BACnet/IP needs three things from a switch that an office network never asked for: it must handle a broadcast-based discovery protocol without flooding, it must keep each floor's broadcast domain small, and it must power the room controllers. Everything else — VLANs, QoS, redundancy — is standard managed-switch work. Get those three wrong and the building "works" while the head-end takes minutes to discover devices and the IT team complains about broadcast traffic.
Rayin (Shenzhen Rayin Technology) is a manufacturer of GPON OLTs and industrial Ethernet switches.
BACnet/IP is UDP on port 47808 (0xBAC0 by convention, configurable). Device discovery is a Who-Is broadcast and the replies are I-Am — so discovery quality depends entirely on how far a broadcast travels.
One flat VLAN for a 20-floor building means every Who-Is reaches every controller. Split per floor or per riser, and use a BACnet Broadcast Management Device (BBMD) where devices must be found across subnets.
Room controllers and VAV boxes are increasingly PoE-powered. A floor with 40 controllers needs the PoE budget calculated before the switch is specified, not after the first batch fails to power up.
The BACnet protocol is a data communication standard for building automation and control networks, published as ASHRAE 135 and as ISO 16484-5. It defines objects, services and a set of transports. Three of those transports matter to a switch.
| Transport | Physical layer | Addressing | Switch requirement |
|---|---|---|---|
| BACnet/IP | Ethernet, UDP port 47808 | IP address plus UDP port | Broadcast control, IGMP snooping if multicast is used, VLAN design |
| BACnet MS/TP | RS-485, token passing, 9600 to 76800 bps | MAC address 0–127 per segment | None at the switch — but the gateway that fronts it needs a reliable port |
| BACnet/SC | TCP/TLS, typically port 443 | Node and hub URLs | Ordinary routed connectivity, no broadcast dependence |
That table explains most integration arguments. BACnet MS/TP is a field bus: one RS-485 segment, token passing, up to 127 master devices, and a segment length limited to roughly 1200 m at the lower baud rates. It does not touch the IP network until a gateway translates it. BACnet/IP is where the switch is involved, and BACnet/SC — added in ASHRAE 135-2020 — is designed to avoid the broadcast problem entirely by running over TLS to a hub.
Most installed buildings are still running BACnet over IP, and that is the case worth designing for. The BACnet protocol itself does not change between transports; only the network's job changes.
Because discovery in BACnet/IP is broadcast, and broadcast is the one traffic type a switch cannot make efficient.
A head-end that starts up sends a Who-Is to the local broadcast address. Every device on that subnet answers with I-Am. On a flat VLAN with 600 controllers that is 600 unicast replies converging on one host at once, plus 600 broadcast frames delivered to every port. Repeat that on a schedule — many BAS front-ends re-discover every few minutes — and the broadcast rate becomes a permanent background load.
Two consequences follow:
Broadcast storm control is not optional. Set a threshold on access ports and treat any port that trips it as a fault, not as normal BACnet behaviour. A healthy BACnet segment should sit far below 1% broadcast.
The broadcast domain should be small. Per floor, per riser, or per building depending on size. Small domains make discovery fast and limit the blast radius of a misbehaving controller.
Note: If a BAS must discover devices across subnets, the standard answer is a BBMD: one device per subnet acts as the broadcast management point and forwards Who-Is and I-Am between them as unicast. A BBMD is a configuration on the BAS side, but it only works if the intervening switches route cleanly and do not filter UDP 47808.
BACnet/IP can be configured to use IP multicast instead of broadcast for some services, and where it does, IGMP snooping matters.
Without snooping, a switch treats multicast like broadcast and floods every group frame to every port in the VLAN. With snooping, the switch tracks which ports have joined which group and forwards only to those. On a building network with video surveillance sharing the infrastructure, that difference is the difference between a working CCTV system and a stuttering one.
The practical requirement list for the switch:
IGMP snooping enabled on every VLAN carrying BACnet or video.
An IGMP querier present on each VLAN. Snooping without a querier eventually stops forwarding, because the switch has no way to refresh group membership. If the router does not run a querier, the switch must.
Multicast storm control, separately from broadcast control, because the two have different legitimate baselines.
Nothing exotic, but the gateway is the single point of failure for a whole RS-485 trunk, so the port it sits on deserves attention.
A dedicated access port, not a shared one. Gateways are often installed in a riser or a plant room where a spare port is whatever is left. Give it a documented port with a label.
PoE where the gateway supports it. Many MS/TP gateways are PoE-powered, which removes a local power supply from a riser cupboard nobody visits.
Port security or MAC binding. A gateway's MAC address should not move. Binding it prevents an accidental duplicate from taking the trunk offline.
A UPS-backed switch. If the switch loses power, every device behind the gateway becomes invisible to the BAS even though the controllers are still running.
The layout decision is about discovery scope, not about security alone.
| Design | Broadcast domain | Discovery behaviour | When it fits |
|---|---|---|---|
| One VLAN for the whole building | All controllers | Fast to build, slow to converge as the device count grows | Small buildings, under roughly 100 devices |
| VLAN per floor | One floor | Discovery stays local; floor isolation is free | Mid-size buildings, 10–30 controllers per floor |
| VLAN per riser plus BBMD | One riser segment | Controlled cross-subnet discovery through BBMD | Tall buildings where each riser serves many floors |
| Separate BA VLAN per tenant | Per tenant | Clean demarcation for billing and fault responsibility | Multi-tenant buildings with separate BAS contracts |
Whichever you choose, keep the BAS VLAN separate from the tenant data VLAN. Not primarily for security — although that is a benefit — but because a tenant's DHCP scope or a broadcast-heavy device should never be able to affect how quickly the BAS discovers its own controllers.
