hardware:hp2101nw_wlan_printserver
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen RevisionVorhergehende ÜberarbeitungNächste Überarbeitung | Vorhergehende ÜberarbeitungNächste ÜberarbeitungBeide Seiten der Revision | ||
hardware:hp2101nw_wlan_printserver [2011/12/07 13:13] – reinhold | hardware:hp2101nw_wlan_printserver [2012/02/26 15:18] – [section 28] reinhold | ||
---|---|---|---|
Zeile 2: | Zeile 2: | ||
This device is not really a print server, but rather a USB port forwarder over WLAN. It has a USB micro connection for configuration (config only via USB!) and a normal USB plug for the printer. | This device is not really a print server, but rather a USB port forwarder over WLAN. It has a USB micro connection for configuration (config only via USB!) and a normal USB plug for the printer. | ||
- | * https:// | + | * https:// |
+ | * https:// | ||
+ | * https:// | ||
* CUPS protocol: http:// | * CUPS protocol: http:// | ||
Zeile 124: | Zeile 126: | ||
| 5-12 | sendername | | 5-12 | sendername | ||
+ | ==== Device option ranges ==== | ||
+ | |||
+ | ^ Range ^ Command types ^ | ||
+ | | 0xxx | General system settings (hostname, L1/L2/L3) | | ||
+ | | 4xxx | IP-Address, dhcp, router, etc. settings | ||
+ | | 5xxx | Unknown (only set, but not returned with configuration | | ||
+ | | 70xx | Infrastructure wireless settings | ||
+ | | 71xx | Ad-hoc wireless settings | | ||
+ | | 9xxx | Device commands (sent to the device) | | ||
+ | |||
+ | ==== Device commands ==== | ||
+ | |||
+ | To send a command (e.g. reset, retrieve config data, etc.) to the device, the same format is used as described above. All commands start with 9xxx and typically don't have any value. | ||
+ | |||
+ | ^ Command | ||
+ | | 9002 | Reset device | ||
+ | | 9100 | Request configuration from the device | full device config | | ||
+ | | 9107 | Start wlan scan | empty (only header) | | ||
+ | | 9971 | Unknown (only called for ad-hoc after network scan) | '' | ||
==== USB detection / device capabilities ==== | ==== USB detection / device capabilities ==== | ||
Zeile 470: | Zeile 491: | ||
7119 : | 7119 : | ||
++++ | ++++ | ||
+ | |||
+ | ==== Resetting the device ==== | ||
+ | |||
+ | The device is reset with the '' | ||
+ | |||
+ | |||
+ | 0040 40 00 06 00 58 58 58 58 58 58 58 58 39 30 30 32 | ||
+ | 0050 3a 0a :. | ||
+ | 1.) 0040 40 00 00 00 00 50 54 39 45 32 44 32 46 @....PT9E2D2F | ||
+ | 2.) 0040 40 00 00 00 00 50 54 39 45 32 44 32 46 @....PT9E2D2F | ||
+ | 3.) [empty] | ||
+ | |||
+ | |||
==== All configuration variables ==== | ==== All configuration variables ==== | ||
Zeile 539: | Zeile 573: | ||
- | ===== Printing | + | ===== Network communication |
- | * Ports 34447, 34448 and 34450 are open and used | ||
- | ==== Device detection ==== | + | There are three different types of communications: |
- | | + | |
- | No. | + | |
- | 4 3.832106 | + | |
- | + | ||
- | Frame 4: 48 bytes on wire (384 bits), 48 bytes captured (384 bits) | + | |
- | Arrival Time: Dec 6, 2011 13: | + | |
- | Epoch Time: 1323174537.028001000 seconds | + | |
- | [Time delta from previous captured frame: 0.742167000 seconds] | + | |
- | | + | |
- | | + | |
- | Frame Number: 4 | + | |
