The 2025 PCAP Recap: Optigo Networks’ State of the Network Report

We’re proud to launch our very first ‘State of the Network’ report. We’re surfacing the interesting and the indicative: data that reflects both the changes we’ve seen over the last year, but also the larger shifts in the industry, reflected in our customers metrics. What sort of changes are we seeing in network sizes and device counts? How is the sheer volume of data on these networks changing? What are the most popular devices people are grabbing to build the future… and which legacy workhorses are they refusing to let go of?

Because our data collection is system-agnostic, this report captures the full breadth of the OT landscape. Unlike studies limited to single-vendor ecosystems, our insights reflect the diverse, multi-platform reality that operators actually face.

A modern smart building has an intricate nervous system — your OT network. This network is responsible for nearly everything that makes a building efficient, comfortable, and secure. For years, OT networks have been growing, not just in scale, but in complexity and importance. But I don’t need to tell you that. It’s your work that forms the basis for this lookback.

As Optigo Networks continues to grow alongside our partners, we’ve been watching the data. And frankly, it’s telling some fascinating stories.

In the following pages, we’ll dive into these trends, share our insights, and explore what it all means for the future of smart buildings.

Let’s get started.

Our deep dive of the results is live on Your Network Questions: Answered, talking details and insights with Optigo Network’s CTO Ping Yao. Subscribe to our YouTube Channel to get notified when new episodes drop, or sign up today for our weekly email drop to get the video delivered right to your inbox! 

Executive Summary

What 2025 Tells Us
About the Industry

Complexity is Scaling.

Networks aren't just growing; they are becoming denser and louder. While new network adds continue, the data volume (+101%) and PCAP counts (+154%) are also growing.

The Hybrid Reality.

The transition to BACnet/IP is undeniable (32%), yet MS/TP remains a component in most backbones (61%). The industry is not "switching" so much as "layering."

Critical Misses.

Network health is stagnating in the "Critical" zone (34%), driven by configuration errors like Unacknowledged Requests. The logical layer is struggling to keep up.

This year marks the beginning of a new data-driven era for Optigo Networks. By establishing 2025 as our baseline year, we have uncovered three critical observations that define the current state of the OT network landscape.

Looking Ahead to 2026

This report establishes the baseline metrics for device count, health scores, and protocol balance. Next year, we will measure the velocity of change against these 2025 pillars.

Total Networks Tracked 2,008

© 2025 Optigo Networks Inc. | State of the Network Report

In short, 2025 was a year of firsts for Optigo Networks. Total data processed in 2025 was approximately 22 TB—approximately 1.1 million PCAP files. That’s double the data we handled in 2024, and our first time passing 1 million PCAP files uploaded and processed.

For context, that’s about 1,120 times the total size of the English edition of Wikipedia (about 24 GB without media).

2025: A Year of Firsts

Optigo Networks

State of the
Network 2025

Data Processed+100% YoY
22.48 TB
FY 2025 Total Volume
Total FilesNew Record!
1.1 Million
PCAP Files Analyzed
Global Reach
2,008
Networks Monitored

The Data Explosion

Total network traffic volume FY24 vs FY25

Protocol Distribution

MS/TP remains a critical component.

Hybrid (MS/TP Active)
60%
Pure BACnet/IP
32%

Scale Context

We processed 1,120x more data than the entire English Wikipedia this year.

WIKIPEDIA SIZE~24.05 GB

OPTIGO TRAFFIC22,480 GB

Network Complexity

781Devices

Avg devices monitored per org.

Trending Upwards ▲

© 2025 Optigo Networks Inc. | Data Source: Aggregated Protocol Analysis (Nov 2025)

There’s a total of 1333 organizations monitoring approximately 2008 OT networks and subnetworks in the Optigo Networks system. 711 of those networks were added in 2025.

That’s down slightly from the 949 added in 2024, but the size and complexity of the networks are more significant.

Growth and Engagement

Year Over Year Analysis

Growth &
Engagement

Data Volume (TB)

Traffic Processed

▲ +101%

PCAP Files

Files Analyzed

▲ +165%

New Networks

Annual Adds

Total: 2,008

New Users

Annual Adds

Total: 1,837

© 2025 Optigo Networks Inc. | Data Source: User & Network Activity Logs Nov 2025

Not only are new customers bringing their challenging networks online, but they are doing more with OptigoVN than ever before.  We saw big growth on the number of new users and the number of PCAP files uploaded.<br><br>

Network Numbers: Response Times

Performance Analysis

Network
Response Time

Network Composition

Breakdown of networks by device protocol type

61%
MS/TP Dominance

Legacy MS/TP networks are still in the mix for the majority of network infrastructure, with most networks still a hybrid of MS/TP and IP.

