0
Probes sent
No scans, no agents on the devices, no traffic injected. NotLine only reads what is already on the wire.
Passive network discovery · Digital twin platform
NotLine maps your network. Zero packets sent.
A non-intrusive, automated platform that builds and keeps updating a digital twin of your ICT/OT infrastructure — just by listening to the traffic that is already there. Live topology and risk assessment, with nothing injected into the network.
- Hosts found
- 0/14
- Links mapped
- 0/17
- Packets observed
- 0
- Probes sent
- 0
Listening… nothing observed yet.
What is NotLine
A digital twin of the network, built by listening.
NotLine is a non-intrusive, automated platform that constructs and updates a digital twin of ICT/OT infrastructures through continuous passive monitoring. From the traffic it observes it derives a structural and behavioural model of the system — which hosts exist, how they are connected, how they talk — and gives you network visibility without touching the live systems.
Always current
A twin that moves with the network
A scan is a photograph that starts ageing the moment it is taken. NotLine monitors continuously, so new hosts and new conversations enter the twin as soon as they show up in the traffic.
ICT + OT
Made for systems that must not be scanned
Industrial and cyber-physical systems often cannot tolerate active probing. Because NotLine never transmits, it can be used where conventional discovery is ruled out.
Auto
No hand-drawn diagrams
The model is built automatically from observation instead of interviews and spreadsheets.
How it works
From raw traffic to risk, in four moves.
Passive network discovery turns ordinary traffic into a model you can reason about.
-
Observe
NotLine watches traffic passively, building on the open-source monitors Zeek and ntopng. Nothing is sent back.
-
Reconstruct
Hosts and the links between them emerge from who talks to whom, forming the network topology and its behaviour.
-
Update
Monitoring never stops, so the digital twin follows the network as it changes instead of drifting out of date.
-
Assess
The twin supports risk assessment and feeds a Security Twin, where attacker moves can be simulated safely.
Passive vs active
Why not just scan the network?
Active scanning asks every address a question and waits for answers. Passive discovery never asks — it listens. Switch the simulation above to Active scan to see the difference.
| Active scanning | NotLine · passive discovery | |
|---|---|---|
| Traffic injected into the network | Probes to every address and port | None |
| Effect on fragile OT devices | Can disturb devices not built to be probed | None — it only listens |
| Who talks to whom | Not visible: a scan finds hosts, not conversations | Observed directly from real traffic |
| Freshness | A snapshot taken at scan time | Updated continuously |
| Hosts that never communicate | Found, if they answer the probe | Invisible until they send or receive traffic |
The last row is the honest trade-off of any passive approach: a silent host stays unseen until it talks. In exchange, everything in the twin reflects what the network actually does.
Where it fits
Visibility for networks you can't afford to touch.
Industrial control systems
Discover what is on a plant network that must keep running and must not be probed.
Living network topology
Replace stale diagrams with a topology reconstructed from, and kept in step with, real traffic.
Risk assessment on a twin
Run what-if and attack-path analyses on the model instead of on production infrastructure.
Research
Published research from the University of Pisa.
NotLine is part of the Security Twin research line on non-intrusive modelling for proactive cyber defence.
NotLine: A Non-Intrusive Automated Platform to Build a Digital Twin
F. Baiardi, V. Sammartino, S. Ruggieri — 29th International Symposium on Distributed Simulation and Real Time Applications
NotLine: Dynamic Network Topology and Risk Assessment Through Passive Discovery
V. Sammartino — 10–12 December 2025
Zeek and ntopng: Comparison and Integration in NotLine
Comparative analysis of the two monitors and their integration into NotLine for non-intrusive traffic detection.
@inproceedings{baiardi2025notline,
author = {Baiardi, Fabrizio and Sammartino, Vincenzo and Ruggieri, Salvatore},
title = {NotLine: A Non-Intrusive Automated Platform to Build a Digital Twin},
booktitle = {29th International Symposium on Distributed Simulation and
Real Time Applications (DS-RT 2025)},
publisher = {IEEE},
year = {2025},
doi = {10.1109/DS-RT68115.2025.11185873}
}
FAQ
Questions, answered.
What is NotLine?
NotLine is a non-intrusive, automated platform developed at the University of Pisa that builds and continuously updates a digital twin of an ICT/OT network through passive monitoring. It reconstructs the network topology and supports risk assessment without sending any traffic into the monitored network.
What does non-intrusive mean?
NotLine only listens to traffic that is already flowing on the network. It sends no probes and runs no active scans, so the monitored systems keep operating exactly as they would without it.
How is NotLine different from an active network scanner?
An active scanner sends probes to every address and records what answers, which gives a snapshot of hosts at scan time and can disturb fragile industrial devices. NotLine observes real traffic instead, so it learns which hosts exist and which hosts talk to each other, and it keeps the model up to date as the network changes. The trade-off is that a host becomes visible only once it communicates.
What is a digital twin of a network?
It is a software model of a real network: its hosts, the links between them and the way they behave. Analyses that would be risky on the live infrastructure, such as simulating an attacker or testing a countermeasure, can be run on the twin instead.
Which monitoring tools does NotLine build on?
NotLine integrates the open-source network monitoring tools Zeek and ntopng as passive sources of traffic information for building the digital twin.
How does NotLine relate to the Security Twin?
A Security Twin is a digital twin built for security: it simulates how an attacker could move through an infrastructure so that defences can be evaluated before deployment. NotLine automates the construction of the network model that this kind of analysis needs.
Who develops NotLine and how can I get access?
NotLine is a research platform by Fabrizio Baiardi, Vincenzo Sammartino and Salvatore Ruggieri at the University of Pisa. For access, demonstrations or collaborations, contact the authors.
Team & contact
Stop probing. Start listening.
NotLine is developed at the University of Pisa. Interested in a demo or a research collaboration?