This is where building projects most often get the switch wrong, because the load is not what it was five years ago.
Room controllers, thermostats, VAV controllers, CO2 sensors and IP cameras all draw from the same switch. The arithmetic:
A PoE room controller typically runs in the Class 3 range (up to 15.4 W at the port under IEEE 802.3af).
An 802.3at device such as a PTZ camera can draw up to 30 W at the port.
An 802.3bt device can draw 60 W or 90 W.
Two rules prevent the usual failure. First, budget at the class maximum, not at the measured draw — a controller that idles at 3 W still negotiates its class. Second, leave 20–30% headroom for the switch's own consumption and for the next device someone adds. A 24-port PoE switch with a 370 W budget cannot power 24 Class 4 ports at 30 W each, and the failure appears as the last few ports refusing to come up, which looks like a controller fault.
Tip: If the floor plan is not final, specify the PoE budget for the fully populated floor. Adding a second switch later costs more than the larger power supply did.
| Feature | Why it matters for building automation | Priority |
|---|---|---|
| IGMP snooping with querier | Prevents multicast flooding where BACnet multicast or CCTV shares the VLAN | Mandatory |
| Broadcast storm control per port | Contains a controller that floods and protects discovery performance | Mandatory |
| 802.1Q VLANs | Separates floors, tenants and the BAS from tenant data | Mandatory |
| PoE with per-port power budgeting | Powers controllers and sensors without local supplies | Mandatory where PoE devices exist |
| Port security / MAC binding | Stops a duplicate MAC from taking a controller offline | Recommended |
| QoS with priority for control traffic | Keeps BACnet ahead of bulk data during congestion | Recommended |
| RSTP or ring redundancy | Keeps the BAS visible during a single link failure | Recommended |
| Per-port energy monitoring | Turns the PoE budget from a guess into a measurement | Nice to have |
| Wide temperature rating and DIN rail | Plant rooms and risers are not conditioned offices | Site-dependent |
The last row is not marketing. A riser cupboard on a roof in summer regularly exceeds 45 °C, and a commercial switch specified to 40 °C will run there until it does not. For riser and plant-room locations, an industrial switch with a wide operating range and a fanless housing removes a maintenance item that nobody wants to own for fifteen years.
Where a building spans several blocks, a PON link between the blocks often beats extending copper: a single fibre from the main distribution frame to an ONU in each block carries the BAS VLAN without a powered aggregation point in a plant room. On the access side, Rayin's 8+4-port gigabit industrial switches with optional PoE cover a floor's controllers and cameras from one DIN-rail box.
Five checks, all of which can be done with the BAS tools you already have.
Discovery time from a cold start. Record how long the head-end takes to find every device. Repeat after six months; a doubling is a broadcast problem, not a BAS problem.
Broadcast rate per port at steady state. Baseline it. Any port above 1% of link rate deserves an explanation.
UDP 47808 reachability across every routed boundary. Test from the head-end to a device on each subnet, not from a laptop plugged into the same switch.
PoE headroom under full load. Read per-port power draw with every device powered, then compare with the budget.
Redundancy behaviour. Pull one uplink and confirm the BAS keeps its device list. A BAS that re-discovers everything after a 30-second link loss is a BAS that will do it during a maintenance window.
What port does BACnet IP use?
UDP 47808 by convention, which is 0xBAC0 in hexadecimal. The port is configurable, and some sites change it to keep multiple BACnet networks separate on the same subnet. Whatever the value, the switch must pass it and the firewall must allow it in both directions for discovery to work.
Does BACnet/IP need a managed switch?
It needs broadcast control, IGMP snooping and VLANs, which in practice means a managed switch. An unmanaged switch will work on a small, flat network — until a controller floods or the device count makes discovery slow. The moment a building has more than one floor or shares infrastructure with CCTV, managed is the cheaper answer.
How many devices can share a BACnet MS/TP segment?
Up to 127 master devices on one RS-485 segment, with a segment length limited to roughly 1200 m at lower baud rates. Beyond that you need another segment and another gateway port. The IP network only sees the gateway, so MS/TP scale limits appear as gateway port count, not as switch ports.
Should BACnet and CCTV share a VLAN?
No. Both are broadcast and multicast heavy in different ways, and a CCTV burst or an IGMP snooping misconfiguration degrades discovery for the BAS. Separate VLANs, with QoS giving control traffic priority if they must share an uplink, keep the two systems independent.
Does BACnet/SC remove the need for broadcast control?
Largely, yes. BACnet/SC runs over TLS to a hub, so devices connect rather than discover by broadcast, and the switch only needs ordinary routed connectivity. Buildings with a BACnet/IP installed base still need broadcast control; new projects specifying BACnet/SC have a simpler network requirement.
About the author: Sara — Sara is a Customer Manager at Rayin with over 10 years of experience in the communications field. In her free time, she enjoys badminton and swimming.
About Rayin: Shenzhen Rayin Technology Co., Ltd. — Company Profile
