Internet-Security.com UDP port 1911 details

Tridium Niagara Framework (Niagara R2/AX/N4) uses UDP port 1911 for Fox/Station discovery broadcasts to find Niagara stations on the local network; the Fox protocol itself typically runs over TCP 1911 (and 4911 for TLS).
This is seen in real products built on Niagara, such as Honeywell WEBs, Johnson Controls FX, Vykon, and Schneider Electric I/A Series controllers.
In practice, Niagara stations may listen/respond on UDP 1911 for discovery while management tools (e.g., Workbench) establish sessions over TCP.
Security note: Port 1911 is frequently scanned and has been implicated in exploitation of Niagara Fox services (e.g., default credential issues and remote code execution vulnerabilities on exposed Niagara instances), though the primary attack surface is the TCP Fox service.

UDP 1911