New Cisco switches come with a RFID tag. Need to do inventory? No need to move the switch all around looking for serial numbers, just use a scanner and read them in as you enter the room!

I bought a sub $100 scanner on Amazon (Thincol RFID reader) . It works as a keyboard — when it comes into contact with a RFID tag it energizes the tag and types out the info on the tag. This particular scanner works only with windows (or in my case a windows VM via virtualbox).

I was trying to RFID a switch with this serial:

FCW2141L002

And when I used the RFID scanner, it outputted this info:

36142D8D4000B1E343AEC98B4633183064000000000000000000

So, how in the world do you get to the serial from that hex gobbledygook? Read on!

There is this article on cisco.com on RFID tag identification. It seems to be the only article out there. It has some good info in it, mostly behind the theory, but lite on practicality. What is output from the scanner is only the Electronic Physical Code (EPC) at 208 bits. The tag ID and user memory portion are not read/output (at least I could not get anything there). Of those 208 bits:

• Bits 1-8 are for the EPC header and say ’36’ in hex (0x36)
• Bits 9-11 are for the filter and read ‘0’ in hex (0x0)
• Bits 12-14 are for the partition and read ‘5’ in hex (0x5)
• Bits 15-34 are for the GS1 company prefix (whatever that is) and read on my switch ‘0B635’ in hex (0x0B635). Note this is different than the example given on cisco.com which is 7 characters: 0746320
• Bits 35-58 are for some item reference (again, whatever that is) and read ‘0002C7’ in hex (0x0002C7)
• Finally bits 59-135 are where the serial number is

This is very non-intuitive (hey, it’s Cisco, not Meraki). Speficially if you look at the first 2 bytes that come back on the scanner (3614) – the 36 maps exactly to 36 for the EPC header, but the next byte (14) the “1” maps to all bits 9-11 for the filter (all zeros) and 1/3 of the bits 12-14 for the partition (specifically the first 1 in 101). The first half of the “4” maps to the rest of the filter 01 and the last half of the “4” maps to the first part of the GS1 company prefix (00). Confused? Yes you are.

Now the simple thing to do is put the string you get back from the RFID scanner in a HEX to binary converter like this one. Then on the resulting string back will be 206 bits long, like this

11011000010100001011011000110101000000000000001011000111100011010000111010111011001001100010110100011000110011000110000011000001100100000000000000000000000000000000000000000000000000000000000000000000000000

Why 206 bits and not 208? There are 0 leading zeros you have to put in for the ’36’ on the EPC header. So add in 2 leading zeros and you get:

0011011000010100001011011000110101000000000000001011000111100011010000111010111011001001100010110100011000110011000110000011000001100100000000000000000000000000000000000000000000000000000000000000000000000000

Now that you have 208 bits, you want to grab bits 59-135 (because you want 77 bits starting at position 59). Getting that out gives you:

1000110 1000011 1010111 0110010 0110001 0110100 0110001 1001100 0110000 0110000 0110010

(spaces added every 7 bits for readability)

Then you take those bits (with the spaces every 7 characters) and put them into a binary to ASCII converter: and you get: FCW2141L002.

Voila! FCW2141L002 from 36142D8D4000B1E343AEC98B4633183064000000000000000000