A packet-level S7comm security investigation tracing COTP session setup, PDU negotiation, PLC memory access, SZL diagnostics, and state-machine anomalies.