Port reference
Port 47808 (UDP) – BACnet
BACnet/IP — building-automation protocol controlling HVAC, lighting, and access via device and object properties.
Quick facts
- Transport
- udp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on BACnet/IP controllers and BAS devices (HVAC, lighting), with no authentication on the protocol.
What is port 47808 used for?
Port 47808 (hex 0xBAC0) hosts BACnet/IP, the most common protocol for building automation — HVAC, lighting, access control, and energy management. Building management systems and controllers from vendors like Siemens, Honeywell, Johnson Controls, and Schneider Electric use it to discover devices and read or adjust things like temperature setpoints. It runs over UDP and relies on broadcasts, often linked across subnets by a BBMD device.
When would you open it?
This port belongs on the building automation (BAS/OT) network that connects your controllers and management workstations. Allow it only within that controlled network, and use a BBMD to bridge subnets where needed. It should never be reachable from the internet or from general office Wi-Fi.
Is it safe to open?
Standard BACnet/IP has no authentication, so anyone who reaches it could read building data or change setpoints; keep it on an isolated network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :47808
nmap -sU -p 47808 <target>netstat -ano | findstr :47808
Test-NetConnection <host> -Port 47808 # TCP onlylsof -i :47808
nmap -sU -p 47808 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 47808 to your device's local IP, internal port 47808, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 47808/udpsudo firewall-cmd --permanent --add-port=47808/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 47808 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 47808" -Direction Inbound -Protocol UDP -LocalPort 47808 -Action AllowSecurity & risks
Common attacks
- Device and object enumeration via Who-Is / bacnet-info
- Unauthorized ReadProperty disclosure of building configuration
- WriteProperty abuse to change setpoints and outputs
- Denial of service against controllers via malformed APDUs
Hardening
- Never expose port 47808 to the internet — isolate BACnet on an OT/BAS network
- Segment with firewalls and restrict broadcasts (BBMD scope)
- Use BACnet/SC (Secure Connect) where devices support it
- Monitor with an ICS IDS for unexpected WriteProperty traffic
How to block this port
sudo ufw deny 47808/udpsudo firewall-cmd --permanent --remove-port=47808/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 47808 -j DROPNew-NetFirewallRule -DisplayName "Block 47808" -Direction Inbound -Protocol UDP -LocalPort 47808 -Action Blocknmap snippet
nmap -sU -p47808 --script bacnet-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does BACnet have authentication?
- Classic BACnet/IP has no real authentication or encryption, so any host reaching UDP 47808 can enumerate devices and read or write object properties. BACnet/SC (Secure Connect) adds TLS-based security but is not yet widely deployed.
- What can an attacker do over BACnet?
- They can discover controllers with Who-Is, read building configuration via ReadProperty, and use WriteProperty to change HVAC setpoints, override outputs, or disrupt comfort and safety systems in a building.