Free tools for reading a building's network

Why these exist

The first hour on an unfamiliar site is always the same hour. What is on this network. What is it called. Is that value real. The tools that answer those questions well are either a vendor's, or licensed to a laptop that is not yours, or excellent and free and installed on a machine you are not allowed to install anything on.

So these two are deliberately small. A single Python file each, standard library only, nothing to install, nothing to register, and no ability to change anything in the building. Copy the file onto whatever laptop you have, run it, read the output, delete it.

They are not replacements for the tools you already use. They are narrower than all of them on purpose: a sweep and a dump, a tap and a tree. Where a general-purpose explorer is better, use the explorer — each page says so.

What “read-only” means here

It means something mechanical in both cases, not a promise about intent. bacnet-sweep can encode two BACnet services and no others, Who-Is and ReadProperty, and a gate function raises before any packet leaves if anything else is ever passed to the request builder. mqtt-tap has no PUBLISH encoder in it at all; every outbound byte goes through one function that refuses any packet type outside CONNECT, SUBSCRIBE, PUBACK, PINGREQ and DISCONNECT, and mqtt-tap.py --self-check makes that refusal happen in front of you. Both files are one file, so anyone who wants to check rather than believe it can.

Read-only is not the same as no effect. A Who-Is makes every device on a subnet answer at once, and reading a large controller's object list is hundreds of requests to a device that also has a building to run. A new MQTT client that takes an identifier already in use gets the existing client disconnected, which is a way to cause an incident without publishing a byte. Both tools are built to avoid the second and to pace the first, and both pages say where it still matters.

Neither has been near real hardware

This is the honest headline and it belongs above the fold rather than in a footnote. bacnet-sweep has never spoken to a real BACnet device; mqtt-tap has never connected to a real broker product. Each was proved against a fixture written from the protocol specification and run on loopback — 194 assertions for one, 130 for the other — and every terminal transcript on these pages is real output from that fixture, not from a site. A real controller or a real broker will differ. Each page has a section saying exactly what was and was not covered, and it is worth reading before you rely on either of them for anything that matters.

Also free, and not a program

The Niagara 5 module scan is the same idea pointed at a different problem: send a listing of a station's modules folder and a per-module readiness table comes back. That one we run rather than give away, because it needs a Java 25 JDK and a rule set rather than a laptop.