drop knx/ip capture · parse group address writes + bus device activity · runs locally
drop knx/ip capture · local only
heuristic screener · vendor schema varies · not definitive proof