BACnet/IP: A Packet-Level Study of Objects, Priority Arrays, and Event Services

The article provides an in-depth examination of the BACnet/IP protocol, focusing on its unique object-oriented design, priority arbitration system, and event-driven notification services. Traditional industrial control systems (ICS) have relied on register-based protocols, but BACnet represents automation systems as a distributed object database.

This object model includes sensors, actuators, schedules, alarms, trend logs, and even the controller itself, each with standardized properties that describe configuration, state, and behavior.

In contrast to register-based systems, BACnet does not expose operational state through memory locations. Instead, every device operates as an object-oriented application server, with each component represented as an object instance. Clients interact with objects through a collection of typed properties, rather than dealing with memory addresses. For example, reading an Analog Input's current value involves requesting the Present_Value property of a specific object instance.

To understand BACnet, one must grasp how the protocol organizes information internally and how its architectural components interact. This article presents a packet-level analysis of these mechanisms using an isolated BACnet/IP laboratory built around an open-source bacnet-stack implementation. By manually assembling BACnet Virtual Link Layer, Network Protocol Data Unit, and Application Protocol Data Unit structures using custom Python research harnesses, the experiments in four complementary phases - Object Model & Property Engine, Priority Array Arbitration, Routing, BBMD & Network Traversal, and Change of Value & Event Services & Secure Connect - provide a practical view of how the protocol operates beyond its formal specification, without seeking to discover vulnerabilities or evaluate commercial implementations.