MarlinSpike
Open source passive OT/ICS network analysis and topology mapping, positioned as a GRASSMARLIN replacement.
Technical Architecture & Overview
MarlinSpike ingests PCAP files and produces ICS network topology maps, vendor fingerprints, and protocol breakdowns, inferring Purdue model levels for discovered devices. It runs as a Docker Compose web workbench and maps findings to ATT&CK for ICS and Enterprise. The project describes itself as a GrassMarlin-style replacement (the NSA GRASSMARLIN repository is archived), and it is the open source core of Fathom, the commercial OT security platform from Erisforge.
Targeted Technical Use Cases
Offline analysis of OT network captures to build an asset picture without touching the live network.
Evaluation & Trade-offs
Core Strengths
- +Fills the gap left by GRASSMARLIN archival.
- +PCAP-based workflow is safe for OT environments.
- +Versioned GitHub releases with changelogs.
Trade-Offs & Limitations
- -Works mainly from captures, so coverage depends on capture points; the optional live capture sidecar is Linux only.
- -Distributed collectors and enterprise-scale baseline learning sit in the commercial Fathom platform.
Defensive Security Application
OT asset discovery and network mapping from passive captures.
Frequently Asked Questions
What is MarlinSpike?→
MarlinSpike ingests PCAP files and produces ICS network topology maps, vendor fingerprints, and protocol breakdowns, inferring Purdue model levels for discovered devices. It runs as a Docker Compose web workbench and maps findings to ATT&CK for ICS and Enterprise. The project describes itself as a GrassMarlin-style replacement (the NSA GRASSMARLIN repository is archived), and it is the open source core of Fathom, the commercial OT security platform from Erisforge.
What is MarlinSpike used for?→
Offline analysis of OT network captures to build an asset picture without touching the live network.
What are the strengths of MarlinSpike?→
- +Fills the gap left by GRASSMARLIN archival.
- +PCAP-based workflow is safe for OT environments.
- +Versioned GitHub releases with changelogs.
What are the limitations of MarlinSpike?→
- +Works mainly from captures, so coverage depends on capture points; the optional live capture sidecar is Linux only.
- +Distributed collectors and enterprise-scale baseline learning sit in the commercial Fathom platform.
How is MarlinSpike used defensively?→
OT asset discovery and network mapping from passive captures.