Use of wireshark to decode BACnet traffic on non standard ports

BACnet IP can operate on any port including non any non default ports. BACnet default port is 47808 (or BAC0 in HEX), we have also seen 47808-47817 (or BAC0-BAC9) on many different sites. When attempting to debug BACnet IP traffic that is on a non standard you need to change the default decoding for a perpendicular  port.

Instructions  

1. Start Wireshark
2. Load or capture some BACnet packets on a non standard port
3. From the “Analyse” menu select “Decode as”
4. Select the non default BACnet IP udp port number in the drop down box.
5. Select “BVLC” from the right hand menu.
   Note: “BVLC” stands for “BACnet Virtual Link Control” and is the header to all BACnet IP messages.
6. Click OK

Source: Chipkin.com