Open / standardized
BACnet/IP
The IP profile of BACnet, using BBMDs and foreign device registration to carry broadcasts across routed networks — which also extends discovery reach.
47808/UDP (0xBAC0)UDPEncryption: No
How it works
BBMDs forward broadcast messages between IP subnets; foreign devices register to receive them without being on the local subnet.
Communication patternWorkstation ↔ BBMD ↔ remote building controllers.
Fact sheet
TransportUDP
Ports47808/UDP (0xBAC0)
AuthenticationWeak / legacy
PurdueLevel 3 – Level 2
EnvironmentsCampus building automation, Multi-building estates
DevicesBBMD, Building controller, Operator workstation
IndustriesBuilding Automation, Data Centers, Healthcare / Medical CPS
Why should I care?
Understanding BACnet/IP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Forwarded-NPDU
- Foreign device registration
- Standard BACnet services
Security concerns
- Foreign device registration can be abused to join broadcast distribution
- BBMD tables are rarely audited
- Frequently exposed to the internet in public scanning research
What normal looks like
- Stable BBMD peer table
- Registered foreign devices you can name
What deserves attention
- New foreign device registration
- BBMD peers you did not configure
Hunting ideas
- unexpected-internet-connectivity
- new-device-control-zone
Defensive controls
- Audit BBMD and FDT tables
- Block 47808/UDP at the perimeter
- Dedicated BAS VLANs
Related ATT&CK for ICS techniques
T0846
Sources & further reading