Sig-Net: signed DMX, explained for lighting crews

What Sig-Net is for

For more than twenty-five years, DMX has been moving from XLR cable to the network: Art-Net, then sACN, carry hundreds of universes over Ethernet and Wi-Fi. Both protocols share one trait: they don’t check who is speaking. Any device on the network can send a universe, and the fixtures obey. On an isolated stage that is fine. On a shared network, it isn’t.

Sig-Net® answers that question. It is a lighting-control-over-IP protocol designed by Singularity (UK) Ltd, the company of Wayne Howell, who created Art-Net. It was introduced at the PLASA European PlugFest in Lille in April 2026 and won a PLASA Award for Innovation the same year. It carries DMX, but also RDM, timecode, firmware updates and node configuration. Its promise fits in one sentence: a fixture only obeys a console that knows the network key.

On a film set, that means:

• an app opened on the wrong Wi-Fi by mistake can’t take over another stage’s lighting;
• an unknown device can’t inject frames, or replay recorded ones;
• the crew knows which consoles drive which universes, and so does the network.

Sig-Net is free, royalty-free, and its licence is irrevocable. It remains a proprietary protocol: a manufacturer that implements it must reproduce the attribution notice and identify its products with an ESTA manufacturer ID.

How it works

An IoT transport

Sig-Net doesn’t reinvent networking. DMX travels as CoAP (a lightweight Internet-of-Things standard, RFC 7252) over UDP, port 5683. Each universe is sent to a multicast group address, as in sACN: only devices that subscribe receive it. The 63,999 possible universes are “folded” onto 109 multicast groups so switches aren’t overwhelmed.

Each level packet carries the universe priority (0 to 200) followed by its 512 values. Merging between several consoles is therefore done by priority, as in sACN.

One shared key, several derived keys

Everything starts from a network passphrase chosen by whoever runs the network. It is turned into a root key by a deliberately slow function (PBKDF2, 100,000 iterations), then split into role keys: one for lighting senders, one for nodes, one for administration tools. A guest console can therefore be given what it needs to send, without what it needs to reconfigure nodes.

Keys can also be passed around as a file, so nobody has to read the passphrase out loud on set.

Every frame is signed

Each packet carries an HMAC-SHA256 signature computed with the key of its role. Before using a frame, the receiver checks, in order:

1. that it comes from the right network (the “scope”);
2. that it isn’t trying to downgrade security;
3. that it is fresh: each sender has a session number and a counter, and a frame already seen is rejected;
4. that the signature is correct.

Frames are not encrypted, by design: encrypting every universe would add latency to protect data that isn’t secret. Sig-Net guarantees who is speaking and that nothing was altered, not that nobody is listening.

Identities and built-in discovery

Each device has a unique identity starting with its manufacturer’s ESTA ID. Nodes answer polls and announce their name, model and roles; senders announce the universes they send. These exchanges are signed too. There is no central server: several consoles and tools can share one network.

For networks that can’t manage keys yet, an unsigned Open Mode exists. It has to be chosen explicitly.

What is at stake

European law: the Cyber Resilience Act

The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) applies to every product with digital elements sold in the Union, which includes networked fixtures, nodes and consoles. Since September 2026, manufacturers must report actively exploited vulnerabilities. From December 2027, a product that doesn’t meet its cybersecurity requirements can no longer carry the CE mark or be sold in the EU. Art-Net and sACN weren’t designed for this. Sig-Net is one of the industry’s answers, which is why so many manufacturers joined within a few months.

The field: shared networks

A film set often shares its network: video, DIT, production, guests, sometimes the venue’s own network. Consoles multiply, on iPads, on laptops, at several rental houses. Authentication reduces accidents (the wrong console on the wrong universe) as much as malice.

What Sig-Net changes for the crew

• A key to manage. Someone has to choose the passphrase, give it to the right people and change it between productions.
• Gear to update. Nodes and fixtures need compatible firmware. Meanwhile, existing gear stays usable (see below).
• Coexistence. A device can speak Sig-Net, Art-Net and sACN at once: the move can happen universe by universe.

The limits

• Sig-Net doesn’t encrypt: it doesn’t hide what goes over the network.
• Open Mode, if used, protects nothing.
• Security is only as good as the passphrase handling.
• The protocol is young: the specification is still evolving (version 1.11 in September 2026), and compatible hardware is only starting to appear.

