CND (312-38) Network Defense Simulation

Welcome, Network Defender. You are assessing an industrial control systems (ICS) environment. Understanding legacy OSI Layer 1/Layer 2 standards is essential for implementing proper network segmentation in legacy operational technology (OT) networks.

Network Scenario

During an acquisition of an older manufacturing plant, you are tasked with auditing the plant floor's Operational Technology (OT) network prior to integration. The facility uses legacy Programmable Logic Controllers (PLCs) communicating over a deterministic, broadband coaxial network using token-passing to prevent collisions.

The IT department has requested a direct bridge from this network to the main corporate Ethernet LAN. You must identify the physical standard in use to recommend the appropriate industrial firewall/gateway to ensure protocol isolation.

Traffic & Logs

[14:22:10] SW-SPAN-01: Port Mirroring Initialized - Capturing VLAN 40 (Plant Floor)
[14:22:15] PHY-LOG: Intercepted Token Pass - Node MAC 02:00:1B:4A:22:01 -> 02:00:1B:4A:22:02
[14:22:16] IDS-ALERT: [1:2000145:1] LEGACY PROTOCOL - Unencrypted Broadband Control Frame Detected
[14:22:18] PCAP: Frame 45: MAC Control Frame (Type: Claim Token, Length: 22 bytes)
[14:22:19] SYS-LOG: Gateway dropping invalid CSMA/CD payload mismatch

*Analysis note: Observe the use of token passing on a physical broadband medium, completely lacking standard Ethernet (CSMA/CD) structures.

Question

Which of the following IEEE standards defines a physical bus topology?

Defensive Hint: Look at the logs showing a "Token Pass" mechanism on a broadband topology. While standard Ethernet uses CSMA/CD, which standard was specifically built around a token-passing bus (often associated with Manufacturing Automation Protocol)?

Expert Analysis

1. What is happening in the network

The packet capture and switch logs reveal a deterministic token-passing mechanism operating over a legacy bus architecture. Devices are transmitting "Claim Token" control frames, indicating this network strictly controls which node can transmit data at any given time to avoid collisions.

2. Identify attack or behavior

There is no immediate cyber attack in progress. The "threat" here is architectural. The business wants to directly bridge a legacy, unauthenticated industrial bus network to a modern Ethernet IT network. If this occurs, malware on the IT network could flood or manipulate the token-passing sequence, causing a Denial of Service (DoS) against critical physical manufacturing equipment.

3. Why the correct answer is correct (Option A)

IEEE 802.4 (Token Bus) specifically defines a physical bus topology that uses a token-passing mechanism for media access. It was heavily adopted in industrial settings (like the Manufacturing Automation Protocol - MAP) where deterministic, predictable delivery times were mandatory, unlike the random collision nature of early Ethernet.

4. Why others are wrong

B. 802.5 (Token Ring): Uses a logical ring topology, wired physically as a star (via a Multistation Access Unit or MAU).
C. 802.6: Defines Metropolitan Area Networks (MANs) using the Distributed Queue Dual Bus (DQDB) standard, not a local physical bus for endpoints.
D. 802.3 (Ethernet): Originally used a physical bus, but standard Ethernet is defined by its CSMA/CD (Carrier Sense Multiple Access with Collision Detection) access method, not token passing. Today it is almost exclusively deployed as a physical star.

5. Defensive action

Do NOT directly bridge legacy 802.4 Token Bus networks to standard 802.3 corporate networks. Defenders must implement the Purdue Enterprise Reference Architecture (PERA). Insert an industrial-grade firewall or OT gateway between the IT and OT boundaries. The gateway should terminate the legacy token protocol, inspect payloads, and securely translate necessary telemetry data via modern protocols (like encrypted MQTT or OPC UA) to the IT side.

MINI LESSON: Legacy Protocols in Modern Defense

Defenders often encounter outdated physical layer standards in Operational Technology (OT) and SCADA environments:

  • Availability Over Confidentiality: Legacy standards like 802.4 were designed purely for uptime and deterministic delivery. They have zero built-in encryption or spoofing protection.
  • The Danger of IT/OT Convergence: Bridging these flat, trusting network topologies directly into modern IP networks exposes vulnerable PLCs to modern automated threats (e.g., ransomware that scans and pivots).
  • Protocol Anomalies: Modern IDSes (like Suricata or Snort) can be tuned with specific SCADA rules to detect when legacy control frames leak into expected standard Ethernet segments.

Ready to master Network Defense?

Enhance your traffic analysis and defensive architecture skills with full CND practice environments.

Explore more CND simulations