Decoding BACnet Traffic on Non-Standard Ports Using Wireshark

BACnet IP can operate on any port, including any non-default ports. BACnet's default port is 47808 (or BAC0 in HEX), but we have also seen 47808-47817 (or BAC0-BAC9) on many different sites. When attempting to debug BACnet IP traffic that is on a non-standard port, you need to change the default decoding for a particular port.

Instructions 

1. Start Wireshark
   
2. Load or capture some BACnet packets on a non standard port
3. From the "Analyse" menu select "Decode as"
4. Select the non default BACnet IP udp port number in the drop down box.
5. Select "BVLC" from the right hand menu.
   Note: "BVLC" stands for "BACnet Virtual Link Control" and is the header to all BACnet IP messages.
6. Click OK