SERINUS OT (Windows)

English | 日本語

SERINUS OT is a lightweight passive OT/ICS monitoring tool that detects the first communication from unknown devices connected to industrial control system networks.

Designed for OT security, ICS security, and industrial cybersecurity environments where active scanning is not acceptable.

It never transmits anything to the network — detection is based solely on MAC addresses observed in received packets.

• Completely passive (zero transmission)
• MAC address only — no active probing
• Detects first communication from unknown devices
• Operated with just 3 buttons
• Works in offline environments

---

---

Quick Start

Requirements

• Windows 10 / 11
• Python 3.9 or later
• Npcap
• scapy

Npcap — install with "WinPcap API-compatible Mode" enabled:

https://npcap.com/

scapy:

pip install scapy

Launch

Open a terminal with administrator privileges and run:

cd serinus_pc_proto
python app.py

For the English UI:

python app.py --lang en

After launch:

1. Select the NIC to monitor
2. Start bulk registration (learning)
3. End learning
4. Monitoring begins

---

Basic Usage

Initial Setup

1. Start bulk registration (learning mode)
2. Allow existing devices to communicate — they are recorded as registered
3. End learning
4. Switch to monitoring mode

When an Unknown Device Is Detected

When an unknown MAC address is detected:

• Screen flashes red/black
• Buzzer sounds

After dismissing the alert, you can review the device in the history screen.

If the device is legitimate, you can mark it as registered with a long press of the right button.

---

Exporting Data

To export the device list as CSV:

1. Connect the maintenance USB
2. CSV is written to usb_serial_out.txt
3. On an external PC, run:

python pc_extract_tool.py

4. Retrieve serinus_export.csv

Example output:

mac,ip,state,category,vendor_guess
00:00:0c:11:22:33,192.168.1.1,Registered,Network Device,Cisco
02:00:5e:10:00:01,192.168.1.10,Pending,Random MAC,

---

Out of Scope

The following are not covered:

• ARP spoofing / MITM detection
• Random MAC identification
• Active probing
• Detection of completely silent devices

SERINUS OT is intentionally designed to be:

• Completely passive
• MAC address only
• Single-function

— prioritizing low cost and ease of deployment in the field.

Notes

• Administrator privileges required — Npcap requires administrator rights for raw packet capture on Windows.
• Windows only — Linux and macOS are not supported (Npcap dependency).
• Passive only — SERINUS OT never transmits packets to the network.
• Privacy — Detected MAC and IP addresses are stored locally in serinus_state.json. This file is not transmitted anywhere and is excluded from version control.
• Random MAC addresses — Smartphones and recent operating systems use randomized MAC addresses per network. These will appear as unknown devices on every reconnection and cannot be reliably identified.
• Prototype — This is a proof-of-concept PC implementation. It is not hardened for production use.

Disclaimer

This software is a prototype implementation created to demonstrate the operational concept of SERINUS OT.

It is not intended for use in production environments.

The author assumes no liability for any damages arising from the use of this software.

Use at your own risk.

Feedback Welcome

SERINUS OT is published to demonstrate its operational concept and gather feedback.

Use-case ideas for OT / ICS environments, improvement suggestions, and any feedback — such as "this would be useful on the shop floor" or "I'd like to see X displayed" — are all welcome.

Feel free to open an Issue.

License

This software is licensed under the GNU General Public License v2.0.

Copyright (C) 2026 Cyber Defense Institute, Inc.