Film fixtures: old and new

Good news: a fixture doesn’t need to know Sig-Net to be driven over Sig-Net. It all depends on where the network ends.

DMX fixtures, wired or wireless

The most common case on set: the fixture receives DMX512 over XLR, or through a wireless receiver (CRMX, W-DMX). Here the node speaks Sig-Net: it checks signatures on the network side, then outputs plain DMX to the fixtures or to the wireless transmitter. Every DMX fixture, however old, stays compatible as soon as the node is. That is exactly the setup of ChamSys’s live test at the WOMAD festival in August 2026: a MagicQ console, a GeNetix GN8 node running Sig-Net, 100 fixtures on 6 universes.

Networked fixtures

Recent sources often take Art-Net or sACN directly on their Ethernet port. For them to take Sig-Net, the manufacturer has to ship a firmware update. Until then there are two options: keep using Art-Net or sACN, or use their DMX input behind a Sig-Net node.

Tomorrow’s fixtures

With the CRA deadline, new products sold in Europe will have to secure their network interfaces. Several manufacturers found on film sets already publicly support Sig-Net (Astera, ETC, Elation, Chauvet Professional, Chroma-Q, Prolights, Robe…). Compatible firmware can reasonably be expected in nodes, then consoles, then networked fixtures, though nobody has announced it yet for a specific film fixture.

Where does compatibility stand?

Sig-Net is still too new for a compatibility list. The protocol was published in April 2026, and its specification is still evolving (version 1.11 in September 2026). As of 31 October 2026, no film fixture announces native support, and the first publicly reported live use dates from August 2026: a ChamSys console and a GeNetix GN8 node at the WOMAD festival, with 100 fixtures on 6 universes.

The movement has started, though. More than thirty manufacturers and software makers already publicly support the protocol on sig-net.net, including Astera, ETC, Elation, Chauvet Professional, Chroma-Q, Prolights, Robe, Claypaky, GLP and Ayrton. PlugFests are dedicated to integrating it. Above all, the Cyber Resilience Act requires every manufacturer selling in Europe to secure its networked products by December 2027. All brands can be expected to follow, first in nodes and consoles, then in networked fixtures.

Meanwhile, nothing is blocked: any DMX fixture, wired or wireless, can be driven over Sig-Net behind a compatible node, and networked fixtures can still be driven over Art-Net or sACN from Lumographe. We will update this article as manufacturers release firmware. Already have a device that speaks Sig-Net? Write to support@lumographe.com.

Sig-Net in Lumographe

What is supported

• Output on a par with Art-Net and sACN: each universe is sent multicast, signed, with its priority (100 by default, 0 to 200), universes 1 to 63,999, at up to 44 frames per second. Lumographe announces the universes it sends and releases them cleanly when output is switched off.
• Network key: passphrase or key file (.equalkeys, .guestkeys), kept in the iOS Keychain for this device only, with no iCloud sync or export. Nothing is sent without a key. Open Mode is turned on explicitly and stays flagged in orange.
• Discovery: the list of Sig-Net devices on the network, nodes, consoles and devices without a key, with an alert on possible spoofing.
• DMX input: receive Sig-Net from another console, every frame checked before it enters the merge.

Lumographe uses NOLO’s ESTA manufacturer ID (0x04BE). The specification’s official test vectors are checked byte for byte, and the app’s real traffic has been checked by an independent receiver and by the official Wireshark dissector.

Turning it on

What is not supported yet

• remote node configuration (universe patch, name, IP address, reboot);
• RDM, timecode, preview and OSC carried over Sig-Net;
• secure device onboarding (SNOW);
• universe synchronisation (the question is open with the protocol’s author);
• IPv6: Lumographe sends over IPv4.

Art-Net, sACN or Sig-Net?

In practice: stick to the protocol your nodes speak. If your hardware accepts Sig-Net and the network is shared, it is the safest of the three.

Sources

• sig-net.net: official site, specification, partners.
• LSi Online, 9 April 2026: Sig-Net launch.
• PLASA: PlugFest launch and CRA timeline.
• ChamSys, August 2026: live test at WOMAD.
• Regulation (EU) 2024/2847: Cyber Resilience Act.

Sig-Net® Designed by and Copyright Singularity (UK) Ltd. Sig-Net is a trademark of Singularity (UK) Ltd. Art-Net™ Designed by and Copyright Artistic Licence Holdings Ltd. Other trademarks belong to their respective owners.