Open / standardized
BACnet
The dominant building automation protocol. BACnet/IP on UDP 47808 is broadly deployed, frequently on shared corporate networks, and often internet-exposed by accident.
47808/UDP (BACnet/IP)MS/TP serial, Ethernet, IPEncryption: No
How it works
Devices expose standard object types (analog input, binary output, schedule). Clients read/write properties and subscribe to change-of-value notifications.
Communication patternOperator workstation → controller property read/write; Who-Is / I-Am discovery broadcasts.
Fact sheet
TransportMS/TP serial, Ethernet, IP
Ports47808/UDP (BACnet/IP)
AuthenticationWeak / legacy
PurdueLevel 2 – Level 1
EnvironmentsBuilding automation, HVAC, Lighting
DevicesBuilding controller, VAV controller, Operator workstation
IndustriesBuilding Automation, Healthcare / Medical CPS, Data Centers
Why should I care?
Understanding BACnet is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- ReadProperty
- WriteProperty
- Who-Is / I-Am
- SubscribeCOV
- Schedule and trend objects
Security concerns
- Discovery broadcasts enumerate an entire building quickly
- Property writes can change setpoints and schedules
- Building networks are often the least segmented OT in an organisation
What normal looks like
- Known workstation performing scheduled reads
- COV subscriptions from the BAS front end
What deserves attention
- Who-Is sweeps from a new host
- WriteProperty from an unmanaged device
- Internet-sourced BACnet traffic
Hunting ideas
- ot-network-scanning
- unexpected-internet-connectivity
- protocol-write-activity
Defensive controls
- Give building systems their own zone and conduits
- Never expose 47808/UDP to the internet
- Inventory BAS devices explicitly
Related ATT&CK for ICS techniques
T0846T0855
Sources & further reading