Lighting Network Security: Art-Net and sACN

To reach a DMX cable you have to get into the building. To reach Art-Net you only have to get onto the network. When lighting control moved from copper to Ethernet, something came along that nobody talks about: none of these protocols have any authentication. Whoever sends the packet, the node obeys it.

In short

Art-Net, sACN and RDM have no authentication; anyone on the network can write to the lights.
sACN priority is not a security feature — the highest priority wins.
The single most effective measure is separating the lighting network (own VLAN or own switch).
At the switch: IGMP snooping on, unused ports off, factory password changed.
Remote access via VPN only; never port forwarding.
RDM can rewrite addresses remotely — restrict who can reach it.

The security model of these protocols: there isn’t one

Art-Net and sACN were designed in the late nineties and early two-thousands, on the assumption of a closed, trusted network. That assumption no longer holds; the same switch now carries guest wifi, the scoreboard, cameras and lighting. The protocols did not change.

Protocol	Port	Transport	Authentication	Practical risk
Art-Net	UDP 6454	Broadcast / unicast	None	Anyone on the network can send lighting data
sACN (E1.31)	UDP 5568	Multicast	None (only a priority field)	Whoever sends higher priority takes the show
RDM	DMX line	Bidirectional	None	Address, mode, even factory reset can be changed
Node web interface	TCP 80	HTTP	Usually no password	Configuration is wide open

What can actually happen

Discovery. Anyone joining the network can list every node, with model and IP, using a single ArtPoll packet. That is not an attack — it is the protocol working as designed.
Takeover. sACN priority runs 0–200 and defaults to 100. A laptop transmitting at priority 200 outranks the console.
Quiet sabotage. RDM can rewrite the start address of dozens of fixtures. The lights come on, but nothing is where it should be, and nobody understands why.
Configuration change. Node web interfaces usually have no password; universe mapping or the IP itself is a few clicks from being broken.

This is not theoretical

The most common picture we see on site is this: the nodes are plugged into the venue’s general network, and guest wifi lives on that same network. So any phone in the room shares a broadcast domain with the lighting nodes. Malice is not even required; one misconfigured device or a network-scanning app is enough to disturb universe traffic.

Separation: the single most effective measure

Ninety percent of the security here comes from one decision: the lighting network is separate. A separate physical switch is cleanest; where that is impossible, a separate VLAN is mandatory. That network should have no internet access, no DHCP arriving from outside, and every connected device should be known.

  [ Guest wifi ]   [ Office LAN ]   [ Cameras ]
         \              |              /
          ------ SHARED SWITCH ------      <-- WRONG
                     |
                Lighting nodes

  [ Console ]--[ Lighting switch ]--[ Nodes ]   <-- RIGHT
        separate VLAN / separate network, no internet

Keep lighting off the same segment as scoreboard, audio, ticketing, cameras and office traffic.
No internet route on the control network; when updates are needed, do it temporarily and supervised.
Use a fixed IP plan and write it down; if you use DHCP, use reservations.
Maintain a list of every device on the network. If it is not on the list, it does not get plugged in.

What to do at the switch

IGMP snooping on. sACN is multicast; with snooping off the traffic floods every port. That is both a performance and a visibility problem.
Disable unused ports. An empty RJ45 is an open door.
Port security / MAC locking. Only that node should be able to use that node's port.
Change the management password. Most switches we find on site are still running factory credentials.
Put management on its own VLAN. The switch's own interface should not sit in the lighting traffic.

When remote access is genuinely needed

On architectural jobs the request “let us change the scene remotely” is inevitable. The only correct way to grant it is a VPN. Exposing Art-Net or a node interface directly to the internet hands control to everybody.

Never put Art-Net on the internet

Forwarding port 6454 through the router gives every person on earth the ability to send data to your lights, and to do it without leaving a trace. The same goes for node web interfaces. If remote access is required, build a VPN — do not open ports.

The wireless side

Lock the pairing on wireless DMX (CRMX and similar); a receiver left open can bind to the wrong transmitter.
If you use a wifi bridge for lighting, give it its own SSID, use WPA2/WPA3 and isolate it from the guest network.
Do not put wifi on the critical path; 2.4 GHz is not dependable in a crowded room.
Password-protect the configuration interfaces of wireless devices too.

Redundancy is part of security

Separate primary and backup with sACN priority; that also makes an unauthorised source noticeable.
Set the “no signal” behaviour on nodes deliberately — you decide what the light does when data stops.
Put console and network gear on UPS.
Leave a manual path that can bring the lights up even with the control system entirely lost.

Checklist

Is the lighting network on its own VLAN or its own switch?
Is internet access on the control network disabled?
Has the switch's factory password been changed?
Is IGMP snooping enabled?
Are unused ports disabled?
Do the node web interfaces have passwords?
Is remote access over VPN?
Is the IP and universe map printed and in the panel?

Project and product support

Stuck somewhere in your installation, or unsure which product fits? Drop us a line for project consultancy and product support.

Send us an email → info@dmx512.net

Lighting Network Security: Art-Net and sACN Have No Authentication

In short

The security model of these protocols: there isn’t one