Works offline. Every calculation runs on your device, no signal needed. Install the BAS Field Reference app to keep it on your phone.

Filter type to narrow the list

Port	Protocol / platform
UDP 47808	BACnet/IP (0xBAC0). The standard. Sites with multiple BACnet networks sometimes use 47809 and up.
TCP 502	Modbus TCP. Wireshark's dissector is bound to this port — on anything else you need Decode As.
TCP 802	Modbus over TLS. Less common but part of the spec.
TCP 4840	OPC UA. Not a hard default — confirm the endpoint URL with the server owner.
TCP 1911	Niagara Fox, unencrypted. Should not be exposed to the internet.
TCP 4911	Niagara FoxS, TLS-secured. The modern expectation.
TCP 443	BACnet/SC and general HTTPS. SC rides WebSockets over TLS.
TCP 80 / 443	Device and gateway web configuration interfaces.
UDP 161 / 162	SNMP and SNMP traps — common on power meters and network gear.
TCP 22	SSH. Sometimes the only way into a JACE or a Linux-based gateway.
TCP 21	FTP. Still found on older gateways for configuration upload.
UDP 67 / 68	DHCP. Relevant when a controller unexpectedly changes address.
UDP 123	NTP. Matters more than people expect — OPC UA fails on clock drift.

How to use it

Use this when requesting firewall rules — IT will want the specific port and transport.
Also useful in reverse: if a scan shows one of these open, you know what's running.
Always confirm against the actual device. Ports are configurable and plenty of sites don't use defaults.

Go deeper

These tools come out of the book — a field reference for BACnet, Modbus, LonWorks, OPC UA and the diagnostic method that works across all of them.

Found a wrong number or a broken link? Tell me and I’ll fix it.

BAS Port and Protocol Reference