Wireshark Display Filters for BACnet

Why BACnet Wireshark Filters Matter

A typical building automation network carries far more than just BACnet. ARP broadcasts, DNS queries, DHCP renewals, web traffic from supervisory workstations, and sometimes IT infrastructure traffic all share the same wire. Without proper display filters, a technician staring at a raw Wireshark capture is searching for a needle in a haystack. The right filters strip away the noise and surface only the BACnet conversations that matter for troubleshooting.

Wireshark ships with a built-in BACnet dissector that decodes three protocol layers: BVLC (BACnet Virtual Link Control, the BACnet/IP transport header), BACnet NPDU (Network Protocol Data Unit, the network layer), and bacapp (BACnet APDU, the application layer where services like ReadProperty and Who-Is live). Understanding which layer to filter on is the key to efficient packet analysis.

Essential BACnet Wireshark Display Filters

These are the filters every BAS technician should know. Copy them directly into the Wireshark display filter bar and press Enter or click Apply.

Filtering by BACnet Service Type

BACnet services fall into two categories: confirmed services (which require a response) and unconfirmed services (fire-and-forget). Wireshark uses separate filter fields for each: bacapp.confirmed_service and bacapp.unconfirmed_service. The values correspond to the service choice numbers defined in ASHRAE 135.

Unconfirmed Services

Confirmed Services

Tip: To see Who-Is and I-Am together (a common troubleshooting pair), combine them:

bacapp.unconfirmed_service == 8 || bacapp.unconfirmed_service == 0

Filtering by Device or Object

When you need to narrow a capture down to a specific controller or a particular object, Wireshark's BACnet dissector provides fields for object type and instance number.

By Object Type

The bacapp.objectType field filters packets by BACnet object type. Common values:

By Instance Number

Use bacapp.instance_number to target a specific object instance. For example, to find all traffic referencing Device instance 12345:

bacapp.objectType == 8 && bacapp.instance_number == 12345

To find all ReadProperty requests targeting Analog Input 1:

bacapp.confirmed_service == 12 && bacapp.objectType == 0 && bacapp.instance_number == 1

By IP Address

When you know the IP of a specific controller, combine a standard Wireshark IP filter with a BACnet filter:

ip.addr == 192.168.1.100 && bacapp

Use ip.src or ip.dst instead of ip.addr if you only want to see traffic originating from or destined to that address. This is particularly helpful when debugging one-way communication failures where a controller sends requests but never receives responses (or vice versa).

Advanced BACnet Wireshark Filter Combinations

Compound filters are where Wireshark becomes a precision tool. These examples address real-world BAS troubleshooting scenarios.

Find Unanswered Who-Is Broadcasts

If a device sends Who-Is but never gets an I-Am back, it cannot discover its peers. This is one of the most common BACnet troubleshooting scenarios—a controller that should appear in a device list simply does not respond. Filter for both Who-Is and I-Am traffic, then compare timestamps and source addresses to determine which devices are replying and which are silent:

bacapp.unconfirmed_service == 8 || bacapp.unconfirmed_service == 0

After applying this filter, sort by the Info column. You should see Who-Is requests followed by I-Am responses from each device on the network. A device that never sends an I-Am is either offline, misconfigured, on a different subnet without proper BBMD routing, or blocked by a firewall.

Isolate WriteProperty to a Specific Controller

ip.dst == 192.168.1.50 && bacapp.confirmed_service == 15

Find BACnet Errors and Rejects

BACnet error and reject APDUs indicate a device refused or could not process a request:

bacapp.type == 5 || bacapp.type == 6 || bacapp.type == 7

These values correspond to APDU types: 5 = Error, 6 = Reject, 7 = Abort. If you see a high volume of these, something is misconfigured.

BBMD and Foreign Device Registration

To troubleshoot cross-subnet BACnet/IP routing, filter for BBMD-specific BVLC functions:

bvlc.function == 0x05

This shows Register-Foreign-Device messages. Other useful BVLC function values:

Excessive COV Notifications

A chatty device flooding the network with Change of Value notifications can degrade BAS performance and overwhelm controllers with limited processing power. COV subscriptions that fire too frequently—often due to noisy sensor inputs or overly tight COV increments—are a common source of network congestion. Filter for both confirmed and unconfirmed COV traffic:

bacapp.confirmed_service == 1 || bacapp.unconfirmed_service == 2

Use Wireshark's Statistics > I/O Graphs feature after applying this filter to visualize COV notification rates over time. Spikes may correlate with specific devices or time-of-day events.

Exclude Noisy Services

Sometimes you want to see everything except a high-volume service. To exclude Who-Is and I-Am from the display:

bacapp && !(bacapp.unconfirmed_service == 8 || bacapp.unconfirmed_service == 0)

Common Mistakes

Capture Filters vs. Display Filters

This is the most common source of confusion for technicians new to Wireshark. The application has two completely separate filter systems with incompatible syntax. Capture filters (set before recording begins, in the capture options dialog) use Berkeley Packet Filter (BPF) syntax—the same syntax used by tcpdump. Display filters (applied after recording, in the filter bar at the top of the main window) use Wireshark's own protocol-aware syntax. All the filters on this page are display filters.

If you want to restrict what Wireshark records to only BACnet/IP traffic, set this capture filter before starting the capture:

udp portrange 47808-47823

Do not paste bacnet or bacapp into the capture filter field—those are display filter names and will cause a syntax error.

Using "bacnet" Alone and Missing Application Data

The filter bacnet only matches the NPDU layer. Some BACnet packets (particularly those from BBMDs) may only register under the bvlc filter. For complete visibility, always use bvlc || bacnet || bacapp.

Wrong Comparison Operators

Wireshark display filters use == for equality, not =. Writing bacapp.confirmed_service = 12 will fail. The correct syntax is bacapp.confirmed_service == 12.

Forgetting Boolean Operator Syntax

Wireshark accepts both C-style and English-style operators. These pairs are equivalent:

• && or and
• || or or
• ! or not

Both work, but be consistent within a single filter expression to keep it readable.

Non-Standard Port Numbers

If BACnet/IP is running on a port other than 47808, Wireshark may not automatically decode it as BACnet. Right-click a packet, select Decode As, and set the UDP port to use the BACnet dissector. Only then will bacnet, bacapp, and bvlc filters work on that traffic.

Platform and Version Compatibility

The BACnet dissector has been part of Wireshark since its early releases. All display filters listed on this page work with Wireshark 2.x, 3.x, and 4.x on Windows, macOS, and Linux. The dissector covers BACnet/IP natively. For BACnet MS/TP captures (serial-based), you need a dedicated MS/TP-to-Wireshark capture tool (such as an Optigo BACnet Capture device or a compatible RS-485 adapter with capture firmware) that converts MS/TP frames into a pcap-compatible format. Once imported, the same bacnet and bacapp display filters apply to MS/TP traffic. The MS/TP-specific filter prefix mstp provides additional fields for MS/TP frame analysis.

To verify your Wireshark version supports a specific filter field, type the field name into the display filter bar. Wireshark will show a green background if the field is valid, or red if it is unrecognized.

Source Attribution

• Wireshark Display Filter Reference: BACnet APDU (bacapp)
• Wireshark Display Filter Reference: BACnet NPDU
• Wireshark Display Filter Reference: BVLC
• Wireshark Wiki: BACnet Protocol Page
• Optigo Networks: How to Filter for BACnet Data in Wireshark
• Events2HVAC: Using Wireshark to Troubleshoot BACnet
• Wireshark BACnet APDU Dissector Source (packet-bacapp.c) — authoritative reference for service choice values