<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Auditing SCADA Network Segmentation — API & Tool Reference

> Quick reference for tools, commands, and APIs used in auditing-scada-network-segmentation.

## Tools

### `nmap`

Network scanner for zone boundary connectivity testing.

**Usage:**
```bash
nmap -Pn -p 502,102,44818,4840 <target> --reason
```

**Key Flags:**
  - `-Pn`: skip host discovery (treat all as online)
  - `--reason`: show why port is open/filtered
  - `-sV`: service version detection
  - `--open`: show only open ports

---

### `traceroute`

Trace network path between zones to verify routing.

**Usage:**
```bash
traceroute -T -p 3389 <target>
```

**Key Flags:**
  - `-T`: TCP traceroute (firewall-friendly)
  - `-p`: destination port

---

### `iptables`

Linux firewall rule inspection and testing.

**Usage:**
```bash
iptables -L -n -v --line-numbers
```

---

## Integration Notes

- Test from multiple zones to validate bidirectional enforcement
- Document all zone boundary test results for audit trail
- Coordinate active testing with OT operations team

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- Purdue Enterprise Reference Architecture (ISA-95)
