01
Incumbents have a data moat
Vendors with a large installed base sit on years of real telemetry from customer sites. Everyone building against them starts with nothing and has no route to catch up on their own.
Industrial ground truth
Real OT data from plants that are actually running.
Full-fidelity ICS network packet captures paired with SCADA and process historian records from the same operating window, sourced from live production facilities and licensed for detection engineering, model training and product validation.
Live plant sources Full-fidelity, unsampled Purdue L1–L3 Delivered under NDA
architectureSiemens PCS7, redundant
capture_points7 simultaneous
packets_total12,412,880
ip_endpoints159 distinct
protocolsS7comm, PROFINET, OPC
historian_window12 months
tag_definitions895,174
controller_conns5 mapped
remote_accessVNC preserved
integritySHA-256 manifest
status: deliveredlicence: non-exclusive
The problem
The data your models need is not on the internet.
Language models had the web. Industrial models have nothing comparable. Every serious OT dataset sits behind a plant gate, and the operators on the other side of it have no reason to open up.
02
Simulated traffic is too clean
A protocol simulator emits well-formed frames on a tidy network. Real plants give you legacy firmware, flat segments, duplicate MAC addresses, malformed packets and remote sessions nobody documented. Models tuned on lab traffic fall over on the floor.
03
Plant access is the real bottleneck
Storage and labelling are solved problems. Getting a pharmaceutical or steel operator to let you mirror a switch during live production is not. That relationship is what we have built.
What we deliver
Two data families, from the same operating window.
Captured together where the site permits it, so network behaviour and process behaviour can be read against each other rather than in isolation. This pairing is the part most OT data sources cannot offer.
Family A
OT network captures (PCAP)
Raw packet captures from mirror ports on production switches, taken while the line runs.
- Full-fidelity and unsampled, delivered as captured in PCAP or PCAPNG
- Simultaneous multi-point capture across OS servers, batch servers, historian servers and field-level PLCs
- Coverage across Purdue Levels 1 to 3 within a single window
- Engineering stations, operator desktops and IT-domain machines visible alongside controllers
- Remote-access sessions preserved rather than stripped, a signal most datasets discard
- Asset discovery material: LLDP and PROFINET DCP device announcements, hostnames, name-service traffic
S7commPROFINET IOPROFINET DCP
OMRON FINSOPC / DCERPCModbus TCP
EtherNet/IPOPC UADNP3
IEC 61850BACnetVNC / RDP
Family B
Historian & control records
The process side: what the plant was actually doing while the packets moved.
- Process tag time-series, in native historian format and Parquet
- Alarms, events and Sequence of Events (SOE) logs
- Operator audit trail, including recipe and setpoint changes
- Batch and recipe records tied to production runs
- Environmental monitoring: cleanroom temperature, humidity, differential pressure
- Tag dictionaries and control-system configuration exports with address and connection mapping
Siemens PCS7 PHWinCCAVEVA Wonderware
SQL ServerParquetCSVnative backups
Protocol catalogue
Which industrial protocols are available.
Live means captures exist or can be commissioned from an estate we already have access to. On request means we source a plant running that protocol against your specification.
| Protocol | Purdue level | Typical estate | Availability |
|---|---|---|---|
| S7comm | L1–L2 | Siemens PCS7, S7-300 / 400 / 1500 | Live |
| PROFINET IO / DCP / PTCP | L1 | Siemens distributed I/O, PROFINET rings | Live |
| OMRON FINS | L1–L2 | OMRON PLC estates, packaging and filling lines | Live |
| OPC over DCERPC | L2–L3 | PCS7 OS servers, classic OPC clients | Live |
| VNC / RDP remote access | L2–L3 | Engineering stations, vendor remote support | Live |
| OPC UA | L2–L3 | Modern SCADA, MES and edge gateways | On request |
| Modbus TCP | L1–L2 | Mixed-vendor estates, utilities, packaged skids | On request |
| EtherNet/IP & CIP | L1–L2 | Rockwell / Allen-Bradley estates | On request |
| DNP3 | L1–L2 | Electric utilities, water, pipeline SCADA | On request |
| IEC 61850 MMS / GOOSE | L1–L2 | Substation automation, protection relays | On request |
| BACnet | L1–L2 | Building management, HVAC, cleanroom utilities | On request |
Delivered
A recent delivery, by the numbers.
One pharmaceutical sterile injectables facility running multi-line parenteral filling on a redundant Siemens PCS7 architecture. This is the shape of a single engagement, not a cumulative total.
12.4M
Packets in one 75-minute window
159
Distinct IP endpoints
7
Simultaneous capture points
12mo
Historian window delivered
895K
Tag definitions in config export
22GB
Single delivery volume
Delivered under mutual NDA with a full README, data dictionary, network topology summary, anonymisation note and per-file SHA-256 manifest. Buyer identity withheld.