- | Frame Length: 48 bytes (384 bits) | + | |
- | Capture Length: 48 bytes (384 bits) | + | |
- | | + | |
- | [Frame is ignored: False] | + | |
- | | + | |
- | [Coloring Rule Name: UDP] | + | |
- | [Coloring Rule String: udp] | + | |
- | Ethernet II, Src: 38: | + | |
- | Destination: | + | |
- | Address: Broadcast (ff: | + | |
- | .... ...1 .... .... .... .... = IG bit: Group address (multicast/ | + | |
- | .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) | + | |
- | Source: 38: | + | |
- | Address: 38: | + | |
- | .... ...0 .... .... .... .... = IG bit: Individual address (unicast) | + | |
- | .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) | + | |
- | Type: IP (0x0800) | + | |
- | | + | |
- | Version: 4 | + | |
- | Header length: 20 bytes | + | |
- | Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not | + | |
- | 0000 00.. = Differentiated Services Codepoint: Default (0x00) | + | |
- | .... ..00 = Explicit Congestion Notification: | + | |
- | Total Length: 34 | + | |
- | Identification: | + | |
- | Flags: 0x02 (Don't Fragment) | + | |
- | 0... .... = Reserved bit: Not set | + | |
- | .1.. .... = Don't fragment: Set | + | |
- | ..0. .... = More fragments: Not set | + | |
- | Fragment offset: 0 | + | |
- | Time to live: 127 | + | |
- | Protocol: UDP (17) | + | |
- | Header checksum: 0x47d5 | + | |
- | | + | |
- | [Bad: False] | + | |
- | Source: 128.130.51.116 (128.130.51.116) | + | |
- | Destination: | + | |
- | | + | |
- | Source | + | |
- | Destination port: 34447 (34447) | + | |
- | Length: 14 | + | |
- | Checksum: 0xb415 | + | |
- | | + | |
- | | + | |
- | Data (6 bytes) | + | |
- | Data: 534253550100 | + | |
- | [Length: 6] | + | |
- | + | ||
- | 0000 ff ff ff ff ff ff 38 60 77 3e 82 39 08 00 45 00 ......8`w> | + | |
- | 0010 00 22 00 00 40 00 7f 11 47 d5 80 82 33 74 ff ff ."..@...G...3t.. | + | |
- | 0020 ff ff a1 c3 86 8f 00 0e b4 15 53 42 53 55 01 00 | + | |
- | ++ | + | |
- | * Known devices are detected via SNMP: ++details| | + | |
+ | |||
+ | * TCP Ports 34447, 34448 and 34450 are open and used | ||
+ | * UDP Ports 34444 and 34447 are used for discovery broadcast and other device communication | ||
+ | |||
+ | |||
+ | === General communication packet structure for print server communication === | ||
+ | |||
+ | The communication with the print server itself uses UDP port 34444 and a header and packet structure of the form described for the USB communication above. | ||
+ | |||
+ | Structure of OUT packets (sent from the PC to the print server): | ||
+ | 40 00 ll ll 50 54 39 45 32 44 32 46 __ __ __... | ||
+ | |||
+ | ^ byte(s) | ||
+ | | 0 | 0x40 (@) | magic byte indicating a command for the device | | ||
+ | | 1 | 0x00 (\0) | Unknown, always 0 | | ||
+ | | 2-3 | content length | ||
+ | | 4-11 | sendername | ||
+ | | 12-... | ||
+ | |||
+ | Structure IN packets (sent from the device to the USB host): | ||
+ | 40 00 00 e3 03 50 54 39 45 32 44 32 46 __ __ __... @....PT9E2D2F___... | ||
+ | |||
+ | ^ byte(s) | ||
+ | | 0 | 0x40 (@) | magic byte indicating a command from the device | | ||
+ | | 1-2 | 0x0000 (\0\0) | ||
+ | | 3-4 | content length | ||
+ | | 5-12 | sendername | ||
+ | | 12-... | ||
+ | |||
