor lookup helps identify device manufacturer
- Cross-reference discovered assets with existing CMDB/inventory

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82 Rev 3 §5.1: OT Asset Management
