knxprobe

Discover gateways, listen to the bus, and run read-only diagnostics from the command line.

knxprobe finds KNXnet/IP gateways and opens a tunnel. By default it only listens. A few options send requests to the bus; they are marked below. It never writes to a device.

knxprobe -discover
knxprobe -addr HOST:PORT -describe
knxprobe -addr HOST:PORT [-tcp] [-for 30s] [-trace]
knxprobe -addr HOST:PORT [-read GA | -info DEV | -prop DEV:OBJ:PID[:START[:COUNT]] | -mem DEV:ADDR:LEN | -scan LINE | -progmode]
knxprobe -usb-list

Flags

Flag	Default	Meaning
`-addr HOST:PORT`	none	The KNXnet/IP gateway. Required, except for `-discover` (multicast) and `-usb-list`.
`-tcp`	off	Tunnel over TCP instead of UDP.
`-for DURATION`	`10s`	How long to listen (for example `30s`, `5m`). Interrupt with Ctrl+C to stop earlier.
`-trace`	off	Print every KNXnet/IP frame sent and received.
`-discover`	off	Multicast search for gateways, print them, and exit.
`-unicast`	off	With `-discover`: send the search request to `-addr` instead of multicasting.
`-describe`	off	Describe the gateway at `-addr` and exit.
`-usb-list`	off	List plugged-in KNX USB interfaces and exit. Linux only.
`-mgmt`	off	Open a device management connection, hold it briefly, close it. Reads and writes nothing.

Options that send telegrams (read-only requests), used after the tunnel is open:

Flag	Meaning
`-read GA`	Send one GroupValueRead to this group address (for example `0/1/11`). Changes no state. The answer appears in the listening output.
`-info DEV`	Read the device descriptor and device object properties of this device (for example `1.1.21`): mask, serial, manufacturer, order information, programming mode. Sends a connect, a few read requests and a disconnect to that one device.
`-prop DEV:OBJ:PID[:START[:COUNT]]`	Read an interface object property, for example `1.1.20:3:5`. Numbers may be decimal or `0x` hex.
`-mem DEV:ADDR:LEN`	Read device memory, for example `1.1.21:0x0100:22`. Length 1 to 4096. Authorizes first with the key from `-authkey`.
`-authkey HEX`	Access key sent with `-mem`, default `ffffffff` (the factory default). `none` skips authorization.
`-scan LINE`	Ping the devices of a line (for example `1.1`) with T_Connect and T_Disconnect. The range is set by `-from` (default 0) and `-to` (default 255).
`-from N`, `-to N`	With `-scan`: first and last device number.
`-progmode`	Ask which devices are in programming mode (a broadcast individual address read).

After the options run, knxprobe keeps listening for -for and prints each telegram with time, message code, source, destination, service and value, then disconnects.

Examples

knxprobe -discover
knxprobe -addr 10.0.0.5:3671 -describe
knxprobe -addr 10.0.0.5:3671 -for 60s                      # watch the bus for a minute
knxprobe -addr 10.0.0.5:3671 -info 1.1.21 -for 1s
knxprobe -addr 10.0.0.5:3671 -scan 1.1 -from 1 -to 40 -for 1s
mkdir -p dump
knxprobe -addr 10.0.0.5:3671 -mem 1.1.21:0x0100:64 -for 1s > dump/0x0100.txt

knxdownload -from-dump dump compares an image with files saved like this, named 0xADDR.txt (see knxdownload).