Port 47808 — BACnet/IP

• Protocol: BACnet/IP (over UDP), also BACnet/MSTP (RS485) + BACnet Secure Connect (BACnet/SC, new)
• Who-Is / I-Am discovery on UDP/47808 broadcast
• Objects: Device, Analog Input, Binary Output, Schedule, Notification
• BACnet/SC (2020+) — TLS 1.3, WebSocket, fixes the auth gap
• Nmap: -sU -p 47808 --script bacnet-info

# Discovery
$ nmap -sU -p 47808 --script bacnet-info 10.0.0.0/24

# Python bacpypes Who-Is
from bacpypes.app import BIPSimpleApplication
from bacpypes.local.device import LocalDeviceObject
app = BIPSimpleApplication(LocalDeviceObject(...), '10.0.0.5')
app.who_is(1, 999, Address('10.0.0.255'))

• Modbus
• MQTT over TLS

BACnet/IP (Building Automation and Control Network over Internet Protocol) is a communication protocol specifically designed for building automation and control systems. It operates over the UDP protocol, utilizing port 47808, which is defined in the standard ANSI/ASHRAE 135. This protocol enables interoperability among various devices such as HVAC systems, lighting controls, access control systems, and elevator controls.

One of the key features of BACnet/IP is its ability to facilitate open discovery through the Who-Is broadcast message. This allows BACnet devices to announce their presence on a network, enabling them to be easily identified and integrated into building management systems.

However, it is crucial to note that BACnet/IP should never be exposed to the internet without appropriate security measures, as it lacks built-in authentication. Enterprises often mitigate this risk by employing BACnet gateways that support Transport Layer Security (TLS) or by utilizing a bridge with protocols such as MQTT or OPC UA for secure communication.

Configuring BACnet/IP devices involves understanding the necessary commands and settings to ensure proper communication over port 47808. Below are some practical examples of commands and configurations used in a BACnet/IP environment:

• Discovering BACnet Devices: Use the following command to initiate a Who-Is broadcast:

bacnet-discover --port 47808

• Addressing a Specific Device: After discovering devices, you can send commands to a specific device using its Device ID:

bacnet-write --address  --port 47808 --property  --value 

• Monitoring a Property: To monitor a property continuously, you can use:

bacnet-read --address  --port 47808 --property  --interval 

These commands can be executed from a terminal or integrated into automation scripts for enhanced control over building systems, ensuring seamless interactions between devices operating under the BACnet/IP protocol.

While BACnet/IP facilitates communication between various building automation devices, it is essential to implement security measures to protect against unauthorized access and data breaches. Here are some best practices for securing BACnet/IP communications:

• Use of Firewalls: Implement firewalls to restrict access to port 47808 only to trusted devices within the internal network. This helps prevent external threats from exploiting vulnerabilities.
• Implement VLANs: Create Virtual Local Area Networks (VLANs) to segment BACnet traffic from other types of network traffic. This isolation can enhance security and performance.
• Utilize BACnet Gateways: Employ BACnet gateways that support TLS to encrypt data in transit. This ensures that sensitive information transmitted between devices remains confidential.
• Regular Firmware Updates: Keep all BACnet devices updated with the latest firmware to protect against known vulnerabilities. Manufacturers often release updates that address security flaws and improve functionality.
• Monitoring and Auditing: Continuously monitor BACnet traffic and conduct regular audits of device access logs to identify any unusual activity or potential security breaches.

By following these best practices, organizations can significantly reduce the risks associated with operating BACnet/IP networks and ensure the integrity and availability of their building automation systems.