32%
IP Growth

"Pure" BACnet/IP-only networks now account for nearly one-third of the ecosystem.

Global Response Time

Distribution across ~42 Million analyzed links

Most Traffic < 200ms

Response Time by Protocol

Comparing IP/Ethernet (Blue) vs MS/TP (Orange)

Logarithmic Scale

This chart compares how many links fall into each response-time bucket for IP/Ethernet versus MS/TP, showing the distribution and relative volume across speeds.

Note: Vertical axis uses a logarithmic scale to visualize the massive difference in volume between IP and MS/TP traffic.

The Speed Standard

74%

Nearly three-quarters of all analyzed network links respond in under 100ms.

Traffic Dominance

48x

IP/Ethernet networks handle 48 times the volume of MS/TP networks.

Protocol Signal

2x Efficiency

Data confirms: IP networks are ~2x more likely to keep traffic in the 'Fast Lane' (<100ms).

© 2025 Optigo Networks Inc. | Data Source: Optigo Networks, Nov 2025

Across our ecosystem, we’ve polled thousands of anonymized data points to help build a picture of what the average OT network is looking like in 2025.

MS/TP is still a vital part of almost every OT network. IP-only networks continue to rise, particularly in new deployments and retro-refits, but MS/TP still remains the “if it ain’t broke” legacy network component.

What Kind of Traffic Was It?

Traffic Analysis

Packet Type
Distribution

BACnet Traffic Breakdown

Distribution of ~24 Million analyzed packets

60%
Data Polling (Reads)

Heavy reliance on polling (ReadProperty) rather than event-driven updates.

21%
Discovery (Who-Is)

High volume of discovery traffic suggests unstable or searching devices.

11%
Proprietary/Vendor

Non-standard BACnet traffic typically used for vendor-specific configuration.

Polling vs. COV

Only 5% of traffic is efficient Change of Value (COV) notifications, while 60% is polling. Shifting to COV could drastically reduce network load.

Writing Commands

WriteProperty commands make up less than 2% of traffic, confirming that OT networks are primarily read-heavy environments.

© 2025 Optigo Networks Inc. | Data Source: 22.4M Analyzed BACnet Packets

The Story in the Data: Network traffic is overwhelmingly dominated by data polling (ReadProperty/Multiple), accounting for nearly 60% of all packets. This indicates that most networks spend a majority of their operations in a state of “asking” for data rather than “pushing” updates, such as with COV (Change of Value), which is much more efficient but less common (~5%).

 

High Discovery Traffic: A significant portion (21%) is also dedicated to discovery (Who-Is/I-Am). In a healthy, stable network, this should be lower. High discovery traffic often points to misconfigured devices constantly searching for peers.

Vendors & Platforms

Ecosystem Landscape

Vendors &
Platforms

The "Big Players"

Top vendors by % of total monitored devices

Top 5 = ~68% Share
Honeywell (Combined)
28.1% Market Share

Dominant leader (Alerton + Honeywell Inc.).

Siemens
15.0% Market Share

Strong global deployment base.

Automated Logic
11.9% Market Share

Rounding out the top three.

Who are the "Others"?

The 32% slice is made up of these key players (Ranked #11-20)

Lutron1.62%
Sierra Monitor1.55%
ASI Controls1.54%
Reliable1.17%
TAC0.74%
Eaton0.71%
Trane0.63%
Cypress0.61%
Belimo0.54%
Yaskawa0.48%

Top 10 Vendors by Device Count

Total devices detected on network

Category Insight

While HVAC controllers dominate the Top 10, the presence of Lutron (#11, Lighting), Eaton (#16, Power), and Danfoss (#10, Drives) confirms that modern OT networks are deeply integrated multi-system environments.

© 2025 Optigo Networks Inc. | Data Source: 2025 Device Inventory Analysis

The Health of Our Users' Networks

Network Health & Troubleshooting

State of the
Network Health

Ecosystem Health Score

Distribution of health scores across 1,138 monitored nodes

Healthy (80-100%)
28.5% of Networks

Optimized systems with minimal diagnostic errors.