+ | Known config request calls are: | ||
+ | ^ OPTIONID ^ description ^ | ||
+ | | 9010 | Hardware information (MAC, IP, wireless information etc.) | | ||
+ | | 9801 | request MAC address | | ||
+ | |||
+ | |||
+ | === Communication packet structure for printer communication (through print server) === | ||
+ | |||
+ | The communication with the printer uses UDP/TCP ports 34447 and a header of the form | ||
+ | SBSU[Cmd][args] | ||
+ | where '' | ||
+ | |||
+ | Known Commands are: | ||
+ | ^ Cmd ^ description ^ | ||
+ | | 0x0001 | ||
+ | | 0x0007 | ||
+ | |||
+ | === USB over TCP packet structure (TCP port 34448) === | ||
+ | |||
+ | The USB over TCP communication with the printer uses TCP port 34448. | ||
+ | |||
+ | Example: | ||
+ | 0b 00 02 00 00 00 00 01 00 00 00 00 12 00 00 00 ........ ........ | ||
+ | 00 00 00 00 01 00 00 00 ........ | ||
+ | 52 42 52 55 12 00 00 00 02 00 00 00 00 00 00 00 RBRU.... ........ | ||
+ | 01 00 00 00 12 01 00 02 00 00 00 40 2b 13 89 20 ........ ...@ .. | ||
+ | 00 01 01 02 03 01 ...... | ||
+ | |||
+ | The packets sent to the printer have a length of 24 bytes, first byte seems to be the command. After the header comes the actual USB packet contents (empty for USB control calls). | ||
+ | |||
+ | ^ bytes ^ description ^ | ||
+ | | 0 | command: 0x00=GET interface information (FIXME), 0x09=BULK FIXME, 0x0b=GET DESCRIPTOR, 0x1b=URB_CONTROL In | | ||
+ | | 1-5 | FIXME: UNKNOWN | | ||
+ | | 3 | For GET interface information: | ||
+ | | 6 | For GET DESCRIPTOR: DESCRIPTOR index, Otherwise: FIXME UNKNOWN | | ||
+ | | 7 | For GET DESCRIPTOR: DESCRIPTOR type (0x01=DEVICE, | ||
+ | | 8-9 | FIXME: UNKNOWN, for URB_CONTROL In: wValue, for STRING DESCRIPTOR: languageId | | ||
+ | | 10-11 | FIXME: UNKNOWN, for URB_CONTROL In: wIndex | | ||
+ | | 12-15 | For GET DESCRIPTOR: expected data length (excluding response header), URB_CONTROL In: URB length or wLength, little endian | | ||
+ | | 16-19 | serial (little endian): sometimes 0x00000000, mostly equal to bytes 20-23 | | ||
+ | | 20-23 | serial (little endian): Incremented with each USB command | | ||
+ | The resonse packets will quote bytes 16-23 (even if 16-19 is 0x00) | ||
+ | |||
+ | The response packets have a 16 bytes head, after which the contents of the USB packet are sent. | ||
+ | |||
+ | ^ byte ^ description ^ | ||
+ | | 0-3 | '' | ||
+ | | 4-7 | length of the packet data after the header (excluding this header) | | ||
+ | | 8-10 | FIXME: UNKNOWN, mostly 0x02 0x00 0x00 | | ||
+ | | 11 | FIXME: UNKNOWN (values 0x00, 0x32, 0x3a, 0x41) | | ||
+ | | 12-19 | Bytes 16-23 of the request (serial) | | ||
+ | | 20-... | ||
+ | |||
+ | |||
+ | ==== (a) (Broadcast) Device detection & device status ==== | ||
+ | |||
+ | This command is used for | ||
+ | - detecting all available printer servers in the network (UDP broadcast), and for | ||
+ | - obtaining the status of one particular print server (UDP packet to one IP address). | ||
+ | |||
+ | UDP packet to port 34447 on address 255.255.255.255 (broadcast) or one particular IP address. | ||
+ | |||
+ | Packet type: SBSU command '' | ||
+ | |||
+ | Response: either no response at all (i.e. no print server), or a SBSU '' | ||
+ | |||
