troubleshoot pcaps for BACnet industrial protocol in OT/IoT

Question

I have a test bench that I am trying to learn how to take pcaps with WireShark for BACnet UDP traffic of building automation devices.

4 devices in total on test bench:

1. Windows 10 OS running WireShark/nmap - 192.168.0.100
2. Ubuntu Desktop emulating a BACnet client/server device making read requests of sensor values - 192.168.0.104
3. BACnet router, this is a gateway device that can route BACnet/IP traffic to twisted pair Rs-485 devices - 192.168.0.190
4. Rs-485 BACnet MSTP Device wired into the BACnet router, responding to read requests of BACnet device running on Ubuntu 192.168.0.104

Question 1: (not a lot WireShark or nmap wisdom here)

• If I start a WireShark pcap on the Windows 10 machine I am trying to troubleshoot why I cannot see any BACnet UDP traffic between Ubuntu machine making sensor read requests to the MSTP device. Through SSH into the Ubuntu machine I can clearly see in the console that the sensor readings from the MSTP device is being retrieved every 5 seconds just fine but I cannot see any BACnet traffic captured on the Windows 10 device. The only thing that appears to populate in WireShark for BACnet is when the script running on the Ubuntu first starts about, like a global BACnet - who-is-router:

Question 2: (further troubleshoot with running nmap on the Windows 10 device)

• If I nmap the Ubuntu machine: nmap -sV -sU -p 47808 --script bacnet-info 192.168.0.100 Ill get this returned:

  PORT      STATE SERVICE VERSION
  47808/udp open  bacnet
  | bacnet-info:
  |   Vendor ID: Servisys (842)
  |   Vendor Name: SERVISYS inc.
  |   Object-identifier: 3056199
  |   Firmware: 3.8.10 (default, Jun 22 2022, 20:18:18)
  | [GCC 9.4.0]
  |   Application Software: 21.12.03
  |   Object Name: BAC0
  |   Model Name: BAC0 Scripting Tool
  |_  Description: http://christiantremblay.github.io/BAC0/
  MAC Address: 64:31:50:72:C6:62 (Hewlett Packard)
  

  And nmap the BACnet router: nmap -sV -sU -p 47808 --script bacnet-info 192.168.0.104 I get this returned:

  Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-24 10:37 Central Daylight Time
  Nmap scan report for 192.168.0.104
  Host is up (0.0010s latency).
  
  PORT      STATE  SERVICE VERSION
  47808/udp closed bacnet
  

What is the difference between 47808/udp closed bacnet and 47808/udp open bacnet between the nmap results? Could this be a reason why I cannot see BACnet traffic in WireShark? Just curious if I am on track to troubleshooting this or off in the weeds somewhere....any tips help

Answer 1

If I start a WireShark pcap on the Windows 10 machine I am trying to troubleshoot why I cannot see any BACnet UDP traffic between Ubuntu machine

Likely your network uses a switch that connects all nodes together. In a switched network each node can only see/capture traffic that it originates, that is addressed to it, and broadcast traffic. To capture traffic between any other nodes you'd need a managed switch with a port monitoring/mirroring/SPAN feature.

Protocols above the transport layer are explicitly off topic here, so we can't answer your second question.