Abstract: Wireless devices, such as field devices or repeater/relay nodes, detect the presence of anomalies in data packets that suggest intrusion. Upon detection of an anomaly, a wireless device sends a notification to a sentinel device, which determines if intrusion may be occurring. If so, the sentinel device downloads a spy routine to at least one of the wireless devices, which enables further investigation into and/or isolation of the intrusion. Since the spy routine is downloaded to the wireless devices, the spy routine can be used in conjunction with memory-constrained wireless devices. Memory-constrained wireless devices may lack adequate memory for storing both a main application executed during normal operation and the spy routine. The spy routine could overwrite one or more modules of the main application. Once executed, the spy routine could itself be overwritten by the one or more modules, allowing the wireless device to return to normal operation.

Abstract: Wireless devices, such as field devices or repeater/relay nodes, detect the presence of anomalies in data packets that suggest intrusion. Upon detection of an anomaly, a wireless device sends a notification to a sentinel device, which determines if intrusion may be occurring. If so, the sentinel device downloads a spy routine to at least one of the wireless devices, which enables further investigation into and/or isolation of the intrusion. Since the spy routine is downloaded to the wireless devices, the spy routine can be used in conjunction with memory-constrained wireless devices. Memory-constrained wireless devices may lack adequate memory for storing both a main application executed during normal operation and the spy routine. The spy routine could overwrite one or more modules of the main application. Once executed, the spy routine could itself be overwritten by the one or more modules, allowing the wireless device to return to normal operation.