+ | If no printer is connected, the response looks like: | ||
+ | 53 42 53 55 01 00 SBSU.. | ||
+ | 53 42 53 55 01 00 57 50 54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F. | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 | ||
+ | |||
+ | If a printer is plugged in, the response looks like: | ||
+ | 53 42 53 55 01 00 SBSU.. | ||
+ | 53 42 53 55 01 00 57 50 54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F. | ||
+ | 00 00 00 00 00 00 6d 63 31 36 39 30 4d 46 00 00 ......mc 1690MF.. | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 01 00 00 00 2b 13 89 20 ........ ....+.. | ||
+ | 00 01 02 03 00 ff ff ff 01 07 01 02 02 07 01 02 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 | ||
+ | |||
+ | If the Windows driver has the device connected and locked, the response looks: | ||
+ | 53 42 53 55 01 00 57 50 54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F. | ||
+ | 00 00 00 00 00 00 6d 63 31 36 39 30 4d 46 00 00 ......mc 1690MF.. | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 31 30 2e 30 2e 30 2e 35 00 00 ......10 .0.0.5.. | ||
+ | 00 00 00 00 00 00 57 49 4e 53 54 45 49 4e 00 00 ......WI NSTEIN.. | ||
+ | 7c f2 f6 00 be b0 01 10 68 f3 f6 00 20 e9 91 7c |....... h... ..| | ||
+ | 60 00 92 7c ff ff ff ff 5d 00 92 7c 67 a4 01 10 `..|.... ]..|g... | ||
+ | 00 00 bc 00 00 00 00 00 86 a4 01 10 28 8b 5d 1d ........ ....(.]. | ||
+ | 30 2f 39 00 30 f4 00 00 01 00 00 00 2b 13 89 20 0/9.0... ....+.. | ||
+ | 00 01 02 03 00 ff ff ff 01 07 01 02 02 07 01 02 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 | ||
+ | |||
+ | |||
+ | The structure of the response is: | ||
+ | ^ byte ^ value ^ description ^ | ||
+ | | 0-3 | '' | ||
+ | | 4-5 | 0x0001 (little endian) | Response to 0x0001 status request | | ||
+ | | 6-22 | '' | ||
+ | | 23-? | | printer name (e.g. '' | ||
+ | | 86-101 | ||
+ | | 102-111 | | Hostname of the locking PC, 0x00 if not connected | | ||
+ | | 112-168 | | FIXME: Unknown connection / locking data | | ||
+ | | 169-172 | serial | ||
+ | | 173-174 | | USB Vendor ID (little endian) | | ||
+ | | 175-176 | | USB Product ID (little endian) | | ||
+ | | 177-192 | | FIXME: Unknown ('' | ||
+ | |||
+ | All other bytes are 0x00. Their meaning is not yet known. | ||
+ | |||
+ | ==== (b) Device detection over SNMP ==== | ||
+ | |||
+ | * Already known devices | ||
No. | No. | ||
40 30.470445 | 40 30.470445 | ||
| | ||
- | ++ | + | |
+ | ==== (c) MAC-address request ==== | ||
+ | |||
+ | Once a response from a print server is obtained, the MAC address of the device is requested via a 9801 config request: | ||
+ | |||
+ | 40 00 07 00 70 74 39 65 32 64 32 66 39 38 30 31 @...pt9e 2d2f9801 | ||
+ | 3a 20 0a : . | ||
+ | 40 00 00 11 00 50 54 39 45 32 44 32 46 30 30 3a @....PT9 E2D2F00: | ||
+ | 31 37 3a 30 38 3a 39 45 3a 32 44 3a 32 46 | ||
+ | |||
+ | Packet format: USB OUT packet header, then 9801 config option request (7 bytes data) | ||
+ | |||
+ | Return data: USB IN packet header, then MAC-address of the print server as a string (11 bytes data) | ||
+ | |||
+ | ==== (d) USB descriptor (0x0007) ==== | ||
+ | |||
+ | SBSU 0x0007 request, return USB descriptor (mostly 13549): | ||
+ | 53 42 53 55 07 00 00 00 SBSU.... | ||
