UDP/47808 is the default UDP port commonly used by BACnet/IP for device communication over IP networks. It carries BACnet application traffic and broadcast handling on UDP, so firewall rules and segmentation around that port affect discovery and control traffic.
What UDP/47808 Means in BACnet/IP Deployments
UDP/47808 is not just a port number, it is the default transport point that many BACnet/IP networks use for device discovery, broadcast handling, and control traffic. Because that traffic often sits close to building automation functions, the port becomes part of the trust boundary between enterprise networks and operational technology.
In practical terms, the port helps BACnet devices find one another and exchange application data over IP. That makes it a convenience for interoperability, but it also means the network path around the port can expose broadcasts, service discovery, and control messages to any host that can reach it.
Why This Port Matters for Building Automation Security
BACnet/IP environments are often long-lived and heterogeneous, with controllers, gateways, supervisory systems, and engineering workstations from different vendors. A single open UDP service can therefore become a shared dependency for both routine operations and maintenance access, which makes the port an important part of segmentation design.
Because BACnet traffic may include broadcast-heavy communication, careless routing or overly broad firewall allowances can unintentionally extend visibility across segments. That can weaken separation between business IT and building systems, and it can make it easier for an attacker or a misconfigured host to interact with devices that were assumed to be isolated.
Exposure, Discovery, and Control-Plane Concerns
Exposure usually starts with simple reachability. If UDP/47808 is open beyond the intended building automation segment, scanning, device discovery, and unsolicited traffic can reveal BACnet services and potentially map the operational environment. A useful reference for the wider protocol and migration context is the BACnet and BACnet Secure Connect Guide, which covers BACnet/IP attack paths, BACnet/SC hubs, and monitoring patterns.
Even when the protocol itself is working as designed, broadcast handling can create control-plane noise that is easy to overlook. That matters because the same reachability that supports discovery can also support unauthorized probing, segmentation bypass attempts, or manipulation of building control traffic if other safeguards are weak.
How Organisations Should Think About Remediation and Hardening
Security work around UDP/47808 is usually less about the port alone and more about the design around it. The core questions are whether the port is reachable only where BACnet is required, whether broadcasts are constrained to the right zone, and whether legacy BACnet/IP exposure should be reduced through stronger segmentation or migration to more controlled designs.
Practitioners also need to review whether devices that still depend on this port are using compensating controls such as strict network ACLs, dedicated building VLANs, ingress filtering, and monitoring for unusual BACnet traffic patterns. In environments that are moving toward BACnet Secure Connect, the aim is to preserve interoperability while reducing the risk created by unauthenticated or overly exposed UDP communications.
Risk and Threat Considerations
UDP/47808 can become a high-value exposure point because it often supports discovery and command traffic for building systems. If it is left broadly reachable, an attacker may be able to enumerate BACnet devices, observe operational patterns, or reach control functions that were never meant to be exposed outside the building network.
Failure mechanism: Weak segmentation or permissive firewalling allows broadcast and device-management traffic to cross trust boundaries, which turns a convenience port into an attack surface for reconnaissance and unauthorised interaction.
Impact: The result can be loss of confidentiality around the building environment, disruption of control workflows, and in some cases indirect operational impact on HVAC, access, or safety-related systems that depend on BACnet communications.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | BACnet/IP exposure over UDP/47808 is governed by boundary controls and segmentation. |
| AC-4 — Information Flow Enforcement | The port carries control traffic whose flow must be constrained between zones and devices. | |
| Recommendation — Restrict UDP/47808 to approved building automation boundaries and block unnecessary cross-zone reachability. Enforce approved BACnet information flows so discovery and control traffic stay within intended segments. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | The subject depends on network segmentation, rule management, and exposed service control. |
| CIS-13 — Network Monitoring and Defense | Monitoring is needed to detect anomalous BACnet traffic and unexpected exposure patterns. | |
| Recommendation — Inventory and harden network paths that expose UDP/47808 and remove unneeded reachability. Monitor UDP/47808 flows for unusual BACnet discovery, scanning, or cross-segment activity. | ||
| NIST CSF 2.0 | PR.PS-01 — Configuration Management | BACnet port exposure is a configuration and segmentation decision affecting secure operation. |
| Recommendation — Configure BACnet rules and segmentation so UDP/47808 is enabled only where required. | ||
Practitioner Guidance
Why practitioners should care: UDP/47808 is often treated as a simple allow rule, but it represents a protocol pathway that can reveal and connect critical building assets. The right decision is not merely whether the port is open, but where it is open and how far BACnet broadcasts can travel.
What to watch for: Review firewall rules, routing boundaries, and any exceptions that permit broad UDP access to BACnet segments. Also watch for unexpected BACnet traffic outside the normal building automation zone, because that often indicates misconfiguration, overexposure, or early-stage probing.
Practitioner takeaway: Treat UDP/47808 as part of the building control trust boundary, not as a routine network port, and design the surrounding segmentation accordingly.
Related resources from NHI Mgmt Group
- What is the difference between UDP, TCP, and TLS transport for syslog?
- Why does traditional RADIUS create more risk when it relies on UDP and weak shared-secret protection?
- What do teams get wrong about spoofed monitoring traffic in UDP-based systems?
- How should security and observability teams reduce log pipeline bottlenecks when a few UDP senders dominate traffic?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org