Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- hardware:hp2101nw_wlan_printserver [2011/12/13 21:24] – reinhold
+++ hardware:hp2101nw_wlan_printserver [2013/03/13 10:42] (aktuell) – Externe Bearbeitung 127.0.0.1
@@ Zeile 574: / Zeile 574: @@
 ===== Network communication protocol (USB port forwarding over WLAN) =====
+There are three different types of communications:
+  - Device information requests: UDP port 34444 (data format: "@\0[len][DEVNAME][OPTIONID]:[VALUE]\n")
+  - Detection, configuration and locking: TCP & UDP port 34447 (data format: "SBSU[Cmd][args]")
+  - USB over TCP: TCP port 34448 (data format: [type][18byte header], Response "RBRU[len]...")
   * TCP Ports 34447, 34448 and 34450 are open and used
   * UDP Ports 34444 and 34447 are used for discovery broadcast and other device communication
-There are to different types of communications:
-  - communication with the print server for configuration / printer detection and locking
-  - communication with the printer trough the print server
 === General communication packet structure for print server communication ===
@@ Zeile 605: / Zeile 610: @@
 |  5-12  | sendername     | boxname of the sending device (something like "PT9E2D2F", "PT" + last 6 bytes of MAC) |
 |  12-...  | packet contents  | config-file format described under the USB device configuration  |
+Known config request calls are:
+^ OPTIONID ^ description ^
+|  9010    | Hardware information (MAC, IP, wireless information etc.) |
+|  9801    | request MAC address |
 === Communication packet structure for printer communication (through print server) ===
@@ Zeile 616: / Zeile 627: @@
 |  0x0001  | request device status, returns printserver name, connected printer and ... TODO |
 |  0x0007  | ?? |
+=== USB over TCP packet structure (TCP port 34448) ===
+The USB over TCP communication with the printer uses TCP port 34448.
+Example:
+b 00 02 00 00 00 00 01  00 00 00 00 12 00 00 00 ........ ........
+00 00 00 01 00 00 00                          ........
+42 52 55 12 00 00 00  02 00 00 00 00 00 00 00 RBRU.... ........
+00 00 00 12 01 00 02  00 00 00 40 2b 13 89 20 ........ ...@ ..
+01 01 02 03 01                                ......
+The packets sent to the printer have a length of 24 bytes, first byte seems to be the command. After the header comes the actual USB packet contents (empty for USB control calls).
+^ bytes ^ description ^
+|  0  | command: 0x00=GET interface information (FIXME), 0x09=BULK FIXME, 0x0b=GET DESCRIPTOR, 0x1b=URB_CONTROL In |
+|  1-5  | FIXME: UNKNOWN |
+|  3  | For GET interface information: Interface to request info for (0x00, 0x01, 0x02) |
+|  6  | For GET DESCRIPTOR: DESCRIPTOR index, Otherwise: FIXME UNKNOWN |
+|  7  | For GET DESCRIPTOR: DESCRIPTOR type (0x01=DEVICE, 0x02=CONFIGURATION, 0x03=STRING), Otherwise: FIXME UNKNOWN |
+|  8-9  | FIXME: UNKNOWN, for URB_CONTROL In: wValue, for STRING DESCRIPTOR: languageId |
+|  10-11  | FIXME: UNKNOWN, for URB_CONTROL In: wIndex |
+|  12-15  | For GET DESCRIPTOR: expected data length (excluding response header), URB_CONTROL In: URB length or wLength, little endian |
+|  16-19  | serial (little endian): sometimes 0x00000000, mostly equal to bytes 20-23 |
+|  20-23  | serial (little endian): Incremented with each USB command |
+The resonse packets will quote bytes 16-23 (even if 16-19 is 0x00)
+The response packets have a 16 bytes head, after which the contents of the USB packet are sent.
+^ byte ^ description ^
+|  0-3  | ''RBRU'' magic ("URBR" in little endian) |
+|  4-7  | length of the packet data after the header (excluding this header) |
+|  8-10 | FIXME: UNKNOWN, mostly 0x02 0x00 0x00 |
+|  11   | FIXME: UNKNOWN (values 0x00, 0x32, 0x3a, 0x41) |
+|  12-19  | Bytes 16-23 of the request (serial) |
+|  20-...  | USB packet contents  |
@@ Zeile 627: / Zeile 674: @@
 Packet type: SBSU command ''0x0001'' (status)
-Resonse: either no response at all (i.e. no print server), or a SBSU ''0x0001'' response giving details about the connected printer.
