HVAC Network Scanner Files

The scanner now updates itself, finds the whole site behind a BBMD, and says where the time goes. Tested on a real building over four rounds. Full details in CHANGELOG.md (github.com); the project's website is jamesccupps.github.io/HVAC-Network-Scanner.

Download

HVACNetworkScanner.exe: the GUI as one file, no Python needed. Built by GitHub Actions from the v2.10.0 tag (build log), with PyInstaller and its dependencies pinned by hash.

SHA-256  9CECF415AFB83DC3E47DBB0E45FF5FB19B2C30F7DACB2CC5955FAF6BE47BE09B

Check it before running (the same hash is in HVACNetworkScanner.exe.sha256):

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

The build signs an attestation that this exact file came from that workflow run and commit. With the GitHub CLI:

:::powershell
gh attestation verify .\HVACNetworkScanner.exe --repo jamesccupps/HVAC-Network-Scanner

The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC": use More info → Run anyway once the hash matches. If Windows Firewall asks, allow it on the networks you scan: BACnet replies to a broadcast are dropped otherwise.

Updates from inside the app

From this version the executable checks for a new release once a day (Advanced → Check for updates daily; Check for updates in the header asks at once) and installs it with one click. The download must match latest.json, a manifest attached to each release and signed with the project's Ed25519 key; the public key is built into the app. The new exe swaps itself in and reopens, and if anything fails the previous one is put back. Every build is tested by updating a copy of itself for real. Copies older than 2.10 need this one download by hand.

Finds the whole site

• Every silent address on another subnet is probed, and asked a second time where anything answered. Answers relayed by a BBMD, or sent back by the BBMD itself, used to make the scanner treat the subnet as covered: on one site a quick scan missed 29 controllers, and another all 112 on the second subnet.
• Lost packets no longer slow a controller to a crawl. A batched read that goes unanswered on a controller where batches already worked is asked again before the batch shrinks, and the size grows back.
• Devices answering from outside the targets are named by subnet in the log, the report and the export, and the export records the BACnet port and the address the scan ran from (the report says when other BACnet software held 47808).

Faster, and says where the time went

• Devices only depth: each device's identity (name, model, vendor, firmware, description, location) and nothing else, for a fast inventory. Tick Services too for devices and their open ports.
• A per-device time limit (Advanced or --device-time-limit, 180 s by default): a device that reaches it keeps what was read and is marked partial.
• Times in the log: the clock on every section heading, how long each device took and how many of its requests went unanswered, and a summary of where the time went. The report lists controllers that drop requests, usually a network problem near the controller.

Clearer results

• Devices are named for what their model says: DXR2 E10PL / E12P / E18, PXC Modular / Compact, Desigo PXC4 / PXC5 / PXC7, Insight, Desigo CC, Tracer Ensemble, Trane TR200 and Yaskawa HV600 drives, MelcoBEMS MINI. A Tracer Ensemble server used to be a "unitary controller".
• The same fault on many identical controllers is one report row with a count; identical KNX gateways likewise.
• A router heard twice is listed once; the progress text names the devices a deep scan is waiting on; the dark theme's scrollbars are visible.

Only scan networks you own or are authorized to assess.