BACnet/IP Asset Discovery With ReadProperty
Overview
BACnet/IP connects building controllers, supervisory systems, and other automation equipment over IP networks. OTserver uses standard property reads to identify BACnet devices without changing their objects.
How OTserver discovers BACnet devices
OTserver sends unicast BACnet ReadProperty requests to UDP port 47808 on each ARP-discovered target. It first reads the Device object’s Object Identifier to learn the instance number. A valid response then triggers individual reads for eight identity properties.
The response decoder verifies the BVLC length, NPDU routing fields, unsegmented ComplexACK, invoke ID, object identifier, property identifier, tags, and value boundaries before accepting evidence.
Evidence extracted
| OTserver evidence | BACnet property |
|---|---|
| Device instance | Object Identifier (75) |
| Firmware | Firmware Revision (44) |
| Application version | Application Software Version (12) |
| Model | Model Name (70) |
| Name | Object Name (77) |
| Description | Description (28) |
| Location | Location (58) |
| Vendor | Vendor Name (121) and Vendor Identifier (120) |
Text values, numeric identifiers, the initial response, and unsupported encoded values are retained as raw evidence.
Security and read-only safety
The scanner only invokes ReadProperty. It does not use WriteProperty, reinitialize devices, manage alarms, or modify schedules and setpoints. The requests are unicast rather than a BACnet/IP Who-Is broadcast, but they should still be enabled only for an authorized network.
Frequently asked questions
Does OTserver use BACnet Who-Is and I-Am broadcasts?
No. The current implementation starts from ARP-discovered IPv4 targets and sends ReadProperty directly to each target on UDP 47808.
What happens when a BACnet property is unavailable?
OTserver keeps the valid properties returned by the device. A missing optional property does not erase other identity evidence.
Compare all supported discovery protocols or configure per-protocol scanning.