HVAC Network Scanner Files

Fixes from an external review of 2.9.0: what a broken or hostile device could do to a scan, where the scanner was less gentle than it should be, and what the exports left unsaid. Full details in CHANGELOG.md (github.com). The project now has a website: jamesccupps.github.io/HVAC-Network-Scanner.

Download

HVACNetworkScanner.exe — the GUI as one file, no Python needed. Built by GitHub Actions from the v2.9.1 tag (build log), with PyInstaller and its dependencies pinned by hash.

SHA-256  607926862AD631E6C65D76BBCB23BE81E6D5F95BB10EAD46CF8E88C08CD48F31

Check it before running (the same hash is in HVACNetworkScanner.exe.sha256):

:::powershell
Get-FileHash .\HVACNetworkScanner.exe -Algorithm SHA256

New in this release: the build signs an attestation that this exact file came from that workflow run and commit. With the GitHub CLI:

:::powershell
gh attestation verify .\HVACNetworkScanner.exe --repo jamesccupps/HVAC-Network-Scanner

The executable is not code-signed, so Windows SmartScreen will say "Windows protected your PC" — use More info → Run anyway once the hash matches. If Windows Firewall asks, allow it on the networks you scan: BACnet replies to a broadcast are dropped otherwise.

Security

• One oversized number from any host no longer ends the scan. An I-Am or SNMP reply with an integer too large to print used to empty the whole BACnet or SNMP pass, or break every export.
• Spreadsheet formulas in device names are neutralised in both CSVs and the Ctrl+C copy. BACnet names can be changed by anyone on the network; a point renamed =HYPERLINK(...) used to run as a formula in the point list.
• Terminal escape sequences in device text no longer reach the log.
• The classification report (meant for public issues) no longer holds addresses, instance numbers or names, and a site's own SNMP community is exported only as (custom).

Gentler on the building

• UDP 47808 is never shared with BACnet software already running on the PC; the scanner used to split a front-end's traffic with it, dropping its replies and alarms.
• Batched reads are sized to what each device can send back, so small MS/TP controllers no longer abort and get read one index at a time.
• At most two connection attempts to a host at once; Modbus probing of an absent unit behind a gateway stops at the first timeout.
• The MS/TP address probe goes two at a time, waits at least three seconds and keeps to the rate limit. BBMD registration (opt-in, the one write the scanner makes) is capped at 300 seconds.
• Object counts in the billions, I-Am floods, Modbus servers that never finish a reply and services that trickle their banner are all bounded.

Fixed

• Exports say what was not scanned: the JSON has a coverage block and the report shows "Not scanned" instead of "None" for passes that were off, failed or stopped.
• Chunked Who-Is covers the whole instance range (it used to give up after ten empty chunks); wide subnets broadcast correctly.
• The baseline is read before scanning and isn't replaced after a partial scan; a damaged settings file is set aside instead of erasing saved sites; the diff keeps devices with duplicate instance numbers apart and reports them.
• Vendor names match whole words ("webs" in GoAhead-Webs is no longer Tridium).
• CLI: flags you give always beat a saved profile, new --max-hosts, bad values and argument errors exit 1. GUI: no prefilled target, a question before scanning more than 1,024 addresses, the Advanced button counts changed settings, and a mistyped number stops the scan instead of falling back to full speed.

Only scan networks you own or are authorized to assess.