Is port 47808 (BACnet/IP) exposed to the internet?

What’s listening on 47808

BACnet/IP is the IP-based variant of BACnet, the industry-standard protocol for building automation — HVAC controllers, lighting schedules, fire and life-safety monitoring points, and access-control door controllers from different manufacturers all use it to interoperate on the same network. CISA’s Internet Exposure Reduction Guidance names port 47808 directly among the ports building and industrial operators should not expose to the internet.

Why it has no authentication, and what that means if it’s reachable

BACnet’s original 1995 design assumed a physically isolated building network where every device on the wire was already trusted — there’s no concept of a username, password or permission check anywhere in the base protocol. BACnet Secure Connect (BACnet/SC) later added an optional encrypted, certificate-authenticated transport, but it’s additive: the large majority of deployed BACnet/IP installations still run the original, unauthenticated version. If port 47808 is reachable from the internet, anything that can send it a UDP packet can typically read and write points on the building network — changing HVAC setpoints, disabling alarms, or manipulating access-control points — with nothing checking who’s asking. BACnet’s lack of built-in authentication isn’t unique to building automation: SNMP, used for monitoring routers and switches, has the same problem, relying on a default plaintext “community string” instead of a real credential — see is port 161 (SNMP) exposed.

How a building network ends up exposed

It’s almost never a deliberate choice. A building’s BACnet segment gets bridged to the general IT network for remote monitoring or vendor support convenience, and a misconfigured firewall rule or remote-access tool added for one purpose ends up reaching further than intended.

How to check and fix it

AdminKit’s planned open ports check is designed to test whether UDP port 47808 on your own public IP responds from outside your network. If it does: segment the BACnet network behind its own firewall, remove any rule that exposes 47808 directly to the internet, and if remote access is genuinely needed, put it behind a VPN or a purpose-built OT remote-access tunnel rather than a raw forwarded port. Our full guide, BACnet/IP exposure in building automation, walks through all of this in more depth, including how BACnet/SC changes the picture for newer installations.

Defensive use only

Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.