BACnet · Building Automation and Control Network
The building-automation protocol carrying setpoints and alarms between the BMS and plant; unauthenticated by design, so segmentation rather than the protocol provides its security.
Current numbers
Port 502Classic Modbus TCP is unauthenticated, and FrostyGoop used it; Claroty finds over 80% of data-center OT on BACnet/Modbus-class protocols