# From Brown-Field to Future Industrial Networks, a Case Study
## 1 Introduction
Many of the existing industrial networks are also handling IT traffic, generated from IT services such as system updates and anti-viruses, back-up servers and remote access servers. The two traffics are commonly handled by a division of time for accessing the shared link [6]. While the IT traffic in the brown-fields cannot be a just representative of the IT traffic in the future consolidated IT-OT networks, it still can provide partial knowledge about IT characteristics and be used as a basis for knowledge extraction about traffic behavior. One requirement for innovation is to revisit the existing concept and to gain additional insight to build the evolution to the next stage. Investigation of the brown-field traffic can provide a better understanding of the existing networks and facilitate the estimation of future requirements, performance criteria and guidelines for next step integration. Industrial networks are usually designed and configured for a specific application domain with considerations on environment and service requirements. It is impractical to generalize the knowledge gained from one use-case functionality to all the others. However, studying brown-fields can help to establish a basis of network functional properties, and to distinguish the divergence from initial setups and common theoretical assumptions. In other words, studying a brown-field can help with the interpretation of the evolved network to the current stage, and therefore granting insight for partial estimation of the requirements in the next possible stages. In recent years, industrial network traffic has been investigated for purposes such as intrusion and anomaly detection, network management and traffic monitoring. In [7], industrial IP network traffic is investigated for intrusion detection by modeling each pair of traffic flows based on profiled communication patterns. Traffic patterns of SCADA networks were studied in [8] and inter-arrival time and correlation models were proposed and defined as additional key parameters (KP) for traffic characterization and flow modeling. The same KPs showed promising results when applied on emulated network traffic for anomaly detection [9], but the performance was not as satisfactory on the real traffic of SCADA systems [10]. The reason for inaccurate results can be motivated by the complexity of brown-field communication patterns and virtualized architecture. To find the capabilities and limitations of brown-field networks for managing the demands of new use-cases in terms of inter-arrival time and packet size, a methodology is proposed in [11]. A matrix representation captures the state of the network with respect to the selected key performance indicator (KPI), and the effect of one data flow on the other flows is arbitrary ignored. The methodology is validated using emulated SCADA traffic where no logical grouping for flexible communication between physically distributed devices are applied. Even with the literature's valuable works, there is still a gap for insight from the brown-field to identify the current state and further be applied to develop a methodology for the evolution of the brown-fields to the expected future industries. Recognizing the challenges mentioned above and existing related literature, this work presents the results of a case study on brown-field network traffic collected from the Iggesund paperboard production network. To the best of the authors' knowledge, this is the first presented study of shop-floor network data. The contributions of this paper then expand to the following:  
* A comparative study highlights the disparities between the common assumptions of network traffic flow characteristics in the literature and what the collected brown-field traffic projects. Extending deficiency of the existing flow characterization and traffic modeling for network configuration and performance management, with respect to the scalability and flexibility requirements of the converged networks, are discussed.