Asset links

Asset links are Linux applications installed on the same device as the Asset Gateway software and act as a translator from vendor-specific, proprietary protocols to a standardized API. Each Asset link supports a specific protocol and a range of OT devices that can be discovered and identified.

If you want to create your own Asset link, see Asset Link SDK

Layer 2 Network Access

Some Asset Links specifically the SIMATIC Automation Tool, PROFINET Asset Service, and Ethernet IP Connector require Layer 2 (L2) network access to perform deep asset discovery.

What is Layer 2? In the OSI networking model, Layer 2 is the Data Link layer. Operating at this level allows the Asset Link to communicate directly with automation devices using low-level, unrouted protocols (such as PROFINET DCP and LLDP) based on MAC addresses rather than just IP addresses.

To support this communication, the hosting device must have Layer 2 access enabled. This requires reserving a dedicated IP address specifically for the Asset Link on the same subnet as the target automation devices.

For instructions on how to configure Layer 2 on your Industrial Edge device, please refer to the official Siemens Industrial Edge Documentation.

List of supported Asset links

Asset link name	Protocol	Layer 2 Required	Host architecture	Supported devices
Default IP Scanner	ICMP, ARP	No	x86-64, ARM64	All IP connected devices
Asset Link SNMP	SNMPv1 SNMPv2c SNMPv3	No	x86-64, ARM64	IP devices with SNMP enabled Attributes depend on configured attributes in SNMP MIB
SIMATIC Automation Tool	SIMATIC	Yes	x86-64	Siemens SIMATIC S7-1500, S7-1200, S7-400, S7-300 Siemens SIMATIC HMI Basic and HMI Comfort Panels Siemens SCALANCE switches V1, V2, V3 Siemens SINAMICS V90, SINAMICS S210, SINAMICS S120 (CU320-2)
Asset Link Ethernet IP	Ethernet / IP	Yes	x86-64, ARM64	Rockwell CompactLogix series Rockwell ControlLogix series Rockwell MicroLogix series Omron NJ series
PROFINET Asset Service	PROFINET	Yes	x86-64	Siemens PROFINET Devices FESTO PROFINET Devices Wago PROFINET devices Fanuc PROFINET devices
Gateway Host		No	x86-64, ARM64	Siemens Industrial Edge Devices including Industrial Edge Virtual Device Generic host devices (Linux environment)

Additional Information

This section provides detailed configuration and capability information for each specific Asset Link.

Default IP Scanner

The Default IP Scanner is bundled with the Asset Gateway App. It is capable of both active probing and passive traffic monitoring to discover devices.

Requirements

Requires Edge Device with Firmware SIMATIC-IPC-IED-OS-3.0.0-51-X86-64 or later

Supported Attributes:

The scanner can discover and report the following device attributes:

Hostname
IP Address
MAC Address
Vendor

Hostname Discovery:

During active scanning, the Default IP Scanner tries to find device hostname using these methods:

Reverse DNS – Looks up hostname from DNS records (works only if PTR records are configured in the DNS server).
mDNS – Discovers hostname from local network broadcasts; results may vary depending on device behavior.
NetBIOS – Queries devices directly; works only if NetBIOS is enabled and not blocked.
NT LAN Manager (NTLM) (Remote Desktop Protocol (RDP)) – Retrieves hostname during RDP authentication; works only if RDP is enabled and accessible.

If multiple hostnames are found, mDNS hostname is preferred.

Note

Hostname discovery depends on network configuration, enabled services, and device settings, so results may vary.

Active Discovery (User-Initiated)

Active scanning is executed only when explicitly triggered by the user.

When initiated, the scanner:

Probes devices within the configured IP range filters
Identifies reachable assets
Returns results based on active discovery

Rate Limiting : To prevent network congestion, users can configure a discoveryOption RateLimit, which defines the number of packets sent per second during active scanning. If not specified, a default rate limit of 128 packets per second is applied. Rate limiting is only applicable to active scanning and does not affect passive scanning.

Note

Important for Virtual Environments: When running the Asset Gateway on a virtual machine, packet rejection rates may be higher compared to physical devices, which can impact MAC address discovery. Recommendation: Lower the scan rate using the RateLimit discovery option for better results.

Passive Discovery (Background Operation)

Passive scanning is disabled by default. Enable it by setting the enabled flag to true and providing the network interface value in the networkInterface flag in the gateway-config.json during gateway onboarding.

