You re-IP a controller and move it to a different subnet. Which of its three identifiers is unchanged afterward?

Its device instance number. The device instance is the application-layer identity — the number the BMS graphic remembers and the sequence programs against. It doesn't encode topology, so a re-IP or a move can shift the MAC (the data-link IP + port) and the network number, but the instance number stays the same instance number. Only the device instance is forever.

On an MS/TP bus, a device's MAC address is…

a single byte — the station address, 0 to 127. An MS/TP MAC is one byte: the device's RS-485 station address, in the range 0–127. A BACnet/IP MAC, by contrast, is six bytes (four of IPv4 address plus two of UDP port). Both are data-link addresses — the network number and device instance live at higher layers.

How many bytes is a BACnet/IP MAC address (the IPv4 address plus the UDP port)?

6 bytes. Four bytes of IPv4 address plus two bytes of UDP port = six. That's why an EBO hex address of 8 characters (4 bytes) is the IP alone, and 12 characters (6 bytes) carries the port too — C0A80164BAC0 is 192.168.1.100 : 47808.

Which BACnet network number means "broadcast to every network"?

65535. Network 65535 is the global-broadcast network number; network 0 means "the local network, wherever this message originated." Useful, assignable network numbers run 1 to 65534. (47808 is the BACnet/IP UDP port, not a network number — different layer entirely.)

A Who-Is sent on subnet A never reaches devices on subnet B, even though a router connects them. Why?

Routers, by design, do not forward UDP broadcasts.. BACnet leans on UDP broadcasts (Who-Is, I-Am, time-sync), and routers don't forward UDP broadcasts — that's normal IP behavior, not a fault. The fix is a BBMD on each subnet, carrying broadcasts across the L3 boundary as unicast Forwarded-NPDUs and re-broadcasting them on the far side.

Discovery from subnet A finds subnet B's devices, but B can't find A's — no errors anywhere. The two BBMDs' Broadcast Distribution Tables look like this. What's wrong? BDT of BBMD A (192.168.1.10): [ 10.0.5.10 : 47808 ] BDT of BBMD B (10.0.5.10): [ (empty) ]

The BDTs are asymmetric — B's BDT must list A, or B's forwards never reach A.. BDTs have to be symmetric: every BBMD's BDT needs every other BBMD. A's BDT lists B, so A's broadcasts reach B — but B's BDT is empty, so nothing B sees (including the I-Am replies that answer A's Who-Is) ever gets forwarded back. The reverse "silently fails" with no error to grep for. The asymmetric-BDT trap is one of the most common BBMD misconfigurations in the field.

Adding a second BBMD to a subnet that already has one gives you useful redundancy.

False. One BBMD per subnet — no more. Two BBMDs on the same subnet create a broadcast loop: every Forwarded-NPDU arriving from a peer gets re-broadcast by both, each of which the other captures and re-forwards. It's a quiet, persistent storm that scales with the number of peers, usually only caught once a Wireshark capture shows the duplicate frames.

In a Wireshark capture you see a BVLL function byte of 0x04 (Forwarded-NPDU). What does its presence tell you?

A BBMD captured a local broadcast and unicast it across to a peer BBMD.. Healthy local traffic is mostly Original-Unicast-NPDU (0x0A) and Original-Broadcast-NPDU (0x0B). A Forwarded-NPDU (0x04) is the giveaway that a BBMD is doing its job — it captured a broadcast on one subnet and unicast it across the router, carrying the originating IP and port in the BVLL so the source survives. Byte 1 of any BACnet/IP BVLL header is always 0x81.

A VPN-connected workstation could discover devices right after connecting, then quietly stopped a few minutes later — no error message. Most likely cause?

Its Foreign Device Registration TTL expired and wasn't renewed, so the BBMD dropped its FDT entry.. A device with no local BBMD joins via Foreign Device Registration: it sends Register-Foreign-Device with a Time-to-Live, and the BBMD forwards broadcasts to it until the TTL lapses. If the client doesn't re-register before then, the BBMD silently drops the FDT entry and broadcasts stop — no error, no notification. "Worked right after connecting, then stopped" is the signature. Most engineering tools auto-renew; ad-hoc scripts often don't.

An EBO discovery dialog shows a device's BACnet/IP address as this hex string. What is it? C0A8010A

192.168.1.10 at the default port (8 hex chars = IP only). Eight hex characters = four bytes = the IPv4 address alone, with the default port assumed. Byte by byte: C0=192, A8=168, 01=1, 0A=10 → 192.168.1.10, port 47808 (0xBAC0). A 12-character string would append the port; one ending in BAC1 would mean a non-default port (47809). The BACnet/IP Hex Converter does this both ways.

Practice · BACnet Networking

BACnet Networking Quiz BACnet

Read the BACnet Networking lesson first, then test yourself — ten questions on the addressing and broadcast story: the three identifier layers (device instance, network number, MAC), why routers drop broadcasts, the BBMD / BDT machinery and the asymmetric-BDT trap, Foreign Device Registration TTLs, and reading the EBO hex blob. Each reveal links back to the section it came from.

← All practice