Wireshark ships with a native BACnet/IP dissector that allows full inspection of frames (services, objects, properties) once captured from the network; the most common display filter is "bacapp" (BACnet Application layer).

Wireshark is the de facto tool for debugging BACnet traffic: useful filters include bacapp, bvlc and bacnet, and the dissector decodes ReadProperty exchanges into human-readable object, property and value fields. It also provides per-conversation statistics (who talks to whom and at what rate) and lets you follow a single transaction end to end. To capture effectively, use a switch port mirror or a network TAP; a PC plugged directly into the BACnet VLAN will only see broadcasts plus its own unicast traffic.

Save a tcpdump or pcap capture during commissioning even when nothing is wrong; having a baseline trace makes post-incident analysis far quicker months later.