ZoomEye returns 48,667 results for port="47808" and 1,252 for banner="DICOM". The first number is the subject here. 47808 is 0xBAC0, the registered UDP port for BACnet/IP, and it is the port a building automation system uses to talk to its controllers.

Why the count is small and what it misses

BACnet/IP is a broadcast-oriented protocol. A controller announces itself with a Who-Is request and answers with an I-Am that carries its device instance number, vendor identifier and the services it supports. That exchange is unauthenticated in the base protocol, and it is the intended behaviour rather than a defect.
The 48,667 figure undercounts the population for a structural reason. BACnet is designed to stay inside a building network, so most deployments sit behind a router that does not forward the broadcast domain. A scanning index only sees the ones that were published, and publishing a building protocol is usually the result of a flat network rather than an intention.
The converse is what matters for a defender. A host counted here is a host whose controller answers an off-network query, and that means the segmentation the protocol assumes is not in place.

What an answering device exposes

The I-Am response gives a device instance, and the object model behind it is readable with a ReadProperty request. Common objects include the device object, analog input and output objects, binary inputs, schedules and, on many systems, trend logs. A trend log for a chiller or a generator is an operational record, and an analog input for a door contact is a presence signal.
WriteProperty is the part that changes the category. A writable analog output on a supply fan or a binary output on a valve is a control point, and the protocol's own security model arrives as an optional addendum rather than as a default. NIST SP 800-82 treats building automation as a category where the control path and the monitoring path need separate handling for exactly this reason.

A check that stays read-only

A BACnet client can enumerate a device without writing to it:

bacwi
bacrp <device-instance> 8 <object-instance> 28
bacrpm <device-instance> 8 <object-instance> 28 85

bacwi sends the Who-Is and lists the I-Am responses it receives. bacrp reads a single property, and 28 is the object-name property while 85 is the present-value property. bacrpm is the read-property-multiple form of the same request. None of these three writes to the device, which is why they are the ones to start with.
The results of such a scan should be treated as sensitive. A list of device instances and their present values is a floor plan in numbers, and the report should not be posted to a ticket queue that a wider group can read.

What the two counts say together

48,667 BACnet listeners and 1,252 DICOM banners are both small compared with the millions of HTTP endpoints in the same index. The comparison is useful: both protocols were built for a controlled network, both have optional security, and both are measured more often by their footprint than by their exposure. The count from the query executed on 2026-10-25 with sub_type=all establishes the first part of that. It says nothing about how many of the 48,667 answer a WriteProperty request, and that number requires an authorised test rather than an index query.

References

  • BACnet website, including the protocol overview and FAQ: https://www.bacnet.org/

  • BACnet FAQ: https://www.bacnet.org/FAQ/index.html

  • NIST SP 800-82 Rev. 3, Guide to Operational Technology Security: https://csrc.nist.gov/pubs/sp/800/82/r3/final

  • ZoomEye, query executed 2026-10-25 with sub_type=all: https://www.zoomeye.ai/