OTLab Training Platform

A hands-on ICS / OT security training lab. One Raspberry Pi. Full DMZ + Process Control fabric: firewall, virtual PLCs, Modbus + DNP3, Suricata IDS, operator dashboard. Built for ICS Village at DEF CON.

Tour the Dashboard → Train Your Team
1
Raspberry Pi
9
Containerized Services
7
Dashboard Tabs
~30min
First-Run Deploy
Upcoming Classes

Where We Are Teaching Next

In person, on real industrial gear. Early-bird pricing for the DEF CON Singapore class runs through December 31, 2026.

Start Date
December 1, 2026
End Date
December 3, 2026

OT Worlds: OT Foundations with Cyber Ranges

A three-day, in-person class taught by Aaron Crow and Tom VanNorman. Students work real industrial hardware in the room, integrated with the full Cyber Ranges virtual range and its scenarios and attack plans. Day one covers OT security principles and architecture: how OT priorities differ from IT, the Purdue model, and mapping trust zones. Day two is industrial protocol analysis: packet captures, Modbus and DNP3, and protocol replay against simulated valves. Day three is defensive architecture: IEC 62443 zones and conduits, firewall rules, and tracing the ICS kill chain from corporate remote access into the plant.

Where: Quantico Cyber Hub, 1010 Corporate Drive, Suite 305, Stafford, VA 22554
Get class info → About OT Worlds →
Start Date
March 5, 2027 · 9:00 AM
End Date
March 6, 2027 · 5:00 PM

OT-101 Foundation: OT Security Specialization Track

A hands-on, offense-focused introduction to operational technology for people coming from IT and security. Teams of 2 to 4 share an ICS Village lab kit (a simulated water-treatment plant with a PLC, Modbus and DNP3 devices, an HMI, and a monitored network). Over two days they map the plant, build a passive asset inventory, decode industrial traffic, send unauthenticated commands to the PLC and watch the process react, study how real attackers move from IT into OT, and finish with a scored team challenge. Beginner to intermediate; comfort with a command line and basic networking is enough.

Where: DEF CON Singapore 2027, Singapore (room to be announced)
Register →
OT Worlds · December 1–3, 2026

Get the Class Details

Registration is not open yet. Leave your info and we will email you the full class details now, and the registration link the day it opens.

OTLab Architecture tab: Purdue model with the lab's actual assets placed at canonical levels.
One Pi. One WiFi. That's It.

The Whole ICS Fabric in Containers

OTLab packs an industrial DMZ + Process Control Network onto a single Raspberry Pi 5 using ContainerLab. Firewall, DHCP, DNS, virtual PLCs, Modbus and DNP3 outstations, a master polling loop, Suricata IDS, and a 7-tab operator dashboard: all in containers, all on one Pi.

The single-Pi build is shipped and working. Optional expansions (additional Pis with real GPIO, Conpot honeypot personas, RS485 industrial sensors, ESP32 wireless IoT) layer on top without changing the core lab.

  • Industrial DMZ (L3.5) + Process Control Network (L1/L2)
  • Containerized iptables firewall with SNAT + DNS forwarding
  • Maple Ridge Treatment Plant scenario, live on the dashboard
  • MIT-licensed, public, fork-and-teach-with-it
What You Get

A Complete Teaching Environment

Eight categories of real OT infrastructure, on the same Pi a student carries home in a backpack.

Network Segmentation
Industrial DMZ (L3.5) + Process Control Network (L1/L2), enforced by a containerized iptables firewall with SNAT + DNS forwarding.
DHCP / DNS
Per-zone dnsmasq DHCP with static reservations. DNS forwarder integrated into the firewall, all queries logged: "DNS exfil at the firewall" as a teachable signal.
Master / Outstation
modbus-master polling sensor-sim at 10 Hz: deterministic, observable Modbus TCP traffic on the wire.
OpenPLC
Two virtual OpenPLC instances with web UIs on ports :8081 and :8082 for IEC 61131-3 click-around lessons.
DNP3
Pure-stdlib DNP3 outstation on :20000.
IDS
Suricata sniffing pcn-br0 with OTLAB rules for Modbus FC5/6/15/16 writes from non-master IPs plus SSH brute-force detection.
Dashboard
7-tab Flask + vanilla JS operator surface: Overview · Architecture · IDS · Firewall · DHCP · Live Data · Teaching.
Admin UIs
Cockpit (Linux), Portainer (Docker), EdgeShark (live packet capture in browser).
The Dashboard

Maple Ridge Treatment Plant, Live on Your Pi

The OTLab dashboard is a working water-utility operator surface. Animated process schematic, live IDS alerts, real firewall counters, a Modbus write playground: the same artifacts a defender works with on a real plant.

See It at Our Events →
01 · Overview OTLab Overview tab: animated SVG synoptic of the Maple Ridge treatment plant with live tank levels, temperature, and discharge pressure.

Overview

Live process state with an animated SVG synoptic, cards for every container, and live Modbus poll telemetry from the master loop.

02 · Architecture OTLab Architecture tab: Purdue model with lab assets placed at canonical levels and auto-discovered network topology.

Architecture

Purdue model with the lab's actual assets placed at their canonical levels, plus an auto-discovered network topology view.

03 · IDS OTLab IDS tab: Suricata stats with 24h timeline, top signatures, sources, targets, and recent alerts.

IDS

Suricata stats: counts (5m / 1h / 24h), 24-hour timeline, top signatures, top sources, top targets, recent alerts.

04 · Firewall OTLab Firewall tab: live iptables chains with packet counters, conntrack snapshot, and DNS query stats.

Firewall

Live iptables (5 chains) with packet counters, conntrack snapshot, DNS query stats, and the rolling DNS log.

05 · DHCP OTLab DHCP tab: per-zone lease tables with static reservations and recent transactions.

DHCP

Per-zone (DMZ + PCN) lease tables, static reservations, and recent transactions.

06 · Live Data OTLab Live Data tab: system health, audit log, and pcap captures.

Live Data

System health, full audit log, and on-demand pcap captures from the PCN bridge.

07 · Teaching OTLab Teaching tab: Risks, walkthroughs, runnable test library, Modbus Write Playground, Inject Fault, Cohort Reset.

Teaching

The lesson surface: scenario risks, incident walkthroughs, a runnable test library, the Modbus Write Playground (teaching artifact, intentionally no auth), Inject Fault, and one-click Cohort Reset between students.

Expanding the Lab

From Single Pi to Full Plant Fabric

Each stage is independent and optional. The single-Pi lab is fully functional on its own. You don't need any of these expansions to teach the core curriculum.

Stage 2

Physical OpenPLC Pi

Add a second Raspberry Pi with real GPIO, real Modbus on the wire, and Phase 2 hardware: relays, indicators, pushbutton inputs. Students wire real I/O and watch ladder logic drive it.

Optional
Stage 2

Physical Conpot Pi

Three vendor honeypot personas (Siemens / Schneider / Rockwell) running on a separate physical Pi. Great for teaching attacker enumeration vs. real OT vs. honeypot traffic.

Optional
Stage 3

RS485 Industrial Sensor

Connect a real industrial sensor (temperature, energy meter, etc.) over RS485 using a Waveshare RS485-to-Ethernet gateway. Real fieldbus traffic next to the virtual fabric.

Optional
Stage 4

Wireless IoT

ESP32 Modbus client over WiFi joining the PCN segment. Teaches wireless threat surface, MQTT/Modbus translation, and the "unmanaged device" reality of modern plants.

Optional
Looking for Contributors

Help Build the Curriculum

The single-Pi lab is shipped and working. The next chunk of work is the curriculum: Attack/Detect/Defend exercises mapped to MITRE ATT&CK for ICS, CTF challenges, and runnable scripts in the dashboard's Teaching tab.

  • Curriculum & Exercises
  • CTF Challenges
  • Conpot Personas
  • Wire-Feed Sniffer
  • Take-Home Topologies
  • Documentation
  • Video Walkthroughs
  • Translation
Get Involved →
Who Teaches On It

Built And Taught By Working Practitioners

OTLab is the lab the ICS Village instructors actually carry. The curriculum is anchored to it. Students sit at the same dashboard, hit the same Modbus Write Playground, and watch the same Suricata alerts that the instructor demonstrated minutes earlier.

Aaron Crow

Aaron Crow

Instructor
DL

Dillon Lee

Instructor
TV

Tom Van Norman

Co-Founder, ICS Village
NB

Neil Brandon

Instructor

Instructor photos coming soon. Want to teach on OTLab?

Where We Teach

Conference Floors, Academic Classrooms, and Partner Sites Worldwide

University Course

Harvard Summer School · CSCI S-148

Operational Technology Security Fundamentals is a 3-week Harvard Summer School graduate course taught by ICS Village volunteers. David Cass (Federal Reserve Bank of NY) and Vladislav Gostomelsky (TP-Link) are the course instructors, and Aaron Crow, Tom VanNorman, Vlad, and Dillon Lee bring their field experience to it, building its hands-on labs and shaping its focus.

  • Summer 2026 · Jun 22 – Jul 9Cambridge MA
  • MTWTh 6:30–9:30pm · 4 creditsOn Campus
DEF CON banner above the conference floor where ICS Village runs OTLab trainings.
DEF CON Delivery

DEF CON 34 / Singapore

OTLab on the floor at every flagship DEF CON event, with the Trainer Kit fleet supporting hands-on sessions and the Modbus Write Playground open all weekend.

ICS Village and Capture the Flag banners at Critical Effect DC.
Policy & Convening

Critical Effect DC

OTLab demos and capture-the-flag at the annual ICS Village policy convening in Washington. Practitioners brief regulators in front of a working plant.

  • Critical Effect DCWashington DC
Get Started

Bring OTLab to Your Team

Image a Pi, deploy the lab fabric, and run real Modbus traffic on your desk in under an hour. Sponsor a fleet for your conference, bring OTLab into a classroom, or take a private cohort through the curriculum.

Train Your Team → Sponsor OTLab