Critical infrastructure needs to be handled with extra care as there have been reports of scans and even ping sweeps rebooting or causing devices to go offline. This is especially dangerous in networks in production as damages or disruptions of the service can cost hundreds of thousands, even millions of dollars, to the organization. For this reason, we can't aggressively scan the network to gather as much information as possible; instead, a carefully selected list of probes must be used.
This recipe shows you how to identify common ICS SCADA protocols safely with Nmap.