Machine-network recon kit

A cheap travel router (OpenWrt) in bridge mode sits inline on an unknown machine network and scans it before your laptop is even on, then serves a signed text file over HTTP. A PowerShell client reads it, sets a safe static IP, and IDs the PLCs. Nothing gets installed on the workstation.

Flow: arm, connect, claim, name

• Arm: router in bridge mode, ethernet into the machine net. Scans every 180s, bridge mode only.
• Connect: join the router wifi, you land on the machine L2 (no NAT).
• Claim: claim.ps1 finds the file by signature, picks a free IP, re-pings to confirm it is empty, sets the NIC, pings the PLCs.
• Name: names.ps1 writes a device list plus plc-<octet> hosts entries.

Router recon

arp-scan sourced from 0.0.0.0 (no lease taken), nmap -sn for liveness, EtherNet/IP ListIdentity on live hosts only for vendor / product / rev / serial.

Dossier (signed, high port)

#RECON v1
SUBNET|192.168.1.0/24
FREE|192.168.1.240,192.168.1.239,...
PLC|192.168.1.10|Rockwell|1769-L33ER CompactLogix|32.11|0x60A1B2C3

The client checks the signature, so a random device running HTTP gets ignored.

Built careful

No aggressive scans in the auto pass (old PLCs fault), trust signed content not an open port, re-ping before claiming (a powered-off device keeps its static IP).

Next

Auto-load found PLCs into RSLinx as an EtherNet/IP driver so RSWho populates on open. Rollback (VM snapshot plus registry export) tested first.