Werkspilot
    ← Insights

    SNMP SBOM: how switches, routers and PROFINET devices are identified

    In brief · As of October 2026

    SNMP reaches what the fieldbus protocols do not see: switches, routers, access points, industrial PCs and cameras. The system group (RFC 3418) is mandatory in every SNMP agent – sysDescr is free text in which Siemens includes MLFB, hardware and firmware version, sysObjectID names the manufacturer through the IANA number (4196 Siemens A&D, 4346 Phoenix Contact, 13576 WAGO, 25157 Beckhoff). The ENTITY-MIB (RFC 6933) provides model, hardware, firmware, software version and serial number in structured form on managed switches. PROFINET devices of conformance classes B and C must carry SNMP with MIB-II and LLDP-MIB – the LLDP neighbour tables yield the topology as a by-product. For the plant SBOM, SNMP is the second stage after the fieldbus.

    The system group is mandatory, the ENTITY-MIB is the gain

    ObjectMandatoryContentMeaning for the device list
    sysDescr (1.3.6.1.2.1.1.1)yesFree text with hardware, operating system, network softwareAt Siemens for example "SIMATIC S7, CPU 1516-3 PN/DP, 6ES7 516-3AN02-0AB0, HW: Version 5, FW: Version V2.9.4" – MLFB and firmware in plain text, to be parsed per manufacturer
    sysObjectID (1.3.6.1.2.1.1.2)yesOID under 1.3.6.1.4.1.<IANA number>Manufacturer unambiguous; product through the manufacturer MIB
    sysNameyesHostnameOften the PROFINET station name – bridge to the DCP result
    entPhysicalModelName, …HardwareRev, …FirmwareRev, …SoftwareRev, …SerialNum, …MfgName (ENTITY-MIB)noStructured device data per physical entityAccording to the RFC, ModelName is the "customer-visible part number" – the matching key
    LLDP-MIB (1.0.8802.1.1.2)for PROFINET CC-B/CNeighbours per port with chassis ID, port ID, system nameTopology and neighbour identity without querying the end devices

    Managed switches and routers (SCALANCE, Hirschmann, Phoenix FL SWITCH, Moxa, Cisco IE) almost always carry the ENTITY-MIB, controllers and I/O rarely. For them, sysDescr remains – and a parser per manufacturer.

    No discovery, but an address list from the switch tables

    SNMP has no broadcast; the scan needs addresses. The switches themselves provide them: ARP tables and Bridge MIB name every MAC address with port and VLAN, LLDP the direct neighbours. Against this list, a GET on sysObjectID and sysDescr runs over UDP 161 – read-only, with read community or SNMPv3 user. A full MIB walk is not necessary and risky on old stacks; system group and ENTITY-MIB with a small block size are enough.

    A note for practice: many hardening guides according to IEC 62443 disable SNMPv1/v2c. Then SNMPv3 with a read account has to be set up at acceptance (FAT) – otherwise the plant SBOM loses exactly the device class that appears most frequently in advisories: network equipment. What is then missing is shown in the article on the network scan for the plant SBOM.

    What SNMP does not provide

    • A uniform format: sysDescr is free text; MLFB, firmware and serial number are placed differently in it by every manufacturer.
    • Serial number and hardware revision without ENTITY-MIB: controllers and I/O usually carry them only in manufacturer objects under the IANA number – with a MIB file per manufacturer.
    • The software below the firmware: as with all protocols, the device level, not the libraries.
    • Security: v1/v2c are unauthenticated; community strings reveal device data to anyone in the network. An inventory tool should prefer SNMPv3 and never write (SET).

    What this means for the plant SBOM

    • At acceptance (FAT), set up an SNMP read account (v3) on switches, routers, access points and industrial PCs; that is the prerequisite, not the extra.
    • Pull the address list from the ARP and Bridge MIB of the switches, then read system group and ENTITY-MIB per address; resolve the manufacturer through the IANA number.
    • Parse sysDescr per manufacturer and take over MLFB or part number as the matching key; whatever cannot be parsed is listed as an open item with MAC address.
    • Store LLDP neighbour tables as topology – they connect scan result and plant section. How the stages interact is described in the article on the network scan.

    All 13 manufacturers compared: SBOM by manufacturer →

    Trial Werkspilot Scan on your own plant.

    We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.

    Ask about the development partnership →

    Werkspilot Scan reads these fields from the maintenance PC, read-only and with a fixed request list, and keeps them per plant. This article describes the state of the specifications at the time of publication.

    Frequently asked questions

    The mandatory system group with sysDescr (free text on hardware, operating system and software – at Siemens including MLFB and firmware), sysObjectID (manufacturer through the IANA number) and sysName. Managed switches and routers additionally carry the ENTITY-MIB with model name (according to the RFC the customer-visible part number), hardware, firmware, software version and serial number per physical entity.

    Devices of conformance classes B and C, yes: they must carry SNMP with MIB-II (system group, interfaces) and the LLDP-MIB. CC-A devices may omit SNMP. In practice, S7-1200/1500, ET 200, SINAMICS PN, Phoenix Axioline and Festo CPX answer the system group; they usually do not carry the ENTITY-MIB.

    Read-only GET requests on system group and ENTITY-MIB are uncritical. What is risky are complete MIB walks with large GETBULK blocks on old stacks, which can cause load and restarts, as well as SET commands. An inventory tool limits itself to a few objects, small block sizes and SNMPv3 without write rights.