BAS Field Reference Practice Tools Learn Books Troubleshoot

Simulators › BACnet/SC Capture Lab

BACnet/SC Capture Lab

BACnet Secure Connect moves BACnet into encrypted TLS connections to a hub. That’s great for security and hard on troubleshooting: most of what you used to read in a capture is now “Application Data”. Learn what an SC connection looks like, what you can still see without keys, how to decrypt with a key log when you have one, and how to find expired certificates, untrusted CAs, firewall drops, TLS inspection, idle timeouts, failover and duplicate VMACs.

  1. Read the work order
  2. Work the capture: the connection pattern first, then decrypt if you can
  3. Make the call: what broke and how you know
0 of 11 scenarios practiced

Choose a scenario

BACnet/SC in five minutes

Hub and spoke: nodes make outbound TLS connections to a primary hub and fall back to a failover hub Primary hubhub function Failover hubused if primary is down Supervisor AHU-1 AHU-2 SC ↔ BACnet/IPor MS/TP router every link: wss:// over TLS 1.3, certificates both ways
Every node connects out to the hub. The hub forwards unicast between nodes and copies broadcasts (like Who-Is) to all of them. No UDP broadcasts, no BBMDs.
  1. DNS for the hub name in the URI (if it uses a name).
  2. TCP to the URI’s port (no standard port; 443 is common).
  3. TLS 1.3: Client Hello (hub name in clear), Server Hello, then everything is encrypted, including both certificates.
  4. WebSocket upgrade with Sec-WebSocket-Protocol: hub.bsc.bacnet.org.
  5. Connect-Request / Connect-Accept: the node’s VMAC and device UUID.
  6. Encapsulated-NPDU: ordinary BACnet inside. Heartbeats keep quiet connections alive.
What you seeWithout a key logWith a key log
TCP handshake, resets, retransmissionsYesYes
Hub name (SNI) in the Client HelloYesYes
Certificates, TLS alertsNo (TLS 1.3 encrypts them)Yes
WebSocket upgrade, BVLC-SC messages, BACnetNo: “Application Data”Yes

Key logs come from software hubs and test tools; most controllers can’t write one. So every scenario teaches the pattern you can read without keys first. Background: How BACnet/SC works · Troubleshooting BACnet/SC · SC certificates · Cybersecurity section

TutorialThe next menu, row or field to use is outlined, and a bubble explains it. The lesson moves on when you do it in the window.
PracticeSame capture, no outlines. Collect the findings with up to three hints each (hints cost points), then make the call.
What’s realReal Wireshark display-filter names for TCP, TLS, DNS, HTTP, WebSocket and BACnet/SC (bscvlc). Captures are built for training.

Scenarios Learning SC, network path, certificates, hubs and migration

    Protocols, method and the IT conversation

    BAS Communication: A Field Reference covers BACnet, Wireshark for BAS work and the layer-by-layer method used here. Free reading: Planning a BACnet/SC rollout and Talking to IT about the BAS network.

    Buy on Amazon