MarlinSpike
Open source passive OT/ICS network analysis and topology mapping, positioned as a GRASSMARLIN replacement.
Technical Architecture & Overview
MarlinSpike ingests PCAP files and produces ICS network topology maps, vendor fingerprints, and protocol breakdowns, inferring Purdue model levels for discovered devices. It presents results through a web interface and maps findings toward ATT&CK. The project positions itself explicitly as the open source successor to the NSA archived GRASSMARLIN, and it ships as the open core of the commercial Fathom platform.
Targeted Technical Use Cases
Offline analysis of OT network captures to build an asset picture without touching the live network.
Evaluation & Trade-offs
Core Strengths
- +Fills the gap left by GRASSMARLIN archival.
- +PCAP-based workflow is safe for OT environments.
- +Active development with dated validation releases.
Trade-Offs & Limitations
- -Works from captures, so coverage depends on capture points.
- -Commercial features sit in the closed Fathom platform.
Defensive Security Application
OT asset discovery and network mapping from passive captures for assessment and monitoring baselines.
Frequently Asked Questions
What is MarlinSpike?→
MarlinSpike ingests PCAP files and produces ICS network topology maps, vendor fingerprints, and protocol breakdowns, inferring Purdue model levels for discovered devices. It presents results through a web interface and maps findings toward ATT&CK. The project positions itself explicitly as the open source successor to the NSA archived GRASSMARLIN, and it ships as the open core of the commercial Fathom platform.
What is MarlinSpike used for?→
Offline analysis of OT network captures to build an asset picture without touching the live network.
What are the strengths of MarlinSpike?→
- +Fills the gap left by GRASSMARLIN archival.
- +PCAP-based workflow is safe for OT environments.
- +Active development with dated validation releases.
What are the limitations of MarlinSpike?→
- +Works from captures, so coverage depends on capture points.
- +Commercial features sit in the closed Fathom platform.
How is MarlinSpike used defensively?→
OT asset discovery and network mapping from passive captures for assessment and monitoring baselines.