00 01 02 03 04 05 06 07 08 09 10 11
81 0b 00 0c 01 20 ff ff 00 ff 10 08   
ll ll ll ll nn nn nn nn nn nn aa aa

BACnet Virtual Link Control
offset	length	data	description
0042	1	81	Type: BACnet/IP (Annex J) (0x81)
0043	1	0b	Function: Original-Broadcast-NPDU (0x0b)
0044	2	00 0c	BACnet packet length
Building Automation and Control Network NPDU
offset	length	data	description
0046	1	01	Version: 0x01 (ASHRAE 135-1995)
0047	1	20	Control: 0x20 0... .... = NSDU contains: BACnet APDU, message type field absent. .0.. .... = Reserved: Shall be zero and is zero. ..1. .... = Destination Specifier: DNET, DLEN and Hop Count present. If DLEN=0: broadcast, dest. address field absent. ...0 .... = Reserved: Shall be zero and is zero. .... 0... = Source specifier: SNET, SLEN and SADR absent .... .0.. = Expecting Reply: Other than a BACnet-Confirmed-Request-PDU, segment of BACnet-ComplexACK-PDU or network layer message expecting a reply present. .... ..0. = Priority: Not a Life Safety or Critical Equipment message. .... ...0 = Priority: Normal message
0048	2	ff ff	Destination Network Address: 65535
0050	1	0	Destination MAC Layer Address Length: 0 indicates Broadcast on Destination Network
0051	1	ff	hop count: 255
Building Automation and Control Network APDU
offset	length	data	description
0052	1	10	0001 .... = APDU Type: Unconfirmed-REQ (1)
0053	1	08	Unconfirmed Service Choice: who-Is (8)

The basic who-is message above can be followed by two context tags to limit responses to a specific range.