Warning (50-79%)
37.4% of Networks

Functional but showing signs of degradation.

Critical (<50%)
34.1% of Networks

Severe issues requiring immediate attention.

Top 5 Diagnostic Issues

Most common failures detected by OptigoVN

Prediction Check

John Attala, Optigo Networks' Chief Growth Officer, Was Right.

Unacknowledged Requests is a top-tier offender, ranking #3 overall with 513 failures. This confirms that lost packets and communication breakdowns remain a persistent plague in OT networks.

Top Offender

The #1 issue, Error Messages (Programming), suggests that configuration errors—not just physical failures—are the leading cause of poor network health scores.

The Efficiency Dividend

Projected impact of automated diagnostics vs. manual troubleshooting

Industry Estimate
Failures Detected
2,566

Total incidents across the Top 5 diagnostic categories.

Manual Effort Saved
~7,700h

Based on avg. 3 hours to manually identify & resolve complex network issues.

Value Created
$1.92M

Equivalent service value at a conservative $250/hr billable rate.

*Estimates derived from standard industry service times for intermittent packet loss and configuration troubleshooting.

© 2025 Optigo Networks Inc. | Data Source: 2025 Device Inventory Analysis

Pulling it together

2025 was a breakout year for OptigoVN — not just in growth, but in the clarity of what “real-world building networks” actually look like at scale. By mid-November, OptigoVN had processed 159.65 billion packets and 22.48 TB of traffic. That data came from a broad footprint: 2,008 OT networks across 1,333 organizations, with 711 new networks added in 2025.


The result is a strong, defensible baseline for understanding how modern building networks behave — and for tracking what changes year over year.


The big takeaway, though likely not a shocker, is that most environments are still living in a hybrid era. Newer IP-based systems are growing, but legacy approaches and mixed architectures remain a major part of day-to-day reality. The traffic patterns reflect that: networks still lean heavily on polling to collect data (about 60% of observed packets), while event-driven updates like Change of Value (COV) notifications remain a small share (around 5%). Discovery traffic is also a meaningful slice (about 21%), which often indicates devices are regularly “searching” or re-establishing context instead of operating in a steady, quiet state. In plain terms: the industry is modernizing, but many networks are still carrying the operational habits — and overhead — of older designs.


It’s also important to be transparent about what this report is and isn’t. This is a snapshot of the OptigoVN ecosystem, not a complete census of every BACnet network in the world. But that’s exactly what makes it useful: it’s based on real traffic, from real networks, measured consistently.


With 2025 set as the baseline, the story going forward gets sharper: which architectures are gaining share, where performance is improving, and what practical changes (like shifting from heavy polling to more event-driven strategies) can reduce network load and improve responsiveness as portfolios grow.

Methods & Limitations

This report is based on aggregated, anonymized data from the OptigoVN platform as of November 2025. While it offers a unique and granular view into the state of operational technology (OT) networks, transparency about our dataset is key to interpreting these findings.

Data Scope

  • Source: All data is derived exclusively from active OptigoVN users and networks. It does not include offline systems or networks monitored solely by third-party tools.
  •  
  • Timeframe: The “2025” dataset includes traffic and activity logged from January 1, 2025, through November 15, 2025. Historical comparisons use full-year data from 2024 where available.
  •  
  • Volume: Insights are drawn from the analysis of approximately 22.48 TB of network traffic and 1.1 million PCAP files across 2,008 distinct OT networks.
  •  

Limitations & Biases

 

  • Vendor Bias: The “Market Share” analysis reflects the install base of Optigo customers, which may skew towards specific regions or industries (e.g., higher education, commercial real estate) where Optigo has a strong presence. It is a snapshot of our ecosystem, not necessarily the entire global market.
  •  
  • Protocol Visibility: Response time metrics are calculated based on successful packet-to-packet exchanges. Extremely poor connections that result in total packet loss may be underrepresented in latency averages.
  •  
  • Metric Precision: Some metrics, such as “manual hours saved,” are directional estimates based on industry-standard service times rather than direct time-tracking data from technicians.

Share This Post

Don't want to wait?

Sign up now to get posts delivered right to your inbox the moment they go live.