+ | 53 42 53 55 07 00 00 00 00 00 00 00 00 00 00 00 SBSU.... ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 31 33 35 34 39 00 00 00 00 00 ......13 549..... | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 ...... | ||
+ | |||
+ | The structure of the response is: | ||
+ | ^ byte ^ value ^ description ^ | ||
+ | | 0-3 | '' | ||
+ | | 4-5 | 0x0007 (little endian) | Response to 0x0007 request | | ||
+ | | 6-37 | 16 bytes | USB device description | | ||
+ | | 38-42 | 16 bytes | USB device serial number (as string) | | ||
+ | |||
+ | |||
+ | ==== (e) Request basic print server hardware information ==== | ||
+ | |||
+ | Print server hardware information is requested via a 9010 config request: | ||
+ | |||
+ | 40 00 07 00 50 54 39 45 32 44 32 46 39 30 31 30 @...PT9E 2D2F9010 | ||
+ | 3a 0a 00 :.. | ||
+ | 40 00 00 aa 01 50 54 39 45 32 44 32 46 48 61 72 @....PT9 E2D2FHar | ||
+ | 64 77 61 72 65 20 49 44 3a 35 39 34 41 33 34 38 dware ID :594A348 | ||
+ | 43 32 43 0d 0a 46 69 72 6d 77 61 72 65 20 56 65 C2C..Fir mware Ve | ||
+ | 72 73 69 6f 6e 3a 31 34 30 33 0d 0a 4d 41 43 20 rsion:14 03..MAC | ||
+ | 41 64 64 72 65 73 73 3a 30 30 2d 31 37 2d 30 38 Address: 00-17-08 | ||
+ | 2d 39 45 2d 32 44 2d 32 46 0d 0a 50 72 6f 74 6f -9E-2D-2 F..Proto | ||
+ | 63 6f 6c 20 49 44 3a 38 30 34 32 0d 0a 44 65 66 col ID:8 042..Def | ||
+ | 61 75 6c 74 20 4e 61 6d 65 3a 57 50 54 39 45 32 ault Nam e:WPT9E2 | ||
+ | 44 32 46 0d 0a 53 65 72 76 65 72 20 4e 61 6d 65 D2F..Ser ver Name | ||
+ | 3a 50 48 4f 54 4f 53 4d 41 52 54 0d 0a 54 43 50 :PHOTOSM ART..TCP | ||
+ | 2f 49 50 20 49 6e 66 6f 3a 0d 0a 49 50 20 41 64 /IP Info :..IP Ad | ||
+ | 64 72 65 73 73 3a 31 30 2e 30 2e 30 2e 34 0d 0a dress:10 .0.0.4.. | ||
+ | 53 75 62 6e 65 74 20 4d 61 73 6b 3a 32 35 35 2e Subnet M ask:255. | ||
+ | 32 35 35 2e 32 35 35 2e 30 0d 0a 47 61 74 65 77 255.255. 0..Gatew | ||
+ | 61 79 20 41 64 64 72 65 73 73 3a 31 30 2e 30 2e ay Addre ss:10.0. | ||
+ | 30 2e 31 33 38 0d 0a 57 49 52 45 4c 45 53 53 20 0.138..W IRELESS | ||
+ | 49 6e 66 6f 3a 0d 0a 20 20 53 74 61 74 69 6f 6e Info: | ||
+ | 20 4e 61 6d 65 3a 30 30 2d 31 37 2d 30 38 2d 39 Name:00 -17-08-9 | ||
+ | 45 2d 32 44 2d 32 46 0d 0a 20 20 53 53 49 44 3a E-2D-2F. . SSID: | ||
+ | 6b 61 69 6e 68 6f 66 65 72 0d 0a 20 20 42 53 53 kainhofe r.. BSS | ||
+ | 49 44 3a 33 30 3a 33 39 3a 46 32 3a 35 32 3a 41 ID:30:39 :F2:52:A | ||
+ | 44 3a 37 36 0d 0a 20 20 43 68 61 6e 6e 65 6c 20 D: | ||
+ | 4e 6f 3a 33 0d 0a 20 20 4e 65 74 77 6f 72 6b 20 No: | ||
+ | 54 79 70 65 3a 49 6e 66 72 61 73 74 72 75 63 74 Type:Inf rastruct | ||
+ | 75 72 65 0d 0a 20 20 4c 69 6e 6b 20 51 75 61 6c ure.. L ink Qual | ||
+ | 69 74 79 3a 4c 6f 77 0d 0a 20 20 53 69 67 6e 61 ity:Low. . Signa | ||
+ | 6c 20 53 74 72 65 6e 67 74 68 3a 45 78 63 65 6c l Streng th:Excel | ||
+ | 6c 65 6e 74 0d 0a 0c | ||
+ | |||
+ | ++++The response as human-readable text| | ||
+ | Hardware ID: | ||
+ | Firmware Version: | ||
+ | MAC Address: | ||
+ | Protocol ID:8042 | ||
+ | Default Name: | ||
+ | Server Name: | ||
+ | TCP/IP Info: | ||
+ | IP Address: | ||
+ | Subnet Mask: | ||
+ | Gateway Address: | ||
+ | WIRELESS Info: | ||
+ | Station Name: | ||
+ | SSID: | ||
+ | BSSID: | ||
