What are BACnet Who-Is and I-Am?

Updated 4 November 2026

The exchange

On BACnet IP a Who-Is goes to the subnet's broadcast address on UDP 47808, so every device on that subnet gets it at once. A Who-Is can be unconstrained (everyone answer) or carry a low and high instance limit, which is how a head-end asks for device 20114 alone without hearing from the whole building. Many devices broadcast their I-Am back rather than replying only to the sender, which is why a busy site's I-Ams are seen by every tool on the subnet.

What an I-Am carries

• Device Instance — the device's number, which has to be unique across the whole BACnet internetwork, not just the subnet. Two devices sharing one makes discovery and reads unreliable: see BACnet Device IDs explained.
• Max APDU length accepted and segmentation supported — the largest message the device takes (50 to 1476 bytes; small MS/TP controllers are often 480 or less) and whether it can split a long reply into segments. A tool uses these to decide how to read; Easy BACnet reads one property at a time, so it works with devices that support neither.
• Vendor ID — the ASHRAE-assigned number for the manufacturer. Look any number up with our BACnet Vendor ID lookup.

The source address of the I-Am matters too. A device behind a BACnet router answers through the router, so its reply comes from the router's IP with a network number and MAC address inside the BACnet header.

Why a scan sometimes finds nothing

Who-Is is a broadcast, and IP routers do not forward broadcasts, so a device on a different subnet never hears it unless a BBMD carries it across. That is the usual reason a scan comes back empty: see why can't I find my BACnet IP devices?. Devices on an MS/TP trunk answer too, because the BACnet router passes the Who-Is down the trunk and the I-Ams back up. Some devices also answer badly or late, so Easy BACnet repeats the Who-Is through the scan and, if nothing answers, probes the subnet's addresses directly.