Find serial-device servers still advertising UDP/30718 (0x77FE). Flag any 0xF8 (config read) or 0xFD (0x78-byte config write) frames from non-management hosts, and correlate with sudden IP/gateway or serial-forwarding changes on OT jump paths. Prefer network ACLs that deny 30718/udp at the plant boundary; confirm the device Security option that disables port 77FEh is set where the UI still exists. Replace EOL XPress-DR/XPress-DR-I units rather than long-term compensating controls.