+ | Channel No:3 | ||
+ | Network Type: | ||
+ | Link Quality: | ||
+ | Signal Strength: | ||
+ | . | ||
+ | ++++ | ||
+ | |||
+ | ==== (f) Request Wireless information ==== | ||
+ | |||
+ | Information about the wireless connection of the print server is obtained via the 9106 config variable: | ||
+ | |||
+ | 40 00 06 00 50 54 39 45 32 44 32 46 39 31 30 36 @...PT9E 2D2F9106 | ||
+ | 3a 0a :. | ||
+ | 40 00 00 95 02 50 54 39 45 32 44 32 46 37 30 30 @....PT9 E2D2F700 | ||
+ | 30 20 53 53 49 44 3a 6b 61 69 6e 68 6f 66 65 72 0 SSID:k ainhofer | ||
+ | 0a 37 30 30 31 20 44 4f 4d 41 49 4e 3a 31 30 0a .7001 DO MAIN:10. | ||
+ | 37 30 30 32 20 43 48 41 4e 4e 45 4c 3a 30 0a 37 7002 CHA NNEL:0.7 | ||
+ | 30 30 33 20 53 45 43 4d 4f 44 45 3a 32 0a 37 30 003 SECM ODE:2.70 | ||
+ | [...] | ||
+ | |||
+ | The response contains all 7xxx variables of the device configuration (see the USB configuration above). This includes the wireless PASSPHRASE IN CLEAR TEXT!!!! | ||
+ | |||
+ | ==== (g) Unknown call ==== | ||
+ | |||
+ | The 9971 config call: | ||
+ | |||
+ | 40 00 06 00 50 54 39 45 32 44 32 46 39 39 37 31 @...PT9E 2D2F9971 | ||
+ | 3a 0a :. | ||
+ | 40 00 00 01 00 50 54 39 45 32 44 32 46 31 | ||
+ | |||
+ | Return value: '' | ||
+ | |||
+ | This call is also called during USB configuration, | ||
+ | |||
+ | |||
+ | ==== (h) Connecting to and locking the printer ==== | ||
+ | |||
+ | A SBSU 0x0002 command is used on TCP port 34447 to connect the printer to the current PC and lock the device for use with the PC: | ||
+ | |||
+ | 53 42 53 55 02 00 31 30 2e 30 2e 30 2e 35 00 00 SBSU..10 .0.0.5.. | ||
+ | 00 00 00 00 38 f4 57 49 4e 53 54 45 49 4e 00 00 ....8.WI NSTEIN.. | ||
+ | 7c f2 f6 00 be b0 01 10 68 f3 f6 00 20 e9 91 7c |....... h... ..| | ||
+ | 60 00 92 7c ff ff ff ff 5d 00 92 7c 67 a4 01 10 `..|.... ]..|g... | ||
+ | 00 00 bc 00 00 00 00 00 86 a4 01 10 28 8b 5d 1d ........ ....(.]. | ||
+ | 30 2f 39 00 30 f4 00 00 00 00 00 00 | ||
+ | 53 42 53 55 02 00 00 00 31 30 2e 30 2e 30 2e 35 SBSU.... 10.0.0.5 | ||
+ | 00 00 00 00 00 00 38 f4 57 49 4e 53 54 45 49 4e ......8. WINSTEIN | ||
+ | 00 00 7c f2 f6 00 be b0 01 10 68 f3 f6 00 20 e9 ..|..... ..h... . | ||
+ | 91 7c 60 00 92 7c ff ff ff ff 5d 00 92 7c 67 a4 .|`..|.. ..]..|g. | ||
+ | 01 10 00 00 bc 00 00 00 00 00 86 a4 01 10 28 8b ........ ......(. | ||
+ | 5d 1d 30 2f 39 00 30 f4 ].0/9.0. | ||
+ | |||
+ | Data format: Request and response have basically the same data, the response has 2 additional 0x00 bytes at position 6-7, while the request has 6 padding 0x00 bytes at the end. | ||
+ | |||
+ | ^ bytes ^ value ^ description ^ | ||
+ | | 0-3 | '' | ||
+ | | 6-19 | IP-address | IP-address (as string) of the locking PC | | ||
+ | | 20-21 | ||
+ | | 22-31 | ||
+ | | 31-83 | ||
+ | |||
+ | ==== (i) FIXME: UNKNOWN, USB over TCP ==== | ||
+ | |||
+ | TCP port 34448 | ||
+ | |||
+ | Each packet of the TCP stream uses the PSH,ACK flags, so each packet is followed by an empty ACK packet in the network communication! These ACK packets are not shown here. | ||
+ | |||
+ | Requesting various USB descriptors: | ||
+ | |||
+ | 0b 00 02 00 00 00 00 01 00 00 00 00 12 00 00 00 ........ ........ | ||
