BACnet Who-Is Troubleshooting: Why Device Discovery Finds Nothing

You connect to the building network, send a Who-Is, and the device list stays empty. The building is demonstrably running: air handlers modulating, VAVs responding. The devices exist. So why can't your tool see them? In practice the answer is almost never the protocol. It is subnetting, firewalls, or a BBMD you did not know about. This guide explains what Who-Is actually does, then walks a checklist that finds the cause in minutes, with the whole flow runnable from a Mac.

How Who-Is and I-Am Actually Work

Who-Is is BACnet's discovery service, defined in Clause 16.10 of ANSI/ASHRAE Standard 135. It is an unconfirmed request: a client sends it and expects no acknowledgment. It can go out as a global broadcast, or scoped to a range of device instance numbers, and every device whose instance falls in the range answers with an I-Am.

The I-Am reply carries the essentials you map a network with: the device object identifier with its device instance number, the maximum APDU size the device accepts, its segmentation support, and the vendor ID number, which a good tool resolves to the vendor's name. One Who-Is, and you know what is out there and who made it.

On BACnet/IP networks all of this rides on UDP port 47808, written 0xBAC0 in hex. That single fact explains most discovery failures, because UDP broadcasts behave nothing like the TCP connections people are used to.

The Checklist: Who-Is Finds Nothing

Work down this list in order. Each step has a concrete check and a fix.

1. Are you on the same subnet as the devices? IP broadcasts stop at routers. Building automation usually lives on its own VLAN, and corporate Wi-Fi is a different subnet by design. If your Mac is on the office network and the controllers are on the BAS VLAN, a broadcast Who-Is physically cannot reach them. Fix: get your machine onto the BAS network, or use steps 5 and 6.
2. Is a firewall blocking UDP 47808? Discovery needs traffic out and I-Am replies back in. Check the macOS firewall (System Settings, Network, Firewall) and any endpoint security agent. Quick test: temporarily allow incoming UDP 47808, or watch the traffic with sudo tcpdump -i en0 udp port 47808 -n while you send a Who-Is. Outgoing request visible, no replies: a firewall or isolation layer is eating the answers.
3. Is the Wi-Fi isolating clients? Guest and corporate wireless often enable client isolation, which blocks device-to-device packets. Your Who-Is goes out; no device is permitted to answer you. Wired ethernet to the correct VLAN, or a USB ethernet adapter, removes the variable.
4. Is the device-instance range narrowed? Many tools let you scope Who-Is to a range, and yesterday's 0 to 100 filter silently hides every device numbered higher. Reset to the full 0 to 4194303 range before blaming the network.
5. Does the site use a BBMD? On routed BACnet/IP internets, broadcasts only cross subnets if a BACnet Broadcast Management Device is configured to forward them. If the site has one, your client must register as a foreign device with it before a broadcast Who-Is will return anything from other subnets.
6. Can you reach one known device directly? If the BAS contractor gave you even one controller IP, skip broadcast: send a directed unicast request to that address. If unicast works while broadcast fails, the protocol is fine and the problem is pure network plumbing, usually steps 1 through 3.
7. Is the port actually 47808? Some sites run BACnet/IP on a non-default UDP port. If you know the devices answer on another port, set it in the tool. A quiet network with a confirmed-correct port is a common late discovery.
8. Which interface is the tool bound to? A Mac with Wi-Fi, ethernet, and a VPN client active has several addresses. Who-Is may leave on an interface that cannot reach the BAS VLAN. Drop the VPN, prefer wired, and re-send.

Symptoms, Causes, Fixes

Crossing Subnets: BBMD and Foreign Device Registration

IP routers do not forward UDP broadcasts, so a BACnet internetwork needs a device that will. That is the BBMD: it sits on each subnet, and it exchanges forwarded broadcasts with its peers. To join in from a different subnet, your client registers as a foreign device with a BBMD, as KMC Controls' application guide describes: you send the BBMD your address and a lease time, and for the life of that lease the BBMD forwards your broadcasts to its peers and delivers the I-Am replies back to you.

Two Mac-specific gotchas worth knowing. First, the lease: registrations expire, and a Mac that sleeps drops its UDP socket, which kills the registration silently. Re-register when you wake the machine, or use a long lease (600 to 3600 seconds) and let the tool renew in the background. Second, the BBMD itself must be reachable on UDP 47808 from where you are, which fails exactly like everything else on this list.

Doing All of This on a Mac

Nothing above requires Windows. BACnet/IP is plain UDP, macOS sends and receives it natively, and the traditional excuse for the Windows VM, "the BACnet tools only run on Windows", no longer holds. YABE and the classic Windows explorers have native-Mac alternatives now; we compared one of them in BACnet Explorer vs YABE.

The Mac-native flow with MacTools BACnet Explorer maps one-to-one to the checklist:

• Who-Is/I-Am discovery across the full device-instance range, with vendor IDs decoded to vendor names, as covered in the BACnet Explorer for macOS guide.
• Directed unicast to a known device IP when broadcast is blocked, the fastest sanity check there is.
• Pair it with tcpdump when you need packet-level proof of whether your Who-Is left the Mac and whether anything answered. BACnet Explorer has no in-app traffic log, and it does not register as a foreign device with a BBMD.

Once devices are discovered, the next step is reading and writing their objects; the object and property model is explained in BACnet objects and properties.

Frequently Asked Questions

What is a BACnet Who-Is request?

Who-Is is an unconfirmed discovery service defined in ANSI/ASHRAE Standard 135 (Clause 16.10). A client broadcasts it on the BACnet network, optionally scoped to a device-instance range, and every BACnet device that hears it replies with an I-Am carrying its device object identifier, maximum APDU size, segmentation support, and vendor ID.

Why does my BACnet Who-Is find no devices?

The usual causes are network plumbing, not the protocol: your computer is on a different subnet or VLAN than the devices (IP broadcasts do not cross routers), a firewall is blocking UDP port 47808, the Wi-Fi has client isolation enabled, the tool is filtering to a narrowed device-instance range, or the site routes BACnet through a BBMD that requires foreign-device registration before it will forward your Who-Is.

What port does BACnet discovery use?

BACnet/IP uses UDP port 47808 decimal, written 0xBAC0 in hexadecimal. Discovery is a broadcast on that port, and devices send their I-Am replies back on it too. Some sites configure a non-default port, so it is worth confirming with the building's integrator.

How do I discover BACnet devices on another subnet?

Two ways. If a BBMD exists on the remote subnet, register as a foreign device with the BBMD's IP address, port, and a lease time; the BBMD then forwards your broadcasts and returns the I-Am replies. If you already know a device's IP address, skip broadcast entirely and send a directed unicast request straight to that device.

Can I do BACnet device discovery from a Mac?

Yes. BACnet/IP is plain UDP, which macOS handles natively, so discovery needs no Windows tool or virtual machine. MacTools BACnet Explorer ($29 one-time) runs Who-Is/I-Am discovery by broadcast on your local subnets and can connect to a known device by IP address, all natively on macOS. It does not register as a BBMD foreign device.