The short answer
Network Schedules
Network schedules are the tables behind the network drawings. The address schedule has one row per network device with its tag, description, address, mask, gateway, MAC address, VLAN, the switch and port it connects to, its protocols and role, its location, and notes. The switch port schedule has one row per port on every managed switch with its mode, VLAN or trunk list, description, the connected device, and the cable identifier. The VLAN table lists each VLAN with its number, name, subnet, zone, and purpose. The conduit list records each firewall-permitted flow with its source, destination, protocol, port, direction, and reason, and is the human-readable form of the rule set. Together they are the source of truth that the drawings, the switch configurations, the firewall rules, and the asset inventory are checked against, and they are maintained through change management and protected as security documentation.
Key points
- Address schedule, switch port schedule, VLAN table, conduit list: four tables that describe the whole network.
- One source of truth: the drawings, the switch port descriptions, and the firewall rules are derived from the schedules and audited against them.
- Every port on every managed switch has a row, including the empty ones, which are shut down.
- The conduit list is the firewall rule set in plain language, with a reason for every row.
- A change record that touches the network updates the schedule first and the configuration second.
- The schedules are the attacker map; they are protected like the drawings.
The address schedule
| Column | Content |
|---|---|
| Tag and description | The device name used on the drawings and in the SCADA, and what it is |
| Address, mask, gateway | The static address or the reservation; the mask; the gateway or none |
| MAC address | For duplicate detection and switch table reconciliation |
| VLAN and subnet | Which segment, from the VLAN table |
| Switch and port | Where it connects, matching the switch port schedule |
| Protocols and role | What it speaks and what it does: controller, HMI, server, switch, radio |
| Site and location | Building, room, panel |
| Notes | Static or reserved, redundancy partner, special handling |
The address schedule is where addresses are assigned, before a device is configured, from the block layout of the addressing plan; a device configured with an address that is not in the schedule is a finding. Sorted by subnet it shows the spare addresses; sorted by switch it shows what each switch carries; sorted by role it is the polling list. It is the same table the asset inventory needs, and many utilities keep them as one table with the inventory columns added.
The switch port schedule
| Column | Content |
|---|---|
| Switch and port | Every port on every managed switch, in order, including unused ports |
| Mode | Access, trunk, or shut down |
| VLAN or allowed VLANs | The access VLAN, or the trunk list and native VLAN |
| Description | The text set as the port description on the switch, matching the connected device tag |
| Connected device | The device tag from the address schedule, or the far switch for an uplink |
| Cable | The cable or fiber identifier from the cable or fiber schedule |
| Speed and duplex | Auto or forced, and why if forced |
| Notes | Port security, mirror session, power over Ethernet |
The port description configured on the switch is copied from this schedule, so that a technician at the switch console sees the same text the schedule shows and the two can be compared by a script. Unused ports are shut down and assigned to an unused VLAN, and the schedule says so, which is how the annual audit finds a port that was enabled and never recorded.
The VLAN table and the conduit list
The VLAN table is short: number, name, subnet, zone, purpose, and the sites where it exists, the same at every site by the plan. The conduit list is the rule set in words: for each permitted flow, the source group or address, the destination, the protocol and port, the direction and which side initiates, the firewall and rule identifier that implements it, and the reason with a reference to the functional description or the change record. The firewall rule review reads the conduit list beside the rule set and finds the rule with no conduit and the conduit with no rule.
Maintaining them
- 1
Build from the design
The VLAN table from the segmentation design, the address schedule from the block layout and the device list, the port schedule from the layout of switches, the conduit list from the firewall rule design.
- 2
Configure from the schedules
Devices addressed, switch ports configured and described, firewall rules written, from the schedule rows. The schedule is first, the configuration second.
- 3
Reconcile at commissioning
The switch address tables, the port descriptions, and the running configurations compared with the schedules; differences corrected in whichever is wrong.
- 4
Change management
Every change that adds, moves, or removes a device or a flow updates the schedule row as a step of the change record before the configuration is touched.
- 5
Audit
Quarterly: a script or a person compares the switch tables and port descriptions with the schedule, and the firewall rules with the conduit list.
- 6
Protect
The schedules stored with the security documentation, access-controlled, and not in general drawing sets.
Frequently asked questions
- Is a spreadsheet good enough?
- For a system of a few hundred devices with one owner and a change process that updates it, yes. The failure is not the tool but the habit; a database with a change workflow helps at scale and does not replace the habit.
- Why record the unused switch ports?
- Because an unused port that is enabled in the control VLAN is a live connection into the control network for anyone who finds it. The schedule says the port is shut down, the switch configuration is checked against the schedule, and a port that someone enabled without a record is found at the audit.
- Where does the conduit list come from?
- From the functional description of what must talk to what, written as flows during the firewall rule design, before the rules. Each flow has a reason. The rules implement the list; the list explains the rules, and it is what a reviewer reads.
- How do the schedules relate to the passive monitoring sensor?
- The sensor produces the observed list of devices and conversations; the schedules are the intended list. Comparing them is discovery at first and detection afterward: a device or a conversation the sensor sees that the schedule does not have is either a schedule error or an intrusion.
Related topics
- Network DrawingsThe two drawings every control network needs: a logical drawing of zones, subnets, VLANs, firewalls, and conduits, and a physical drawing of switches, ports, cables, fiber, radios, and sites. What each shows and why they are sensitive.
- How to Assign IP Addresses on a Control NetworkBuild an addressing plan before the first device is configured: one subnet per zone and site, a fixed block layout so an address says what the device is, static addresses on everything that controls a process, and a schedule that is kept current.
- How to Configure VLANs on a Control NetworkTurn a zone plan into switch configuration: a VLAN per zone with its own subnet, access ports for devices, tagged trunks between switches, a native VLAN that carries nothing, a separate management VLAN, and routing between VLANs only through the firewall.
- Firewall Rule DesignWriting the rule set for a control network boundary: default deny, one rule per conduit with its reason, hosts not subnets, protocol and port and function, direction and initiator, logging on every rule, and the review that removes forgotten rules.
- Building an OT Asset InventoryThe list of everything in the control system with a network interface or a program, and how to build one that is right: what counts, the fields to record, the site walk, the switch tables and passive listening that find the rest, and keeping it current.
- Fiber SchedulesThe record of every fiber strand between every pair of patch panels: cable identifiers, strand numbers and the standard color sequence, fiber type, connectors, what each strand carries, splices, lengths, and test results, with the labeling that matches it.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.