Once enabled:

The scanner continuously listens to network traffic
Device information is collected passively
No active probing is performed
No user action is required

Requirements

Passive scanning requires a SPAN port network interface
A valid networkInterface must be configured
If passive scanning is enabled without specifying a network interface, passive scanning will not start

Enabling Passive Scanning:

Passive scanning can be enabled in 2 ways: during Asset Gateway onboarding or later by updating the gateway configuration.

When an Asset Gateway is created, a gateway-config.json file is generated. To enable passive scanning, under appConfig > defaultIPScanner > passiveScan set enabled: true and provide a valid networkInterface value.

{
  "gatewayId": "<gatewayID>",
  "gatewayName": "<gateway name>",
  "xfUrl": "<xf url>",
  "registrationToken": "<registration token>",
  "appConfig": {
    "defaultIPScanner": {
      "passiveScan": {
        "enabled": true,
        "networkInterface": "eth0"
      }
    }
  }
}

After the Asset Gateway is onboarded, passive scanning can be enabled or disabled by updating the configuration and restarting the asset-gateway app. To enable or update passive scanning, make sure configuration file includes at least below content with appConfig > defaultIPScanner > passiveScan enabled flag set to true and a valid networkInterface value.

{
  "gatewayId": "<gatewayID>",
  "xfUrl": "<xf url>",
  "appConfig": {
    "defaultIPScanner": {
      "passiveScan": {
        "enabled": true,
        "networkInterface": "eth0"
      }
    }
  }
}

To change an existing gateway configuration follow the instruction of update the asset gateway configuration.

Note

Devices are uniquely identified using their MAC address. If the same device (same MAC) is seen with a different IP address later, the system assumes the IP has changed. In such cases, the latest IP (IPv4 or IPv6) replaces the previously stored IP, and the older IP is discarded.
Example: If a device with MAC AA:BB:CC:DD:EE:FF is first discovered with IP 192.168.1.10, and later the same MAC is observed with IP 192.168.1.25, the system will update the record to 192.168.1.25 and remove 192.168.1.10.
Passive scanning only captures limited information such as MAC address, IP address, and observed protocol. If a device was previously discovered through active scanning with richer details (like hostname and vendor), a later passive scan may update the same device record using only the limited data it observes.
Example: A device initially identified as printer-01 with vendor details may later be updated to just its MAC and a new IP, losing the earlier enriched information. This happens because the system prioritizes the latest observed data for that device.
If an invalid configuration is provided in the config file, it will not be applied. The passive scanner will retain the last valid state.

Discovery Scan Modes

Scan modes control how active discovery is executed and how results are combined with passive data:

Mode 1: Active Scan Initiates an active scan using the configured IP range filters and returns only active discovery results. Passive scanning continues in the background but is not included in the output.
Mode 2: Passive Scan Returns devices discovered through background passive scanning only. This mode does not start passive scanning; it retrieves already collected passive discovery data. If IP range filters are provided, results are filtered accordingly; otherwise, all passively observed devices are returned.
Mode 3: Active + Passive Scan Returns a combined view of active and passive discovery results. When possible, results are merged using the MAC address.

Note

If no scan mode is specified, the Default IP Scanner defaults to Mode 1 (Active).
IPRange Filter must be provided for Active and Active + Passive Scan modes.
SPAN port (also known as a port mirroring port) is recommended for collecting passive discovery data. It allows passive scanning to monitor network traffic more effectively by duplicating traffic from other ports or VLANs to a designated monitoring (SPAN) port. However, using SPAN port is not strictly required—passive discovery can still function without it, but with reduced visibility into network traffic.

Example payload to configure IP range with scan mode and rateLimit:

{
  "assetLinkId": "cdm-device-class-driver-siemens.cdm.dcd.default-ip-scanner",
  "deviceClass": "siemens.cdm.dcd.default-ip-scanner",
  "zone": "default",
   "discoveryFilters":[
        {
            "key":"IPRange",
            "comparisonOperator":"EQUAL",
            "value":"192.168.1.1-192.168.1.250"
        }
   ],
   "discoveryOptions":[
        {
            "key":"Mode",
            "comparisonOperator":"EQUAL",
            "value":"3"
        },
        {
            "key":"RateLimit",
            "comparisonOperator":"EQUAL",
            "value":"256/s"
        }
   ]
}

Note

Only one IPRange filter can be provided in the discoveryFilters array with the comparisonOperator as EQUAL.
Only one Mode option entry can be provided in the discoveryOptions array with the comparisonOperator as EQUAL.
Only one RateLimit option entry can be provided in the discoveryOptions array with the comparisonOperator as EQUAL.
The RateLimit value must follow the format <count>[/<duration>] (e.g. '128/s', '100/500ms', or '50'), representing packets sent over the network in a given duration. For example, "256/s" means 256 packets per second. If not specified, Default Rate Limit of 128/s is applied.

