OT / ICS security · field research & frameworks

Writing · 2025-07-20 · 2 min read · troubleshooting · framework

The RIVER Method™: Industrial Network Troubleshooting Methodology

A five-step field troubleshooting methodology for industrial networks. Reboot, Inspect, Verify, Examine, Replace. Built to be remembered at 2 a.m.

River Caudle · rivercaudle.com

"When in doubt, follow the RIVER"


R - Reboot & Reconnect

  • Power cycle the device (30-second full power removal)
  • Reseat all connections (because 80% of problems are physical)
  • Check cable integrity and proper termination

"If it's not physically connected, it's not gonna work, homie"


I - Inspect the Indicators

  • Check all status lights (document what you see)
  • Look at the switch port lights
  • Verify link status and activity indicators

"The lights don't lie - they're trying to tell you something"


V - Verify the Vitals

  • Ping test (Can you reach it?)
  • Config check (Is the IP/VLAN correct?)
  • Confirm subnet mask and gateway settings

"Match the documentation or make new documentation"


E - Examine the Evidence

  • Check logs if accessible
  • Run Wireshark if needed
  • Review recent changes or events

"Data doesn't lie, opinions do"


R - Replace or Restore

  • Swap with known-good hardware
  • Restore from backup config
  • Document the solution for next time

"When all else fails, nuke it from orbit"


The RIVER Rules™

  1. "Follow the RIVER upstream"
  • Start at Layer 1 and work up
  • Don't skip steps because you think you know the problem
  1. "Don't fight the current"
  • If step 1 fixes it, you're done
  • Celebrate the easy wins
  1. "Document your journey"
  • Screenshot everything for the next poor soul
  • Today's weird problem is tomorrow's known issue

Usage Examples

  • "Did you follow the RIVER?"
  • "I'm stuck at 'V' - can't verify vitals"
  • "Full RIVER diagnostic completed"
  • "RIVER says it's dead - time for replacement"

Quick Reference Card

StepActionKey Question
RReboot & Reconnect"Is it physically connected and powered?"
IInspect Indicators"What are the lights telling me?"
VVerify Vitals"Can I reach it? Is it configured correctly?"
EExamine Evidence"What do the logs and captures show?"
RReplace or Restore"Is it faster to fix or replace?"

Remember: The best troubleshooting happens when you're too lazy to do it twice.

River Caudle · river@riverman.io · Houston, Texas