+ | 00 00 00 00 01 00 00 00 ........ | ||
+ | 52 42 52 55 12 00 00 00 02 00 00 00 00 00 00 00 RBRU.... ........ | ||
+ | 01 00 00 00 12 01 00 02 00 00 00 40 2b 13 89 20 ........ ...@+.. | ||
+ | 00 01 01 02 03 01 ...... | ||
+ | 0b 00 02 00 00 00 00 03 00 00 00 00 04 00 00 00 ........ ........ | ||
+ | 00 00 00 00 02 00 00 00 ........ | ||
+ | 52 42 52 55 04 00 00 00 02 00 00 00 00 00 00 00 RBRU.... ........ | ||
+ | 02 00 00 00 04 03 09 04 ........ | ||
+ | 0b 00 02 00 00 00 03 03 09 04 00 00 ff 00 00 00 ........ ........ | ||
+ | 00 00 00 00 03 00 00 00 ........ | ||
+ | 52 42 52 55 0c 00 00 00 02 00 00 32 00 00 00 00 RBRU.... ...2.... | ||
+ | 03 00 00 00 0c 03 31 00 33 00 35 00 34 00 39 00 ......1. 3.5.4.9. | ||
+ | 0b 00 02 ff 00 00 00 01 00 00 00 00 12 00 00 00 ........ ........ | ||
+ | 04 00 00 00 04 00 00 00 ........ | ||
+ | 52 42 52 55 12 00 00 00 02 00 00 3a 04 00 00 00 RBRU.... ...:.... | ||
+ | 04 00 00 00 12 01 00 02 00 00 00 40 2b 13 89 20 ........ ...@+.. | ||
+ | 00 01 01 02 03 01 ...... | ||
+ | 0b 00 02 ff 00 00 00 02 00 00 00 00 09 00 00 00 ........ ........ | ||
+ | 05 00 00 00 05 00 00 00 ........ | ||
+ | 52 42 52 55 09 00 00 00 02 00 00 41 05 00 00 00 RBRU.... ...A.... | ||
+ | 05 00 00 00 09 02 55 00 03 01 00 c0 01 ......U. ..... | ||
+ | 0b 00 02 ff 00 00 00 02 00 00 00 00 55 00 00 00 ........ ....U... | ||
+ | 06 00 00 00 06 00 00 00 ........ | ||
+ | 52 42 52 55 55 00 00 00 02 00 00 32 06 00 00 00 RBRUU... ...2.... | ||
+ | 06 00 00 00 09 02 55 00 03 01 00 c0 01 09 04 00 ......U. ........ | ||
+ | 00 03 ff ff ff 00 07 05 03 02 40 00 00 07 05 84 ........ ..@..... | ||
+ | 02 40 00 00 07 05 85 02 40 00 00 09 04 01 00 02 .@...... @....... | ||
+ | 07 01 02 00 07 05 01 02 40 00 00 07 05 82 02 40 ........ @......@ | ||
+ | 00 00 09 04 02 00 02 07 01 02 00 07 05 06 02 40 ........ .......@ | ||
+ | 00 00 07 05 87 02 40 00 00 ......@. . | ||
+ | 00 00 02 00 00 00 01 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 07 00 00 00 07 00 00 00 ........ | ||
+ | 00 00 02 01 00 00 01 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 07 00 00 00 07 00 00 00 ........ | ||
+ | 52 42 52 55 64 00 00 00 02 00 00 00 07 00 00 00 RBRUd... ........ | ||
+ | 07 00 00 00 ff ff ff 03 03 02 40 00 00 00 84 02 ........ ..@..... | ||
+ | 40 00 00 00 85 02 40 00 00 00 00 00 00 00 00 00 @.....@. ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 ........ | ||
+ | 52 42 52 55 64 00 00 00 02 00 00 00 07 00 00 00 RBRUd... ........ | ||
+ | 07 00 00 00 07 01 02 02 01 02 40 00 00 00 82 02 ........ ..@..... | ||
+ | 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @....... ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 ........ | ||
+ | 00 00 02 02 00 00 01 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 07 00 00 00 07 00 00 00 ........ | ||
+ | 52 42 52 55 64 00 00 00 02 00 00 00 07 00 00 00 RBRUd... ........ | ||
+ | 07 00 00 00 07 01 02 02 06 02 40 00 00 00 87 02 ........ ..@..... | ||
+ | 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @....... ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | ||
+ | 00 00 00 00 00 00 00 00 ........ | ||
+ | |||
+ | |||
+ | ==== (j) USB CONTROL in (printer desc) ==== | ||
+ | |||