Asset Link SNMP

The Asset Link SNMP can be obtained from the Industrial Edge Marketplace.

Supported Attributes:

Hostname
IP address
MAC address
Asset name
Vendor
Article number
Serial number
Software version

SIMATIC Automation Tool

The SIMATIC Automation Tool can be obtained from the Industrial Edge Marketplace.

Supported Attributes:

Hostname
MAC- and IP-addresses and their relation
ID Link
Vendor
Article number
Serial number
Software version
Hardware version
Station number
Slot number, Slot name, Subslot
Asset capabilities like support of firmware update or backup functionality
Connected submodules' data
Connected periphery's data

Please refer to the separate Documentation for further information and use cases for the SIMATIC Automation Tool application.

Supported Discovery Attributes:

By default, SIMATIC Automation Tool performs a discovery starting with Layer 2 based protocol to discover all assets in a network and, if the asset supports it, continuing with the appropriate Layer 3 based protocol to identify details of the discovered asset. This behavior can be adapted using discovery filters and options.

Only discover assets in a specified IP Range

Type: DiscoveryFilter, optional, but required if DiscoveryStrategy L3 is provided
Key: IPRange
Operator: EQUAL
Value: IpStart-IpEnd, e.g. 192.168.1.1-192.168.1.20

Perform only a Layer 3 protocols based scan, do not try to discover using Layer 2 to support routed environments. Condition: IPRange Filter must be provided

Type: DiscoveryOption, optional
Key: DiscoveryStrategy
Operator: EQUAL
Value: L3

Example:

{
   "discoveryFilters":[
        {
            "key":"IPRange",
            "comparisonOperator":"EQUAL",
            "value":"192.168.1.1-192.168.1.250"
        }
   ],
   "discoveryOptions":[
        {
            "key":"DiscoveryStrategy",
            "comparisonOperator":"EQUAL",
            "value":"L3"
        }
   ]
}

Limitations:

IPRange supports up to Class C networks, e.g. 192.168.1.1-192.168.1.254
Layer 3 discovery option currently has limitations for discoverable device types. A broader range of supported device types is planned for an upcoming release.

Asset Link Ethernet IP

The Ethernet IP Connector can be obtained from the Industrial Edge Marketplace.

Supported Attributes:

Hostname
IP address
MAC address
Vendor
Asset Name
Article number
Serial number
Software version

Please refer to the separate Documentation for further information and use cases for the Ethernet IP Connector application.

When installing the Ethernet IP Connector application on Industrial Edge, the broadcast IP address parameter needs to be set. The broadcast IP address should represent the subnet in which the Ethernet IP devices are located.

PROFINET Asset Service

The PROFINET Asset Service Asset Link is provisioned by default with Industrial Edge. For non Industrial Edge usage, the Asset Link is provided on request.

Supported Attributes:

PROFINET name
IP address
MAC address
Vendor
Article number
Serial number
Software version
Hardware version

Please refer to the separate Documentation for further information and use cases for the PROFINET Asset Service.

Gateway Host

The Gateway Host Asset Link is included with the Asset Gateway by default and supports the scanning of Industrial Edge devices where the Asset Gateway is hosted.

Host Support

Only Asset gateways on an Industrial Edge devices and in a docker deployments on Linux are supported. When the gateway is installed in a different setup and the Gateway Host Asset Link is used, there is no guarantee that the discovered attributes will be correct or complete.

Supported Attributes:

The Industrial Edge Device is shown in the asset list with attributes

Asset Name
IP address
MAC address
ID Link
Vendor
Article number
Serial number
Firmware version

Note

ID Link is shown only for Siemens devices. For other vendors it will be blank.
Edge Device name is the name that was configured during Industrial Edge Device onboarding.

Any questions left?

Ask the community