Extracting Hardware Serial Numbers Over LAN: UPnP, CSTECGI, and SNMP Across Telco Router Vendors

On high-volume telco router refurbishment lines, every returned unit must be checked, tested, and logged. Historically, technicians used handheld optical barcode guns to scan the tiny serial barcode printed on the physical router label sticker.

In production, physical labels present frequent failure modes: stickers are scratched, faded by heat, peeled off by subscribers, or obstructed by mounting brackets. Technicians spent minutes manually squinting at microscopic printed serials or typing 16-character alphanumeric strings by hand. To automate this, we built automated LAN serial extraction directly into the BBTech WiFi Router Diagnostic Tool.

Before querying a router for its serial, the computer must find its IP address. When factory-reset routers arrive on the bench, DHCP is frequently disabled or slow to negotiate, leaving the technician's laptop on an APIPA self-assigned address (169.254.x.x).

The diagnostic tool executes a multi-tiered discovery hierarchy without silently mutating global Windows network settings:

Consumer and ISP routers run diverse proprietary firmware stacks. The diagnostic engine implements model-tailored retrieval handlers:

For Kaon AR2140 routers, UPnP root description XML exposes the manufacturer serial tag <serialNumber> directly to unauthenticated queries on port 80 or 1900. For Huawei GPON ONTs, parsing unauthenticated javascript variables (var OntSN = 'HWTC...';) in the initial login redirection frame yields the hardware serial before authentication challenges occur.

A diagnostic tool on a high-throughput line must never guess. If a query returns a placeholder, recording it corrupts inventory records.

The engine applies a strict validation filter: it rejects MAC addresses (both delimited 00:1B:9E... and raw hex), IP addresses, model strings (AR2140), repeated dummy characters (00000000, XXXXXXXX), sequential numbers (12345678), and generic placeholders (UNKNOWN, N/A). Exact alphanumeric casing is preserved.

The serial extraction engine is verified by **84 automated assertions** across two PowerShell test suites, simulating mock UPnP XML endpoints, HTML payloads, router replacement generation tokens, and credential redaction. It eliminates manual barcode hunting for supported models while preserving complete operator oversight.