HVAC Network Scanner Files

The rest of the BACnet roadmap, KNX, and saved sites — plus fixes found by checking the scanner against nmap, Redpoint, zgrab2, bacnet-stack and BACpypes3. Everything new is read-only: nothing registers with a BBMD, joins a BACnet/SC hub or writes to a device. Full details in CHANGELOG.md (github.com).

Download

HVACNetworkScanner.exe — the GUI as one file, no Python needed. Built by GitHub Actions from the v2.8.0 tag (build log).

SHA-256  FC91D2F5993E33486208397D324CFD51F32B88029C68822C5A9A5F70794C0EB5

Check it before running:

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC" — use More info → Run anyway once the hash matches. If Windows Firewall asks, allow it on the networks you scan: BACnet replies to a broadcast are dropped otherwise.

New

• MS/TP behind routers on other subnets, without a BBMD. The routers' Network Port objects say which MS/TP networks they serve; a Who-Is routed through each router finds the devices that answer directly. --mstp-probe (GUI: Advanced) asks each MS/TP address in turn to find the ones that only broadcast — about a minute per network, a few requests at a time.
• BBMD tables: which subnets each BBMD links into one BACnet network (peers you did not scan are pointed out), and which foreign devices are registered to hear the site's broadcasts.
• Trend logs and schedules, as metadata: what each trend log records, how often, how full, and whether it is still recording; each schedule's weekly programme, default and the objects it controls. New Trends & Schedules tab and report section.
• BACnet/SC detection on TCP 47808 and 47820, HTTPS ports that refuse or serve nothing, and hubs that devices name in their Network Ports. A hub that accepts a BACnet/SC connection without a client certificate is a high-severity finding.
• KNXnet/IP gateways (UDP 3671): name, KNX address, serial, MAC and services. Tunnelling or routing without KNX Secure is a medium finding. --no-knx to skip.
• Niagara stations identified properly: station name, Niagara version, OS, host ID and brand from a complete Fox hello; Fox over TLS on 4911; Niagara AX stations flagged as past end of support.
• Modbus Report Server ID identifies devices that reject Read Device Identification.
• Saved site profiles: Site → Save… in the GUI keeps a building's targets and options; the CLI runs them with --profile "Building A".

Fixes

• Property identifiers above 65535 were sent in two bytes, asking for the wrong property (all the BACnet/SC properties are above 4194303).
• Any web page or banner mentioning "BACnet" was attributed to KMC Controls.
• A comma-separated target list given as one CLI argument disabled unicast discovery and sent a limited broadcast instead of one per subnet.
• A ReadPropertyMultiple value containing a nested context tag 4 was cut short.

Things that behave differently

• Two more passes run by default: BBMD table reads (two read-only BVLL requests per BACnet/IP address; --no-bbmd-tables) and KNX (one UDP request per target; --no-knx).
• Network Port objects are no longer listed as points; they appear in the device details.
• TCP 47808 is now in the service sweep (BACnet/SC on some products).

Only scan networks you own or are authorized to assess.