Comparison
Why public ICS datasets are not enough.
Public testbed corpora such as SWaT, WADI, the Morris power-system datasets and the 4SICS lab captures are genuinely useful for benchmarking, and they are free. They are also testbeds: purpose-built rigs with a handful of nodes, one or two protocols, and most of them captured between 2015 and 2019. If your detection logic has to hold up on a customer site, that gap matters.
| Public testbed corpora | OTTrace | |
|---|---|---|
| Source | Purpose-built laboratory rig | Plant actively manufacturing product |
| Network scale | Typically 5 to 20 nodes | 159 distinct endpoints across 7 capture points in a single delivery |
| Protocol mix | One or two, cleanly separated | Ten or more concurrent, including IT services and remote access |
| Process context | Limited sensor logs | Full historian, alarms, SOE, batch records, operator audit trail |
| Network realism | Clean, well-formed, documented | Legacy firmware, flat segments, malformed frames, undocumented sessions |
| Currency | Mostly 2015 to 2019 vintage | Captured on request against current estates |
| Custom capture | Not possible | Commissioned to a written specification |
| Cost | Free | Commercial licence, quoted per engagement |
Sector coverage
Live sources today, more commissioned on request.
Live means we have an existing plant relationship and can commission a capture. On request means we source it against your specification, typically inside a few weeks.
Live
Pharmaceutical
Sterile injectables, multi-line parenteral filling, lyophilisation, ampoule and pre-filled syringe lines. Siemens PCS7 and OMRON estates.
Live
Steel
Melt shop and rolling operations with energy monitoring across roughly 200 machines.
Live
Specialty industrial
Abrasives and precision component manufacturing, year-round line access.
On request
Food & beverage
Batch lines, utilities, packaging and clean-in-place cycles.
On request
Cement
Kiln control, mills, dispatch and quality loops.
On request
Power generation & T&D
Generation units, substations, IEC 61850 station and process bus.
On request
Oil & gas
Upstream, pipeline SCADA and refinery unit operations.
On request
Automotive
Press shop, body-in-white, paint and final assembly.
On request
Water & wastewater
Treatment trains, pumping stations, distributed RTU networks.
On request
Pulp & paper
Pulp mill, paper machine and recovery boiler.
On request
Mining & metals
Concentrator, smelter and dispatch systems.
On request
Glass
Float line, batch plant and forming controls.
How it works
Specification in, verified dataset out.
Every engagement runs the same way, whether you want a dataset already held or a capture commissioned against a spec you write.
01
Scope
You tell us the vertical, the protocols, the Purdue levels and the process conditions you need represented. We tell you honestly what is sourceable and what is not.
02
Source
We commission the capture through our plant partner network, or pull from datasets already collected and held.
03
Capture
Simultaneous multi-point network capture with a matching historian export from the same operating window wherever the site architecture allows it.
04
Validate
Protocol decode, endpoint census, packet and tag counts, and a completeness check written directly against your original specification.
05
Anonymise
Configurable to your risk posture, from full-fidelity under NDA through to scrubbed addressing, hostnames and product identifiers.
06
Deliver
Presigned S3 access with a SHA-256 manifest, README, data dictionary and topology summary. You verify integrity before anything is accepted.
Terms
How the commercials work.
- Formats
- PCAP and PCAPNG, native historian backups, CSV and Parquet
- Integrity
- Per-file SHA-256 manifest with every delivery
- Documentation
- README, data dictionary, topology summary, anonymisation note
- Licensing
- Non-exclusive by default; per-dataset exclusivity available
- Structure
- One-time datasets, or recurring captures on a refresh cadence
- Legal
- Mutual NDA executed before any sample moves
Every dataset ships with a completeness statement written against your spec. If a capture missed something you asked for, you hear it from us before you are invoiced.
Our standing commitment
Who buys this
Built for teams that cannot get plant access.
OT and ICS security vendors
Training anomaly detection, asset discovery and protocol parsers on traffic that behaves like a real plant.
Detection engineering teams
Real operational baselines to tune rules against, so false-positive rates hold up once deployed on a customer site.
Industrial AI and model teams
Process time-series, batch records and alarm sequences for forecasting, quality and predictive maintenance models.
Digital twin and simulation
Real operating signatures and asset inventories to ground synthetic environments in how plants actually behave.
Research and national labs
ICS testbed programmes and academic groups needing reference data from production environments they cannot access.
Questions
Frequently asked questions.
If your question is not answered here, email [email protected] and you will get a direct answer, not a sales sequence.
Where can I get real industrial control system network traffic data for training?
