JustPeachyFor IT, security and facilities teams
Network and security sheet
At a glance
- Read-only. It never writes to a controller, never logs in to anything and never transmits on an MS/TP (RS-485) trunk.
- Gentle by design. The IP scan is paced to 50 addresses a second. BACnet devices are asked to identify themselves once per scan. Detail reads go one at a time per MS/TP network.
- Stays on the PC. Scan results are never sent anywhere. The program has no telemetry, tracking or crash reporting.
- One Windows program (a single .exe, no installer, no service, no admin rights needed to run).
What it never does
- No BACnet WriteProperty or WritePropertyMultiple, DeviceCommunicationControl, ReinitializeDevice, file transfer, object create or delete, or time synchronization. The program contains no code for these services.
- No transmitting on RS-485. The MS/TP listener opens the USB adapter receive-only, with RTS and DTR off. It never takes a MAC address or the token.
- No passwords tried and no logins. Web pages are read with one plain request for the home page.
- No packet injection. The Switch Port tool only receives LLDP and CDP frames.
- Nothing runs in the background after the window is closed.
Traffic by tool
| Tool | What it sends | Ports |
|---|---|---|
| Network Scan / free-IP finder | For each address in the range the user types: one ping (ICMP echo). If there's no reply, a TCP connection attempt to common ports (opened and closed immediately, no data sent). Then a read of the PC's own ARP table and, optionally, reverse-DNS name lookups through the PC's normal DNS server. | ICMP; TCP 80, 443, 22, 445, 135, 139, 3389, 53, 8080; DNS 53 |
| IP Check (one address) | Up to five rounds of ping, or the TCP check above, half a second apart. With "ask the device what it is" on, it also makes TCP connection attempts to common service ports, sends one plain web request to any open web port, and sends BACnet ReadProperty requests to that one address (unicast). | ICMP; TCP 21, 22, 23, 53, 80, 135, 443, 445, 502, 554, 631, 1883, 1911, 3389, 4911, 5900, 8080, 8443, 8883, 9100; UDP 47808 |
| BACnet scan (MS/TP networks) | Who-Is-Router-To-Network and Who-Is, sent once to one destination: the address the user types, or the broadcast address of the network chosen on the Network Scan tab. Single addresses get unicast packets, never a broadcast. It then listens for replies (at most 60 seconds) and reads each device's name, vendor, model, firmware and Max Master with paced ReadProperty requests. | UDP 47808 |
| BBMD option (only if the user enters a BBMD) | Registers as a foreign device for at most 2 minutes, sends the Who-Is through the BBMD once (Distribute-Broadcast-To-Network), and removes the registration when done. | UDP 47808 to the BBMD |
| MS/TP listener | Nothing. It only receives from the USB RS-485 adapter. Auto-baud only changes the PC's own port speed. | Serial (receive only) |
| Switch Port | Nothing. It captures incoming LLDP/CDP frames for up to 10 minutes. Needs the free Npcap driver. | Ethernet (receive only) |
| Schedules | Same as Network Scan, while the program is open. | As Network Scan |
| Vendor Lookup, Duplicates report, Max Master table | Nothing. They work from data already collected. | — |
BACnet services used
Only these, from ASHRAE 135: Who-Is, Who-Is-Router-To-Network, ReadProperty (device object only: Object Name, Vendor Name, Model Name, Firmware Revision, Max Master), and the BACnet/IP link services Register-Foreign-Device, Delete-Foreign-Device-Table-Entry and Distribute-Broadcast-To-Network, used only with a BBMD the user enters. The program does not answer BACnet requests or advertise itself as a device.
Safety limits built into version 1.1
| Limit | Value |
|---|---|
| IP scan speed | At most 50 new addresses a second, 32 at a time |
| IP scan size | Up to 4,096 addresses (/20) normally; up to 65,536 (/16) after a confirmation; larger ranges refused |
| Scheduled scans | At most every 15 minutes, up to 1,024 addresses (/22), one at a time, with a Stop button |
| Who-Is per BACnet scan | Once, to one destination (no repeat pass, no extra adapters) |
| BACnet detail reads | 1 request at a time per MS/TP network, at most 2 waiting at any router, at most 16 site-wide, at least 150 ms apart on each network, 4-second timeout, 1 retry, 2-minute cap |
| UDP port 47808 | Held only while listening for replies (60 seconds at most); detail reads use a random port. If another BACnet program already holds 47808 the scan uses another port and does not take it over. |
| BBMD registration | At most 2 minutes, removed at the end |
On very large sites (thousands of BACnet devices) we still recommend running BACnet scans at quiet times and scanning one router or network at a time by typing its address.
Internet use
- None for scanning. Every tool works with no internet connection.
- IEEE vendor list from standards-oui.ieee.org: built into the program; downloaded again only if it's missing or the user clicks Download IEEE list.
- Check for updates: only when the user clicks it; downloads justpeachytools.com/version.json.
- Licensing: offline by email today. Licenses are locked to the PC with a one-way hashed hardware fingerprint.
Full details: privacy statement.
What it keeps on the PC
- License files and a date check: %APPDATA%\JustPeachy\MultiTool\ and HKEY_CURRENT_USER\Software\JustPeachy\MultiTool
- Settings and schedules: .ip_scanner_settings.json and .ip_scanner_schedules.json in the user's folder
- CSV exports, only where the user saves them
For IT teams
- Firewall: on first run Windows asks to allow the program. BACnet scans need inbound UDP 47808 (or the reply port) on the technician's PC.
- Allow-listing: the download page shows the program's SHA-256 fingerprint for each release. Code signing is planned.
- Intrusion detection: the IP scan is a ping-and-connect sweep of the range the technician types. It's paced, but some monitoring tools may still note it. Tell your security team before scanning a production network.
- Questions or a security questionnaire: email us. We'll answer in writing.
Contact
support@justpeachytools.com