Purdungeon

Industrial networks are mapped by listening, not scanning, because an active probe can knock over a controller. Purdungeon turns a passive capture from a span port into a reviewable Purdue-layered topology in seconds, with every claim traced back to the packets behind it. A modern, open-source take on GrassMarlin: a Rust analysis core under a Tauri and Vue desktop app, fully offline.

Highlights

decode pcap and pcapng, Ethernet through VLAN, cooked, raw-IP and loopback
parse Modbus TCP down to function codes, unit IDs and register accesses
infer device role and Purdue level from traffic first, self-description second
draw devices in bands by level, with the IT/OT boundary and cross-zone links marked
find cross-zone conduits, writes to controllers, external addresses on OT segments
explain every device and link, with the evidence and the reason behind each guess
stitch several captures from one site into a single session

Design notes

Everything is a row. Hosts, conversations, evidence and findings live in a per-session SQLite database, so every number in the UI is a query and every claim in a report traces to packets.

Roles are guesses, labelled as such. Each one quotes its reason and stays overridable; an override is stored, never inferred away.

Frame accounting reconciles. frames_read == packet_count + skipped always holds, and anything the reader could not decode is counted by reason in the header instead of being silently dropped.

Built with

Rust (analysis core), Tauri 2, Vue 3, Pinia, Konva, SQLite.