Kaspersky Industrial CyberSecurity for Networks can analyze traffic to detect and save information about unknown tags. Unknown tags are tags that are absent from the tags table.
The application adds a detected tag to the tags table if the conditions for adding a tag are fulfilled. If one of the conditions is not fulfilled, the detected tag is ignored (for example, if the tag has no associated protocol specified for the device in the Process Control settings).
Information about unknown tags is received from traffic using the Unknown tag detection method based on the Deep Packet Inspection technology. You can enable and disable this method.
When the Unknown Tag Detection method is used, the performance of application-layer protocol processing modules may be slightly reduced. For this reason, Unknown Tag Detection is disabled by default after the application is installed. It is recommended to enable the Unknown Tag Detection method for a period of time sufficient to detect all tags that may be associated with devices with the specified Process Control settings. It is recommended to disable this method after the detected tags are added to the table.
Unknown Tag Detection is supported for the following protocols: