A Layer 2 discovery protocol operates on the local network segment rather than through routed infrastructure. In OT, these protocols often support device identification, commissioning, and addressing, which makes their exposure relevant to both availability and asset governance.
What Layer 2 Discovery Protocols Do
Layer 2 discovery protocols let devices identify peers, learn addressing details, and support commissioning on the local segment. In OT environments, that local reach makes them useful for onboarding and control, but also means they can expose asset information to anything on the same broadcast domain.
These protocols are not routed in the normal sense, so their visibility and trust model are usually limited to the layer 2 neighbourhood. That design is helpful for discovery speed and simplicity, but it also means a compromised or unauthorized device on the segment may be able to observe or influence discovery traffic.
Why Local-Segment Scope Matters
The key property of a layer 2 discovery protocol is that it works where switching, broadcast behaviour, and local adjacency determine who can see or answer the messages. That makes the protocol tightly coupled to the physical or virtual segment boundary rather than to higher-layer network routing.
In practice, the protocol’s usefulness depends on whether the segment is segmented well enough that only expected devices participate. If the same broadcast domain contains systems that should not see discovery traffic, then the protocol can become a source of unintended asset disclosure or operational noise.
Operational Uses in OT Environments
OT teams often rely on layer 2 discovery during initial device bring-up, commissioning, and addressing workflows. It helps operators find equipment that may not yet have stable higher-layer configuration, which is valuable when devices are newly installed or intermittently managed.
The same convenience can make the protocol part of the asset-management process. When discovery is used to identify controllers, sensors, or gateways, the protocol becomes a clue source for inventory, network mapping, and change control, especially in environments where documentation lags behind the physical plant.
Visibility, Trust, and Exposure Boundaries
Because discovery happens on the local segment, it often reveals more than just reachability. Device names, identifiers, and addressing relationships can become visible to any observer with local access, which creates a governance issue even when the protocol itself is not a remote attack surface.
That also means the security question is not only whether the protocol is “enabled,” but whether the segment is trusted, monitored, and separated from less trusted equipment. Ultimate Guide to NHIs — Key Challenges and Risks is useful here because the same visibility gaps and unmanaged discovery that affect machine identities also affect operational assets that rely on local discovery.
Risk and Threat Considerations
Layer 2 discovery protocols can expand the blast radius of a compromised segment because they advertise useful topology and addressing information to nearby devices. In OT, that can aid reconnaissance, enable rogue device participation, or help an attacker blend into routine commissioning traffic.
Failure mechanism: A device with local presence on the segment can observe discovery exchanges, impersonate a legitimate peer, or trigger misleading addressing and identification behaviour that changes how operators or systems interpret the local asset set.
Impact: The result can be asset confusion, reduced monitoring fidelity, unauthorized device exposure, or operational disruption if commissioning and identification workflows are trusted without segment-level controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Layer 2 discovery is bounded by local network flow control and segment visibility. |
| CM-8 — System Component Inventory | Discovery protocols can inform component inventory and asset visibility in OT. | |
| Recommendation — Enforce segment-level information flow restrictions to limit discovery traffic to authorized local devices. Correlate discovery data with component inventory to detect unknown or unmanaged assets. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Discovery protocols directly support identifying OT assets on the local segment. |
| Recommendation — Use discovery results to maintain an accurate inventory of local devices and systems. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration management | Discovery behaviour depends on network and device configuration at the segment boundary. |
| Recommendation — Control network and device configuration so discovery remains confined to intended environments. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Layer 2 discovery is governed by local network architecture, segmentation, and device exposure. |
| Recommendation — Segment and manage network infrastructure to reduce unintended local discovery exposure. | ||
Practitioner Guidance
Why practitioners should care: Treat layer 2 discovery as both an operational tool and an information source. If you use it for onboarding or asset visibility, its trust boundary should be explicit in network design, because the protocol can reveal more than intended to any device on the same segment.
What to watch for: Unexpected discovery responders, duplicate device identities, commissioning traffic from unapproved assets, and discovery chatter crossing segments where it should not exist are all signs that the local trust model is too broad.
Practitioner takeaway: Align the protocol’s use with segment isolation and asset governance, otherwise discovery becomes a visibility channel for anyone who can reach the local layer 2 domain.
Related resources from NHI Mgmt Group
- Link Layer Discovery Protocol (IEEE 802.1AB)
- What breaks when an IGA platform has no discovery layer for unconnected applications?
- What breaks when discovery tools do not detect Model Context Protocol endpoints and exposed AI tooling?
- What are the signs that a service discovery layer is failing in production?