HVAC Network Scanner Files

More of what a building network holds, and much faster on unreliable controllers. Tested on a real building. Full details in CHANGELOG.md (github.com); the project's website is jamesccupps.github.io/HVAC-Network-Scanner.

Already on 2.10? Press Update to 2.11.0 in the header, or wait for the daily check. Older copies need this download once.

Download

HVACNetworkScanner.exe: the GUI as one file, no Python needed. Built by GitHub Actions from the v2.11.0 tag (build log), with PyInstaller and its dependencies pinned by hash.

SHA-256  F11AB937033631B67344B47D1053BFC95F7D43EF157C288E72C5F5F144540978

Check it before running (the same hash is in HVACNetworkScanner.exe.sha256):

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

The build signs an attestation that this exact file came from that workflow run and commit. With the GitHub CLI:

:::powershell
gh attestation verify .\HVACNetworkScanner.exe --repo jamesccupps/HVAC-Network-Scanner

The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC": use More info → Run anyway once the hash matches. If Windows Firewall asks, allow it on the networks you scan: BACnet replies to a broadcast are dropped otherwise.

New protocols

• LonWorks/IP (IP-852). One device configuration request per address on UDP 1628. IP-852 routers and nodes (i.LON, SmartServer, LOYTEC L-IP, controllers with an IP-852 channel) report their node type, the name they were given, Neuron IDs, configuration server, and whether authentication is on; the report lists those without it. Built from the IzoT LonTalk stack's packet layouts.
• Serial gateways. Moxa NPort, MGate and OnCell devices answer Moxa's identify request on UDP 4800. They are often where P1, N2, MS/TP and Modbus RTU buses reach the network. Only the identify request is sent, never the functions that older firmware answers with its admin password (CVE-2016-9361); the report says to check them against ICS-CERT ICSA-16-336-02.
• OPC UA identity. On 4840 and KEPServerEX's 49320, the discovery exchange any OPC UA client starts with: the server's own name and product, and each endpoint's security and logins. The report flags servers with an unsecured endpoint or anonymous sessions. No session is opened and nothing is read.
• The Niagara platform ports (3011, 5011) are probed.

Serial buses themselves (P1/FLN, N2, LonTalk on twisted pair, DALI, M-Bus) are not on IP: the scanner finds the gateways that carry them.

Faster on unreliable controllers

The timeout is now the longest wait. A BACnet device that has answered a few requests gets four times its slowest recent reply instead (at least 1 s), so a controller that drops requests costs about a second per drop. On one site four controllers drop around half of all requests: a quick scan went from 3 min 39 s to 2 min 32 s, and those controllers from up to two minutes each to 14-26 s. The log says how long each device took and the real time spent waiting.

Accurate names

Alerton was labelled Carrier / ALC (it is Honeywell's), and Vertiv and Copeland Emerson (independent since 2016 and 2023). Moxa, Lantronix and Echelon / EnOcean are now recognised, and a Moxa device is named by product only when its own web page says so.

Only scan networks you own or are authorized to assess.