The connection to Internet services, remote access points and the lack of security by design of industrial components increase the risk of malfunctions, manipulation via remote access, cyber attacks and technical errors in the ICS. The industrial network monitoring system Rhebo Industrial Protector monitors all communication within an industrial control systems (ICS). The system learns the communication pattern of normal operation within a very short time. Subsequently, the communication is continuously analyzed down to the level of the frame contents using deep-packet inspection driven anomaly detection. Any deviation from the regular communication pattern is reported in real-time as an anomaly. Analysis and reporting are entirely non-reactive and passive, preventing the overload or disturbance of the ICS processes. The network monitoring detects and reports both processes relevant for cyber security and technical error states. Risk assessment, network maps, raw data storage, filters and interface integration support the efficient analysis and mitigation of attacks and errors. Thus, operators and security experts can actively react to risks, prevent disruptions and protect supply.