Documentation /

Siemens PLC Data Monitoring via S7 Protocol and Snap7

Last updated on 19 May 2026

In modern industrial automation, reliable communication between PLCs and external systems is essential. This article explains what Snap7 is, how the S7 protocol works, and how to configure a Siemens PLC so that an external client can establish a connection. You will learn exactly what S7comm does, how Snap7 implements the protocol, and which PLC types are supported — including the correct rack and slot settings for S7-300, S7-400, S7-1200, and S7-1500.

For background tools and remote solutions, you can also look into secure remote access for industrial systems.

What is the S7 Protocol Snap7

The S7 protocol (also known as the S7comm protocol) is a communication protocol developed by Siemens for SIMATIC S7 PLCs. It runs on top of TCP/IP and typically uses port 102. Originally designed for engineering tools like STEP 7 or TIA Portal, it is also widely used by SCADA systems, MES platforms, and other applications for data monitoring. Snap7 implements this protocol open-source, allowing reading and writing without Siemens software.

What Can You Communicate With

  1. Read and write data from PLC memory (DB, M, I, Q)
  2. Request PLC status information
  3. Download and diagnose programs (Siemens environments)

Key Features of S7comm

Important technical points to know when integrating with S7 and Snap7:

  1. Communication via TCP/IP (port 102) — standard Ethernet enables access through existing networks.
  2. Support for multiple PLC families — both classic S7 series and modern S7-1200/1500.
  3. Use of rack and slot — rack and slot indicate the CPU position within the PLC cabinet (S7-300/400 typically rack 0 slot 2; S7-1200/1500 typically rack 0 slot 1).
  4. Access to various memory areas such as data blocks (DB), markers (M), inputs (I), and outputs (Q).
  5. No standard encryption within S7comm — security must be managed at network or PLC level.

What is Snap7

Snap7 is an open-source library that implements the S7 protocol. It enables engineers and developers to read and control Siemens PLCs without Siemens licenses. Snap7 works via IP (port 102) and uses the same rack/slot logic as the official tools.

Main features of Snap7:

  1. Works via IP, port 102 and rack/slot settings
  2. Supports multiple memory areas (DB, M, I, Q)
  3. Can both read and write
  4. Suitable for older and modern PLCs
  5. Free to use (no license costs)

Snap7 is widely used for data logging and data processing; for data monitoring and further infrastructure management, you can find background information at data monitoring.

Setting up the Siemens PLC for Snap7

For a successful Snap7 connection, several settings in the PLC and network must be correct. Below are the practical checkpoints.

Network Access and Firewall (Port 102)

Ensure the PLC is accessible on port 102 and that the client is in the same network or can reach the PLC via routing. For external connections, proper network configuration and firewall control are essential; for integrations with remote systems, it’s common to set up and monitor controlled remote access. For information about secure external solutions, check remote access.

S7-300, S7-400, S7-1200, and S7-1500 Rack and Slot Settings

When setting up the connection, the software asks for a Rack and Slot number. This indicates the position of the CPU:

  • Siemens S7-1200 → Usually use Rack 0, Slot 1
  • Siemens S7-1500 → Usually use Rack 0, Slot 1
  • Siemens S7-300 / S7-400 → Usually use Rack 0, Slot 2

PUT/GET Communication (S7-1200 / S7-1500)

For S7-1200 and S7-1500, ‘Allow PUT/GET communication’ must be explicitly enabled in TIA Portal. Without this option, the PLC often refuses external connections via Snap7.

Review Security Settings

Check access rights, firewall rules, and PLC protection. For some S7-1500 systems, protection must be set to “Full access” or equivalent to allow external reading and writing.

Prepare Data Blocks

Define clear data blocks with fixed addresses and data types. Note:

  1. Only global DBs are readable/writable via external clients.
  2. “Optimized block access” must be disabled if you want fixed addressing and simple access.

Supported Siemens PLC Types

Snap7 supports almost all PLCs that use the classic S7 protocol (S7comm). Below is an overview with notes.

PLC typeSeriesSnap7 SupportNotes
S7-200LegacyLimited / partialOnly models with Ethernet module; many old S7-200 communicate via PPI/serial.
S7-300ClassicFullWidely used; stable support.
S7-400ClassicFullSupport comparable to S7-300.
S7-1200ModernFullRequires ‘Allow PUT/GET communication’ in PLC settings.
S7-1500ModernFullSame principle as S7-1200; security can be stricter.
LOGO!Small PLCNot supportedLOGO uses a different protocol than S7comm.
ET200 (IM)Decentralized I/O with CPULimited / dependentIf the CPU supports S7comm, Snap7 works here too.

Note: S7-200 support is limited because many older models communicate via serial PPI bus and not via standard S7comm. LOGO! PLCs are not compatible with Snap7. S7-1200 and S7-1500 are generally fully usable provided the correct communication options are enabled on the PLC side.

In summary: the S7 protocol and Snap7 together form a practical, open way to retrieve or write data to Siemens PLCs. During implementation, pay particular attention to network access (port 102), rack/slot, PUT/GET settings in TIA Portal, and correct data block configuration. For advanced integrations and further documentation about remote solutions and data logging, you can consult Remote’s resources.

Frequently asked questions about Snap7 and Siemens S7 protocol

Use rack 0, slot 1. This is the fixed default setting for all S7-1200 and S7-1500 PLCs. A common mistake is entering slot 2 — that only works for S7-300 and S7-400.

Does the connection still fail after checking the rack/slot? Then the problem often lies within the broader network or access layer. Our hardware, ServiceGate routers and Edge Controllers, are specifically designed for OT environments and ensure a stable, secure connection between external systems and your Siemens PLC — without the hassle of firewalls or network configurations on the IT side.

The three most common causes:

  1. PUT/GET not enabled in TIA Portal → Device properties → Security → Enable PUT/GET
  2. Incorrect slot → use slot 1, not slot 2
  3. Firewall or network is blocking port 102

Are all these settings correct and it still does not work? Then the problem is almost certainly in the access layer between the client and the PLC. This is exactly what we work with every day — contact us and we will take a look with you.

Yes, Snap7 has official support for Linux. The library is platform-independent and works on Windows, Linux, and macOS.

S7comm is the common technical name for the Siemens S7 communication protocol. Both terms refer to the same protocol running on TCP/IP port 102.

No, not without additional measures. S7comm has no built-in encryption. Never expose the S7 protocol directly to the public internet.

The correct approach for secure remote access to a Siemens PLC:

  • VPN tunnel between client and PLC network
  • Network segmentation — PLC in a separate OT segment
  • Zero-trust access control — only authorized users and systems are granted access

Our Remote ServiceGate routers and Edge Controllers are built exactly for this purpose. They form the secure gateway between your OT environment and the outside world — with strong VPN tunnels, zero-trust principles, and separated data streams. View the ServiceGate router solution.

Snap7 handles the protocol. But in OT environments, the connection itself is at least as important as the protocol. Questions you need to answer:

  • Who is allowed to connect to the PLC — and when?
  • How do you log who had access and when?
  • How do you prevent an unmanaged connection from becoming a security risk?
  • How do you scale this to multiple machines or locations?

This is where Remote makes the difference. Since 2008, we have been helping companies manage their installations, machines, and building management systems securely from a distance — with our own hardware (ServiceGate routers and Edge Controllers) and a central Remote Portal for access management, data logging, and monitoring.

The Remote team has in-depth knowledge of industrial protocols, OT networks, and cybersecurity.

→ View our Remote Access Solutions or contact us for a technical discussion about your situation.

In this article

Get more out of your
machine data

Try for 30 days FREE!