Download
HVAC Network Scanner is a free, open source discovery and audit tool for HVAC and building automation networks. It finds what's on a network and identifies each device's make and model, over BACnet/IP and MS/TP behind routers, BACnet/SC, Modbus TCP, KNXnet/IP, LonWorks/IP, Niagara Fox, OPC UA, Siemens APOGEE P2, SNMP and serial gateways. It reads points and registers and writes a survey report.
It's read-only by design. It flags factory-default logins and open setups (BACnet/SC hubs that take a connection without a client certificate, KNX without KNX Secure), and checks firmware against CISA's ICS advisories for Trane and Siemens controllers, a list that updates itself daily.
On Windows it's one code-signed exe with a GUI: nothing to install, and it updates itself. It also runs on Python 3.10 or newer with the standard library alone, with a command line, and installs with Scoop.
Only scan networks you own or are authorized to assess.
Features
- BACnet/IP and MS/TP discovery, across subnets and behind routers
- BACnet/SC, Modbus TCP, KNXnet/IP, LonWorks/IP, Niagara Fox, OPC UA and SNMP
- Detects Siemens APOGEE P2 panels and supervisors without registering on them
- Identifies controller models: Trane, Siemens, Johnson Controls, Tridium and more
- Reads points and registers, and writes a survey report
- Flags factory-default logins, and BACnet/SC and KNX left open
- Checks firmware against CISA ICS advisories, a list that updates itself daily
- Read-only by design
- Code-signed Windows exe, nothing to install, signed in-place updates
- Python standard library only, with a GUI and a command line
Project Samples
