HVAC Network Scanner Files

A review-and-polish release: wrong results fixed, scans about twice as fast, a rebuilt GUI, and three new capabilities — unicast discovery across subnets, Siemens APOGEE P2 detection, and an HTML survey report. Full details in CHANGELOG.md (github.com).

Download

HVACNetworkScanner.exe — the GUI as one file, no Python needed. Built by GitHub Actions from the v2.7.0 tag (build log).

SHA-256  05FE20CC97C4C238AE763C3E9DE3CE0359F312B6613183E589BB0F6D3F2F3DCF

Check it before running:

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC" — use More info → Run anyway once the hash matches. If Windows Firewall asks, allow it on the networks you scan: BACnet replies to a broadcast are dropped otherwise.

Fixes — results were wrong before

• Engineering units. Most of the table was wrong: humidity showed as "W", CO₂ (ppm) as "kPa-alt", kWh as "kPa", and inH₂O, psi, gpm and kW had no label. Now the full BACnet engineering-units table. Object types 32–62 (Integer Value, Large Analog Value, Network Port, …) were missing or off by one.
• BBMD: devices relayed by a BBMD were recorded at the BBMD's address, so their deep scan went to the wrong host.
• Modbus phantom devices: a gateway's "no device at this unit" reply counted as a device, and a meter that answers every unit ID was listed nine times.
• MS/TP devices found by the global Who-Is were labelled BACnet/IP; the CLI printed every log line twice; a bad target exited 0; double-clicking a point crashed the GUI; older HTTPS gear (TLS 1.0/1.1) gave no banner or certificate.

Faster

• BACnet devices are deep-scanned four at a time, without any one controller or MS/TP trunk ever seeing two requests at once (--bacnet-workers).
• Port sweeps run hundreds of connection attempts concurrently, ordered so each host sees one at a time; SNMP queries every host from one socket and waits once; MS/TP networks that already answered aren't asked twice.

New

• Unicast discovery finds controllers on another subnet or VLAN, where a Who-Is broadcast never arrives (--unicast auto|always|off; automatic for non-local targets).
• Siemens APOGEE P2 detection. Firmware 2.x panels speak P2 on TCP 5033, not BACnet/IP, so an APOGEE building looked empty. Each open 5033 now gets one P2 identify frame carrying a network (BLN) name no site uses: a field panel resets the connection and a supervisor closes it, both at the access gate and without writing anything to the panel. Not a handshake, not name-guessing. --no-p2 to skip.
• HTML survey report (Export → Survey report, --html, or python -m hvac_scanner.report scan.json): findings ranked by severity — published default credentials on a reachable login, unencrypted logins, SNMP default communities, certificates, points in alarm or overridden, Modbus and P2 exposure — plus the inventory and open services, in one file for the building owner.
• Point status: points in alarm or fault (red) and overridden or out of service (amber), with a Flagged count; multi-state values read as their state text ("Occupied", not "2").
• Rebuilt GUI: live progress and counts, a filter across every tab, a device details panel, point-list CSV export, an Advanced panel with every option, remembered settings, keyboard shortcuts and an icon.
• --points-csv, --snmp-community (repeatable), --version, and a hint when nothing answers.

Things that behave differently

• Unit labels use symbols (°F, %RH, inH2O) and binary present values export as active/inactive rather than 1/0.
• New CSV columns (Flagged Points, Status) are appended at the end; existing columns don't move.
• APOGEE detection is on by default and sends one frame to each host with TCP 5033 open.
• Deep scans are parallel by default; --bacnet-workers 1 restores one device at a time.

Only scan networks you own or are authorized to assess.