Real ICS network traffic from production plants is not publicly downloadable, because plant operators do not release it. The public options are testbed corpora such as SWaT, WADI, the Morris power-system datasets and the 4SICS lab captures, which are small purpose-built rigs rather than operating factories. OTTrace licenses full-fidelity packet captures taken from plants that are actively manufacturing product, under a mutual NDA, either from datasets already held or commissioned to order against your specification.
What is the difference between testbed ICS datasets and production plant data?
A testbed emits well-formed traffic from a handful of nodes running one or two protocols on a clean network. A production plant produces a much wider protocol mix, legacy firmware, flat network segments, duplicate MAC addresses, malformed frames, undocumented remote-access sessions and long-tail operational noise. Models tuned only on testbed traffic tend to generate excessive false positives once deployed on a customer site, because the baseline they learned does not resemble a real estate.
Which industrial protocols are available?
Currently sourced from live estates: S7comm, PROFINET including IO, DCP, PTCP and LLDP, OMRON FINS, and OPC over DCERPC. Available on commissioned capture: OPC UA, Modbus TCP, EtherNet/IP with CIP, DNP3, IEC 61850 including MMS and GOOSE, and BACnet. Remote-access traffic such as VNC and RDP is preserved rather than stripped, because it is a relevant signal for remote-access threat modelling.
Can I get network captures and historian data from the same time window?
Yes, and this is the main technical differentiator. Where the site architecture permits it, the packet capture and the process historian export are taken from the same operating window, so network behaviour can be correlated against what the process was actually doing. Most available OT data offers one family or the other with no time correspondence between them.
How is the data anonymised?
Anonymisation is configurable to the buyer's risk posture, ranging from full-fidelity delivery under NDA through to scrubbed IP and MAC addressing, removed hostnames, and redacted product and batch identifiers. Heavier anonymisation reduces forensic and asset-inventory value, so the level is agreed before delivery rather than applied by default. Every delivery includes an anonymisation note stating exactly what was and was not modified.
What are the licensing terms?
Datasets are licensed non-exclusively by default, with per-dataset exclusivity available at a premium. Engagements can be structured as one-time dataset purchases or as recurring captures on an agreed refresh cadence. A mutual non-disclosure agreement is executed before any sample is released. Pricing is quoted per engagement and varies by vertical, capture duration, data families included and exclusivity.
How long does a commissioned capture take?
For a vertical where a plant relationship already exists, a commissioned capture typically runs 10 to 14 working days from specification sign-off to delivery, allowing for site scheduling around production windows. Verticals sourced from scratch take longer, generally a few weeks, because plant access has to be negotiated first. Datasets already held can be delivered within days.
What formats is the data delivered in?
Network captures are delivered as PCAP or PCAPNG exactly as captured, without sampling or filtering. Historian data is delivered in the native backup format of the source system, such as a Siemens PCS7 Process Historian backup or an AVEVA Wonderware SQL Server backup, and additionally converted to Parquet or CSV on request. Every delivery includes a per-file SHA-256 manifest, a README, a data dictionary and a network topology summary.
How large is a typical delivery?
A recent single-site delivery was approximately 22 GB, comprising 12,412,880 packets captured across 7 simultaneous capture points in a 75-minute window covering 159 distinct IP endpoints, together with 12 months of process historian data and a control-system configuration export containing 895,174 tag definitions. Delivery volume scales with capture duration and the number of capture points requested.
Which industries do you cover?
Live plant relationships exist today in pharmaceutical manufacturing including sterile injectables and lyophilisation, steel including melt shop and rolling operations with energy monitoring, and specialty industrial manufacturing including abrasives and precision components. Food and beverage, cement, power generation and transmission, oil and gas, automotive, water and wastewater, pulp and paper, mining and metals, and glass are sourced on request against a buyer specification.
Can I specify exactly what I need captured?
Yes. Buyers provide a written specification covering vertical, process type, target protocols, Purdue levels, capture duration, required process conditions and anonymisation requirements. We state up front what is sourceable and what is not, and every delivery ships with a completeness statement written against that original specification, so gaps are disclosed before invoicing rather than discovered afterwards.
Are you a security product vendor?
No. OTTrace is a data supplier and does not sell detection software, a historian, or a security platform. We supply the underlying production data that OT security vendors, detection engineering teams and industrial AI groups use to train, tune and validate their own products. This means we do not compete with our buyers.
Get started
Tell us what you need represented.
Send a specification and we will tell you what is already available, what we can commission, and what nobody can realistically get you. Samples move once a mutual NDA is in place.
Which vertical and process type
Which protocols and Purdue levels
Network capture, historian records, or both
Capture duration and whether you need a refresh cadence
Your anonymisation requirements
Request a sample
Goes straight to the founder. Expect a reply within one business day.
or email [email protected]