How to Read a BACnet Device With a Free Explorer Tool
BACnet devices announce themselves on the network — with the right free tool you can see a device's Device Instance number and its full list of objects without knowing anything about it beforehand. This is a hands-on guide for the curious, not a claim that it's a five-minute project for everyone.
4 Steps to Explore a BACnet Device
Set up an isolated test network
Never experiment on a live production BMS. Use a separate test segment or lab setup where a mistake won't touch a real building.
Send a Who-Is broadcast
A free BACnet explorer/scanning tool broadcasts Who-Is on the network (over UDP 47808 for BACnet/IP, or on the MS/TP trunk) — basically asking 'who's out there?'.
Collect the I-Am replies
Every device that hears the broadcast answers with I-Am, revealing its unique Device Instance number. The tool lists everything it finds.
Browse objects with Read Property
Open a device and browse its object list (AI, AO, BV, and so on) and properties — Present_Value, Object_Name, Units. Reading is safe to try; writing (Write Property) is not, unless it's your own network.
What You'll Actually See Inside a Device
The Device Instance number
Every BACnet device has its own number in this range, unique across the whole network — it's the very first thing you'll see once your tool gets an I-Am reply.
Discovery without an IP list
Who-Is/I-Am finds devices without you knowing their addresses in advance — the tool just calls out and listens for answers.
The full object list
Each device exposes its objects — Analog/Binary/Multi-state Input, Output, Value, plus a Device object for itself — no digging through documentation required.
Live values and status
Properties like Present_Value, Status_Flags and Units show exactly what the system thinks about each point right now — useful for understanding how a device actually behaves.
A hint about commissioning quality
If Object_Name reads like 'AI-1' or 'BO-14' instead of something like '2F-HVAC-ROOM-TEMP', that's a sign of rushed or inconsistent setup — a useful signal when judging an existing system.
A clear line — read yes, write no
Read Property is safe to try on an isolated network. Write Property on a live production BMS can have real consequences — like turning off ventilation — and shouldn't be attempted without authorization.
What You Need Before You Start
Nothing exotic, but a few basics matter
- A computer with a network connection (Ethernet for BACnet/IP, or an RS-485 adapter for MS/TP)
- An isolated test network or segment — not a live production BMS
- A free BACnet explorer/scanning tool of your choice
- Basic comfort with IP/UDP networking, or RS-485 basics for MS/TP
- Patience to read the replies, and a device's PICS document if you can get one
Frequently asked questions
Is it OK to scan a BACnet network that isn't mine?
Only with permission. Test on your own isolated network or with clear authorization from the building owner or integrator — even reading someone else's production network without permission isn't okay, even though it's technically non-destructive.
What's the actual risk difference between Read Property and Write Property?
Read Property just reads a value — safe to try on an isolated network. Write Property changes a real setting; on a production BMS that could mean ventilation switching off or another physical consequence, so don't do it without authorization.
Does a BACnet explorer work over WiFi?
BACnet/IP runs over a standard IP network, and that network can technically ride over WiFi as the underlying transport — but the protocol itself isn't defined as wireless, and MS/TP needs a physical RS-485 connection. Don't think of it as a generic 'wireless BACnet'.
Why isn't Who-Is getting any I-Am replies?
Usual suspects: a firewall blocking UDP 47808, the device sitting on a different subnet without BBMD/Foreign Device registration, or the device actually speaking MS/TP instead of BACnet/IP while your tool listens on the wrong network.
Does this replace hiring a professional integrator?
No. This guide helps you understand the protocol from the inside before you commission a real project — actual commissioning, PICS review, and safe integration on a production system still need professionals.
Want to Go Deeper Into BACnet?
If this got you curious but feels like too much to run solo, browse our other protocol and building-automation guides, or check the smarteg.lv shop for ideas for your own setup.