+ | TCP port 34448 | ||
+ | |||
+ | Each packet of the TCP stream uses the PSH,ACK flags, so each packet is followed by an empty ACK packet in the network communication! These ACK packets are not shown here. | ||
+ | |||
+ | 1b 00 02 ff 00 03 00 00 00 00 00 01 f1 03 00 00 ........ ........ | ||
+ | 0c 00 00 00 0c 00 00 00 ........ | ||
+ | 52 42 52 55 36 00 00 00 02 00 00 00 0c 00 00 00 RBRU6... ........ | ||
+ | 0c 00 00 00 00 36 4d 46 47 3a 4b 4f 4e 49 43 41 .....6MF G:KONICA | ||
+ | 20 4d 49 4e 4f 4c 54 41 3b 43 4d 44 3a 47 44 49 MINOLTA ;CMD:GDI | ||
+ | 3b 4d 44 4c 3a 6d 63 31 36 39 30 4d 46 3b 43 4c ;MDL:mc1 690MF;CL | ||
+ | 53 3a 50 52 49 4e 54 45 52 3b | ||
+ | 1b 00 02 ff 00 03 00 00 00 00 00 02 f1 03 00 00 ........ ........ | ||
+ | 0d 00 00 00 0d 00 00 00 ........ | ||
+ | 52 42 52 55 3c 00 00 00 02 00 00 00 0d 00 00 00 RBRU<... ........ | ||
+ | 0d 00 00 00 00 3c 4d 46 47 3a 4b 4f 4e 49 43 41 .....<MF G:KONICA | ||
+ | 20 4d 49 4e 4f 4c 54 41 3b 43 4d 44 3a 47 44 49 MINOLTA ;CMD:GDI | ||
+ | 3b 4d 44 4c 3a 6d 63 31 36 39 30 4d 46 20 28 46 ;MDL:mc1 690MF (F | ||
+ | 41 58 29 3b 43 4c 53 3a 50 52 49 4e 54 45 52 3b AX);CLS: PRINTER; | ||
+ | |||
+ | ==== (k) Disconnecting and Unlocking the printer | ||
+ | |||
+ | TCP port 34447 | ||
+ | |||
+ | 53 42 53 55 03 00 00 00 SBSU.... | ||
+ | |||
+ | |||
+ | ==== Order of calls ==== | ||
+ | |||
+ | Starting setup programm in Windows to detect all devices, no printer plugged in: | ||
+ | - a) a) a) ... SBSU 0x0001 (status) broadcasts, response from device (UDP port 34447) | ||
+ | - c) c) c) ... 9801: MAC request + response | ||
+ | - a) a)... ... SBSU 0x0001 (status) request to known IP-address, repeated until printer is plugged in (response contains printer information) or timeout is reached (UDP port 34447) | ||
+ | |||
+ | When a printer is plugged in: | ||
+ | - a) ... SBSU 0x0001 (status) request to known IP-address, response contains printer information (UDP port 34447) | ||
+ | - d) ... SBSU 0x0007 (some USB descriptor) (UDP port 34447) | ||
+ | - a)... ... Some status broadcasts and some requests to the known IP (UDP port 34447) | ||
+ | - e) ... 9010: Hardware information (UDP port 34444) | ||
+ | - f) ... 9106: Wireless information (UDP port 34444) | ||
+ | - g) ... 9971: Unknown (UDP port 34444) | ||
+ | - f) ... 9106: Wireless information (UDP port 34444) | ||
+ | - a)d)repeated ... SBSU 0x0001/ | ||
+ | |||
+ | Print server device info: | ||
+ | - e)f) e)f) c) f)g)f) ... device info (UDP port 34444) | ||
+ | - d) ... SBSU 0x0007 (some USB descriptor) (UDP port 34447) | ||
+ | |||
+ | Establishing a connection to the printer through the utility on Windows: | ||
+ | - h) ... SBSU 0x0002 (connect/ | ||
+ | - a) ... SBSU 0x0001 (status), showing the successfull lock (UDP port 34447) | ||
+ | - i) ... USB descriptor requests, response '' | ||
+ | long pause | ||
+ | - j) ... USB CONTROL in (printer desc requested) (TCP port 34448) | ||
+ | |||
+ | Unlocking/ | ||
+ | - k) ... SBSU 0x0003 (disconnect) (TCP port 34447) | ||
+ | - a) ... SBSU 0x0001 (status), showing the unlock (UDP port 34447) | ||
hardware/hp2101nw_wlan_printserver.txt · Zuletzt geändert: 2013/03/13 10:42 von 127.0.0.1