I have a test bench that I am trying to learn how to take pcaps with WireShark for BACnet UDP traffic of building automation devices.

4 devices in total on test bench:

  1. Windows 10 OS running WireShark/nmap -
  2. Ubuntu Desktop emulating a BACnet client/server device making read requests of sensor values -
  3. BACnet router, this is a gateway device that can route BACnet/IP traffic to twisted pair Rs-485 devices -
  4. Rs-485 BACnet MSTP Device wired into the BACnet router, responding to read requests of BACnet device running on Ubuntu

Question 1: (not a lot WireShark or nmap wisdom here)

  • If I start a WireShark pcap on the Windows 10 machine I am trying to troubleshoot why I cannot see any BACnet UDP traffic between Ubuntu machine making sensor read requests to the MSTP device. Through SSH into the Ubuntu machine I can clearly see in the console that the sensor readings from the MSTP device is being retrieved every 5 seconds just fine but I cannot see any BACnet traffic captured on the Windows 10 device. The only thing that appears to populate in WireShark for BACnet is when the script running on the Ubuntu first starts about, like a global BACnet - who-is-router:

enter image description here

Question 2: (further troubleshoot with running nmap on the Windows 10 device)

  • If I nmap the Ubuntu machine: nmap -sV -sU -p 47808 --script bacnet-info Ill get this returned:

    47808/udp open  bacnet
    | bacnet-info:
    |   Vendor ID: Servisys (842)
    |   Vendor Name: SERVISYS inc.
    |   Object-identifier: 3056199
    |   Firmware: 3.8.10 (default, Jun 22 2022, 20:18:18)
    | [GCC 9.4.0]
    |   Application Software: 21.12.03
    |   Object Name: BAC0
    |   Model Name: BAC0 Scripting Tool
    |_  Description: http://christiantremblay.github.io/BAC0/
    MAC Address: 64:31:50:72:C6:62 (Hewlett Packard)

    And nmap the BACnet router: nmap -sV -sU -p 47808 --script bacnet-info I get this returned:

    Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-24 10:37 Central Daylight Time
    Nmap scan report for
    Host is up (0.0010s latency).
    47808/udp closed bacnet

What is the difference between 47808/udp closed bacnet and 47808/udp open bacnet between the nmap results? Could this be a reason why I cannot see BACnet traffic in WireShark? Just curious if I am on track to troubleshooting this or off in the weeds somewhere....any tips help

1 Answer 1


If I start a WireShark pcap on the Windows 10 machine I am trying to troubleshoot why I cannot see any BACnet UDP traffic between Ubuntu machine

Likely your network uses a switch that connects all nodes together. In a switched network each node can only see/capture traffic that it originates, that is addressed to it, and broadcast traffic. To capture traffic between any other nodes you'd need a managed switch with a port monitoring/mirroring/SPAN feature.

Protocols above the transport layer are explicitly off topic here, so we can't answer your second question.

  • Thanks for the response, so its my switch that is filtering traffic....its actually my home Wi-Fi router that I am using on my home test bench. I do have a cheap unmanaged portable switch, would that help at all? Thanks for any tips not a lot of wisdom here
    – bbartling
    Sep 27, 2022 at 13:54
  • Sorry if my question is off topic but my home router does have a To add static routing entries: is that anything that would help me at all? BACnet protocol runs on UDP port 47808
    – bbartling
    Sep 27, 2022 at 13:59
  • I don't think so - from your capture, all devices are located on the same private subnet, so there's no (static) routing in that network. You'd need to add a static route if there's another router with an additional IP subnet behind it.
    – Zac67
    Sep 27, 2022 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.