BAC Building Automation Utility

BACnet/IP BVLC & NPDU Decoder

Decode classic BACnet/IP hexadecimal packets into BVLC and NPDU fields, including BVLC function and length, BACnet network addressing, hop count, message priority, network-layer message type and application payload bytes.

✓ BVLC ✓ NPDU ✓ DNET / DADR ✓ SNET / SADR ✓ Hop Count ✓ APDU

B/IP

BVLC & NPDU Structure Decode

● Ready

BACnet/IP Hex Bytes Enter one complete classic BACnet/IPv4 BVLC message beginning with 0x81. Spaces, commas, colons, hyphens, 0x-prefixed bytes and continuous hexadecimal input are supported.

BVLC rule: classic BACnet/IPv4 uses BVLC Type 0x81. The two-byte BVLC length field is big-endian and includes the complete BVLC message, including the four-byte BVLC header.

BACnet/IP Decode Result Decoded

Decoded BACnet/IP Packet —

BVLC Type —

BVLC Function —

Declared Length —

Total Bytes —

Originating Device —

NPDU Version —

NPDU Control —

Priority —

DNET —

DADR —

SNET —

SADR —

Hop Count —

Expecting Reply —

Network Message —

Payload Bytes —

Remaining APDU / Network Payload

—

Packet Breakdown

—

What Is BACnet/IP?

BACnet/IP carries BACnet building-automation communication across IP networks. Classic BACnet over IPv4 uses the BACnet Virtual Link Layer, commonly called BVLL, above UDP.

The BVLC portion identifies how the packet is being transported, while the BACnet NPDU carries network-routing information and either an application APDU or a BACnet network-layer message.

BACnet/IP BVLC Structure

Byte 0
BVLC Type

Byte 1
BVLC Function

Bytes 2–3
BVLC Length

Bytes 4...
Function-specific data or NPDU

Classic BACnet/IPv4 normally uses BVLC Type 0x81. The length field uses network byte order, meaning the high byte appears first.

Common BACnet BVLC Functions

Code	Function
0x00	BVLC-Result
0x01	Write-Broadcast-Distribution-Table
0x02	Read-Broadcast-Distribution-Table
0x03	Read-Broadcast-Distribution-Table-Ack
0x04	Forwarded-NPDU
0x05	Register-Foreign-Device
0x06	Read-Foreign-Device-Table
0x07	Read-Foreign-Device-Table-Ack
0x08	Delete-Foreign-Device-Table-Entry
0x09	Distribute-Broadcast-To-Network
0x0A	Original-Unicast-NPDU
0x0B	Original-Broadcast-NPDU

Original-Unicast-NPDU

An Original-Unicast-NPDU uses BVLC function 0x0A. The BACnet NPDU begins immediately after the four-byte BVLC header.

81 0A 00 0A ...

81
BACnet/IPv4 BVLC

0A
Original-Unicast-NPDU

00 0A
10-byte BVLC message

Original-Broadcast-NPDU

BVLC function 0x0B identifies an Original-Broadcast-NPDU. It carries a BACnet NPDU that is being transmitted using the BACnet/IP broadcast mechanism.

Forwarded-NPDU

A BACnet Broadcast Management Device can forward broadcasts between BACnet/IP networks. Function 0x04 contains an additional six-byte originating BACnet/IP address before the NPDU.

IPv4 Address
4 bytes

UDP Port
2 bytes

Then:
BACnet NPDU

The commonly used BACnet/IP UDP port is 47808 decimal, or 0xBAC0.

BACnet NPDU Control Byte

Bit 7
Network-layer message

Bit 5
Destination specified

Bit 3
Source specified

Bit 2
Expecting Reply

Bits 1–0
Message Priority

The decoder reads optional address fields only when their corresponding control bits are present.

BACnet Message Priority

Value	Priority
0	Normal
1	Urgent
2	Critical Equipment
3	Life Safety

DNET, DLEN and DADR

When NPDU destination addressing is enabled, DNET identifies the destination BACnet network. DLEN indicates the number of destination MAC-address bytes and DADR contains those bytes.

DNET
2 bytes

DLEN
1 byte

DADR
DLEN bytes

Hop Count
1 byte

DNET 0xFFFF represents the BACnet global broadcast network.

SNET, SLEN and SADR

When source addressing is present, SNET contains the source BACnet network number, SLEN specifies the source address length and SADR contains the source MAC-layer address.

These fields are useful for routed BACnet traffic crossing one or more BACnet networks.

BACnet Hop Count

When destination network information exists, the NPDU contains a one-byte hop count. BACnet routers use this field to restrict forwarding loops and excessive routing.

BACnet Network-Layer Messages

If bit 7 of the NPDU control byte is set, the bytes following NPDU addressing contain a network-layer message rather than an application APDU.

Code	Message
0x00	Who-Is-Router-To-Network
0x01	I-Am-Router-To-Network
0x02	I-Could-Be-Router-To-Network
0x03	Reject-Message-To-Network
0x04	Router-Busy-To-Network
0x05	Router-Available-To-Network
0x06	Initialize-Routing-Table
0x07	Initialize-Routing-Table-Ack
0x08	Establish-Connection-To-Network
0x09	Disconnect-Connection-To-Network
0x12	What-Is-Network-Number
0x13	Network-Number-Is

BACnet APDU Payload

When the NPDU is not a network-layer message, the remaining bytes belong to the BACnet application layer. APDU interpretation depends on the PDU type and BACnet service.

This tool deliberately preserves those bytes rather than guessing object identifiers, property values or service parameters that require a separate BACnet APDU decoder.

BACnet/IP BVLC & NPDU Decoder FAQs

What is BACnet BVLC Type 0x81?

0x81 identifies the classic BACnet/IPv4 Virtual Link Layer format.

Does the BVLC length include the header?

Yes. BVLC Length includes the Type, Function and two-byte Length field.

What is Original-Unicast-NPDU?

It is BVLC function 0x0A and carries a BACnet NPDU to a unicast BACnet/IP destination.

What is Original-Broadcast-NPDU?

It is BVLC function 0x0B and carries a BACnet broadcast NPDU.

What is Forwarded-NPDU?

It is BVLC function 0x04 and contains the original source IPv4 address and UDP port before the NPDU.

What does DNET mean?

DNET is the BACnet Destination Network Number.

What does SNET mean?

SNET is the BACnet Source Network Number.

What is BACnet/IP port 47808?

47808 decimal equals hexadecimal 0xBAC0 and is the commonly used default BACnet/IP UDP port.

Does this decoder parse BACnet application values?

No. It structurally decodes BVLC and NPDU and preserves the application APDU bytes for separate application-layer analysis.

Does this decode BACnet/SC?

No. BACnet Secure Connect uses different transport and framing. This tool is for classic BACnet/IPv4 BVLC Type 0x81.

Decode BACnet/IP BVLC and NPDU Packets

Inspect BACnet virtual-link functions, routed network addresses, message priority, hop count, network-management messages and application payload bytes directly from raw hexadecimal BACnet/IP traffic.