Network diagrams describe the cabling someone intended, while the patch panel shows what is actually plugged in, and an undocumented cable or device is invisible to every logical control. MITRE D3FEND names the countermeasure Direct Physical Link Mapping (D3-DPLM), with the synonym Manual Physical Link Mapping, and defines it as creating "a physical link map by direct observation and recording of the physical network links." It sits under the Model tactic as a child of Physical Link Mapping (D3-PLM), alongside Active Physical Link Mapping (D3-APLM). This page covers when inspection is the right method, what to record, how to run a walkdown and keep the record current, and how it supports detection and physical hardening. It is written for network engineers, data centre and OT site teams, and auditors who need evidence that physical topology records are accurate.
Key takeaways
- It is the fallback, and sometimes the only option. D3FEND recommends automated active physical link mapping where feasible, and physical inspection where it is not, because passive traffic monitoring cannot reliably map physical links.
- Inspection finds what protocols cannot. Unmanaged switches, media converters, taps, serial links, out-of-band modems and devices that do not speak discovery protocols only show up when someone looks.
- The record must be structured. Port-to-port connections with identifiers, cable labels, rack positions and dates make the map comparable with automated discovery and with the previous walkdown.
- Differences are the security signal. A new device, a moved cable or a link that discovery protocols cannot see is a finding to investigate, not just a documentation fix.
- D3FEND's ATT&CK relations here are weak. D3FEND lists only inferred, experimental relations through shared artefacts; the real value is accurate topology for segmentation, incident response and physical access control.
D3-DPLM at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-DPLM (d3f:DirectPhysicalLinkMapping) |
| Tactic | Model |
| Parent technique | Physical Link Mapping (D3-PLM), defined as identifying and modelling "the link connectivity of the network devices within a physical network"; itself a child of Network Mapping |
| Synonym | Manual Physical Link Mapping |
| Digital artefacts (from parent) | Network Node and Physical Link (D3FEND relation: maps) |
| D3FEND reference | Network mapping article (Wikipedia) |
| ATT&CK relations | Inferred and experimental only (D3FEND 1.6.0, checked November 2026) |
| Effort | High per site; scales with port count and how well cabling is labelled |
When to use inspection instead of discovery
D3FEND's own considerations state that building and maintaining physical topologies by hand is challenging and time-consuming for large networks, so automated active mapping should be considered as a partial or complete solution. Active mapping relies on devices reporting their neighbours, typically through the Link Layer Discovery Protocol defined in IEEE 802.1AB, which provides managed objects for discovering physical topology from adjacent stations. The table shows where each method fits.
| Situation | Active mapping (D3-APLM) | Direct inspection (D3-DPLM) |
|---|---|---|
| Managed enterprise switching with LLDP enabled | Primary method | Spot checks to validate the automated map |
| Unmanaged switches, hubs, media converters | Not visible as neighbours | Required |
| OT and industrial networks where probing is restricted | Often limited by operational risk policy | Primary method, combined with passive monitoring for logical links |
| Serial, fieldbus and non-Ethernet links | Out of scope for 802 LAN discovery | Required |
| Out-of-band links (console servers, cellular modems, management ports) | Partial | Required to find undocumented ones |
| Data centre build, move or decommission | Confirms the result | Required for acceptance and handover |
| Suspected rogue device or physical tap | May miss passive or unmanaged devices | Required |
See D3-APLM Active Physical Link Mapping for the automated method.
What to record
A physical link record that cannot be compared with anything is a drawing. The fields below are an NHI Mgmt Group suggestion for a record that can be reconciled against automated discovery and the asset inventory.
| Field | Example | Use |
|---|---|---|
| Site, room, rack and position | DC1, Hall B, rack B07, U22 | Locates the device for response and physical access control |
| Device A and port | Access switch asset tag and interface name | Joins to the network node inventory |
| Device B and port | Server NIC, patch panel port or field device | Defines the link end to end |
| Cable identifier and media | Cable label, copper or fibre type, length | Traces intermediate patching |
| Intermediate passive points | Patch panels, cross-connects, splice trays | Shows where a tap or reroute could sit |
| Observed state | Link light, unlabelled, unknown device attached | Captures findings for follow-up |
| Observer and date | Engineer name, walkdown date, photo reference | Evidence for audit and comparison |
The ANSI/TIA-606 administration standard family is the usual reference for labelling and record keeping in structured cabling; use the identifier scheme your cabling contractor already follows rather than inventing a second one.
How to run a walkdown
- Prepare from what you already know. Export the current automated neighbour map, the network node inventory and the last walkdown record for the site, so the team checks differences rather than starting blank.
- Agree safety and access. Book escorted access, agree a no-touch rule for live equipment unless a change is approved, and for OT sites follow the site's operational safety process.
- Record port by port. Work rack by rack, recording both ends of each cable, the labels and any device not in the inventory. Photograph panels as evidence.
- Trace unknowns, do not unplug them. An unknown device or cable is raised as a finding and investigated through change and incident processes. Removing it on the spot destroys evidence and may cause an outage.
