# Rockwell WWS OT decoy: beginner

~30-45 minutes. Contained water/wastewater face (MicroLogix + Modbus/ENIP).

!!! info "Plane separation"
    This tutorial configures the **decoy / sensor** plane only. Do not put
    VirusTotal, OTX, or Ops GUI credentials on the public decoy host.
    See [plane-separation](../architecture/plane-separation.md) and
    [ot-wws-config](../reference/ot-wws-config.md).

## Prerequisites

- Built `sensor` binary (`cd engine && go build -o ../bin/sensor ./cmd/sensor`)
- Loopback-only research binds

## Enable the pack (loopback)

```bash
export CYBERHALLUCINET_OT_ROCKWELL_WWS=1
export CYBERHALLUCINET_OT_VENDOR_FAMILY=rockwell
export CYBERHALLUCINET_OT_DEVICE_FACE=micrologix1400
export CYBERHALLUCINET_OT_PLANT_PROFILE=water_wastewater
export CYBERHALLUCINET_LISTEN_MODBUS=127.0.0.1:1502
export CYBERHALLUCINET_LISTEN_ENIP=127.0.0.1:44818
./bin/sensor --profile=research
```

With no listen addresses, pack flags alone do **nothing** (default-off / no OT plane).

## Verify MicroLogix identity

Use an ENIP ListIdentity client (or purple-team harness) against `127.0.0.1:44818`.
Expect Rockwell vendor and a MicroLogix 1400 product name (≤16 chars on the wire).

## Read water registers (Modbus)

Point a Modbus TCP client at `127.0.0.1:1502`:

- Holding 0: tower level ×10
- Holding 9: free chlorine ×100 (e.g. 180 ≈ 1.8 mg/L)
- Coil 1: chlorine dosing pump

## Confirm default-off

Unset listen env vars and restart: sensor must not bind Modbus/ENIP.

## Next

[Advanced WWS tutorial](ot-wws-advanced.md): CSP `:2222`, modem sidecar, RSS lure, intent triage, EPA inhibit.