Skip to content

Product Boundaries

Clear boundaries are part of an industrial security product—not a disclaimer added after deployment.

What L2Proxy provides

  • network-based industrial protocol visibility through l2proxy-dissector;
  • ordered, testable YAML policy;
  • log, accept, and drop decisions;
  • bounded in-memory state and atomic single-key transitions;
  • structured rule, state-action, timeout, and parser events;
  • PostgreSQL storage models for raw JSONB evidence and indexed normalized events;
  • passive, offline, and inline deployment workflows;
  • DNP3 semantic helpers, stateful examples, and industrial normalization;
  • optional network/session identity enrichment where integration provides it.

What L2Proxy does not replace

  • safety instrumented systems or certified safety functions;
  • PLC, RTU, relay, or DCS process interlocks;
  • endpoint authentication and authorization;
  • engineering management of change;
  • backup, restore, patching, or endpoint protection;
  • a general web application firewall or antivirus engine;
  • TLS man-in-the-middle inspection;
  • bandwidth shaping or deterministic industrial QoS;
  • a historian or full SIEM, although structured events can feed those systems.

Observation limitations

Stateful network policy is only as complete as the observed traffic. Results can be affected by:

  • packet loss or capture beginning mid-sequence;
  • asymmetric routing or one-way SPAN visibility;
  • retransmission, segmentation, or reassembly differences;
  • local operation at an HMI, panel, relay, PLC, or RTU;
  • an alternate network path not traversing L2Proxy;
  • encrypted payloads;
  • unsupported or malformed protocol variations;
  • device behavior that differs from the customer's assumed sequence.

State lifecycle

Current state is local to one engine instance, in memory, and not restored after restart. This is a security-relevant boundary: short-lived authorizations and selections do not silently survive a process restart. Persistent/distributed state and atomic multi-key transactions are not current runtime features.

Capability claims

Protocol parser availability does not automatically mean semantic helper completeness, tested stateful policy, or production enforcement readiness. The Capability Status page is the authoritative customer-facing maturity statement for this documentation set.

The same distinction applies to normalization. The current Industrial Event Normalizer activates DNP3. Its protocol-neutral interface is an extension point, not a claim that Modbus, S7comm, IEC 104, or every dissected protocol is already normalized.

The provided database schema is an event store, not a complete historian lifecycle or SIEM replacement. Retention duration, partitioning, storage sizing, backup, access control, integrity protection, and regulatory retention remain deployment decisions.

Deployment responsibility

The customer and integrator remain responsible for traffic qualification, asset mapping, policy approval, test coverage, fail-open/fail-closed selection, operational rollback, and compliance with site safety and change-management requirements.