- Reconcile and publish. Load the record into the network source of truth or CMDB, compare it with automated discovery, and open tickets for every mismatch.
- Set the next cycle. Schedule walkdowns by risk (for example, critical rooms and OT cells more often than branch closets; an NHI Mgmt Group suggestion, not a standard) and trigger extra walkdowns after major moves or incidents.
How it supports detection and hardening
D3-DPLM is a Model technique: it detects nothing in real time. These connections are NHI Mgmt Group's view of how the map is used, not D3FEND relations.
- Rogue device detection: a verified port map makes unexpected link-up events and new MAC addresses on a port meaningful, because the expected attachment is known.
- Segmentation assurance: physical bypasses such as a cable bridging two segments or a dual-homed device defeat logical segmentation. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
- Physical access control: knowing which rooms and panels carry sensitive links tells you where NIST SP 800-53 PE-4 Access Control for Transmission controls belong. See the Physical Security Guide for Security Teams.
- Incident response: responders isolating a compromised host need to know which switch port and which physical path to cut, which is often the slowest part of OT containment.
ATT&CK techniques D3FEND relates to D3-DPLM
Relationship type: inferred only. D3FEND shows no direct ATT&CK mapping for D3-DPLM. It lists a small set of inferred, experimental relations through shared artefacts. They are shown for completeness; none of them is detected by a physical link map. Each ID was checked against ATT&CK v20.
| ATT&CK ID | Technique | Practical relevance |
|---|---|---|
| T1505.002, T1505.003 | Server Software Component: Transport Agent, Web Shell | None direct; the map only locates the affected server |
| T1114.002 | Remote Email Collection | None direct |
| T1578.002, T1578.003, T1578.004 | Create, Delete and Revert Cloud Instance | None direct; cloud instances have no physical links the customer can inspect |
| T1686.002 | Disable or Modify System Firewall: Network Device Firewall | Limited: a verified map shows which network devices enforce boundaries. D3FEND lists this under an ATT&CK ID revoked in v20; T1686.002 is the v20 successor |
How to verify it works
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | What it shows |
|---|---|---|
| Ports in scope with a recorded link in the last cycle | 100% for critical rooms and OT cells | Coverage |
| Agreement between walkdown and automated neighbour data | Above 98% where both exist | Accuracy of both methods |
| Unknown devices found per walkdown | Falling over time, each one resolved | Change control discipline |
| Mismatch tickets closed within the agreed period | Above 90% | Findings are acted on |
| Time to identify the physical port of a given host during an exercise | Minutes, not hours | Usefulness for response |
Limits and failure patterns
- A one-off project: a walkdown done for a migration and never repeated is out of date within months; schedule cycles and tie updates to change control.
- Drawings instead of records: diagrams cannot be reconciled automatically. Keep port-level records and generate diagrams from them.
- Trusting labels: labels survive moves that cables do not. Trace both ends on critical links rather than reading the label alone.
- Ignoring out-of-band paths: console servers, management networks and cellular modems give remote access that bypasses the production network and its monitoring.
- Unplugging during the walkdown: removing unknown equipment on sight loses evidence and can stop production, especially in OT.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 | Inventories of hardware managed by the organisation are maintained |
| NIST CSF 2.0 | ID.AM-03 | Representations of authorised network communication and data flows are maintained |
| NIST SP 800-53 Rev 5 | CM-8 System Component Inventory | Accurate component inventory that the link map joins to |
| NIST SP 800-53 Rev 5 | PE-4 Access Control for Transmission | Physical protection of transmission lines inside facilities |
| CIS Controls v8.1 | Safeguard 12.4 Establish and Maintain Architecture Diagram(s) | Network architecture documentation |
| MITRE D3FEND | D3-PLM, D3-DPLM | Parent and technique |
Practitioner checklist
- Use active mapping where devices support it and reserve walkdowns for what it cannot see.
- Record links port to port with device identifiers, cable labels, rack positions, observer and date.
- Start every walkdown from the automated map and the last record, and check differences.
- Raise unknown devices and cables as findings; never unplug them during the walkdown.
- Include out-of-band, serial and management links in scope.
- Load records into the network source of truth and reconcile with discovery data.
- Schedule walkdowns by risk and after major moves or incidents.
Standards and references
- MITRE D3FEND: Direct Physical Link Mapping (D3-DPLM)
- MITRE D3FEND: Physical Link Mapping (D3-PLM)
- NIST: Cybersecurity Framework 2.0 (ID.AM-01, ID.AM-03)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (CM-8, PE-4)
- IEEE: 802.1AB Station and Media Access Control Connectivity Discovery (LLDP)
- CISA and partners: Foundations for OT Cybersecurity, Asset Inventory Guidance for Owners and Operators
- NIST: SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: MITRE D3FEND Network Mapping Implementation Guide · D3-PLM Physical Link Mapping · OT Asset Visibility Guide · Data Centre Security Guide · MITRE D3FEND Guide