+Response: either no response at all (i.e. no print server), or a SBSU ''0x0001'' response giving details about the connected printer.
 If no printer is connected, the response looks like:
@@ Zeile 663: / Zeile 711: @@
 00 00 00 00 00 00 00  00 00 00 00             ........ ....
-If a printer is connected, the response looks like:
+If a printer is plugged in, the response looks like:
 42 53 55 01 00                                SBSU..
 42 53 55 01 00 57 50  54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F.
@@ Zeile 696: / Zeile 744: @@
 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
 00 00 00 00 00 00 00  00 00 00 00             ........ ....
+If the Windows driver has the device connected and locked, the response looks:
+42 53 55 01 00 57 50  54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F.
+00 00 00 00 00 6d 63  31 36 39 30 4d 46 00 00 ......mc 1690MF..
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 31 30  2e 30 2e 30 2e 35 00 00 ......10 .0.0.5..
+00 00 00 00 00 57 49  4e 53 54 45 49 4e 00 00 ......WI NSTEIN..
+c f2 f6 00 be b0 01 10  68 f3 f6 00 20 e9 91 7c |....... h... ..|
+00 92 7c ff ff ff ff  5d 00 92 7c 67 a4 01 10 `..|.... ]..|g...
+00 bc 00 00 00 00 00  86 a4 01 10 28 8b 5d 1d ........ ....(.].
+2f 39 00 30 f4 00 00  01 00 00 00 2b 13 89 20 0/9.0... ....+..
+01 02 03 00 ff ff ff  01 07 01 02 02 07 01 02 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00             ........ ....
 The structure of the response is:
@@ Zeile 703: / Zeile 785: @@
 | 6-22  | ''WPT9E2D2F''  | device name of the print server (''WPT'' + last 9 bytes of MAC), padded with 0x00 to 16 bytes |
 | 23-?  |                | printer name (e.g. ''mc1690MF''), padded with 0x00 |
-| 169   | 0x01  | FIXME: Unknown, always 0x01 (whether a printer is connected or not) |
+| 86-101  | ''10.0.0.4''  | IP-address (as string) of the locking PC, 0x00 if not connected |
+| 102-111 |               | Hostname of the locking PC, 0x00 if not connected |
+| 112-168 |               | Locking data (as sent with the SBSU 0x07 locking command) |
+| 169-172 | serial  | 0x01; if printer is connected/locked, incremented with each status request (every 3 seconds) |
 | 173-174 |     | USB Vendor ID (little endian) |
 | 175-176 |     | USB Product ID (little endian) |
-| 177-192 |     | FIXME: Unknown (''00 01 02 03 00 ff ff ff  01 07 01 02 02 07 01 02'') |
+^ USB device interface information: ^^^
+| 177 | iConfiguration(?)    |  |
+| 178 | bConfigurationValue(?)    |  |
+| 179 | bDescriptorType(?)    |  |
+| 180 | bNumInterfaces  | Nr. of interfaces  |
+| 181-...   || interface info (4 bytes per interface) |
+|     | bInterfaceNumber   | Byte 0: ifNumber |
+|     | bInterfaceClass    | Byte 1: ifClass |
+|     | bInterfaceSubClass | Byte 2: ifSubclass |
+|     | bInterfaceProtocol | Byte 3: ifProto |
 All other bytes are 0x00. Their meaning is not yet known.
@@ Zeile 727: / Zeile 822: @@
 Packet format: USB OUT packet header, then 9801 config option request (7 bytes data)
 Return data: USB IN packet header, then MAC-address of the print server as a string (11 bytes data)
@@ Zeile 743: / Zeile 839: @@
 | 0-3  | ''SBSU'' | magic header indicating a USBS communication packet over UDP |
 | 4-5  | 0x0007 (little endian) | Response to 0x0007 request |
-| 38-42   |  ''13549''   | FIXME: Unknown, some USB descriptor (?) |
+| 6-37 | 16 bytes | USB device description |
-| 173-174 |  0x132b  | USB Vendor ID (little endian) |
+| 38-42  | 16 bytes   | USB device serial number (as string) |
-| 175-176 |  0x2089  | USB Product ID (little endian) |
-| 177-178 |  0x0100  | USB bcdDevice (little endian), TODO: Or iManufacturer or bNumConfigurations??? |
-| 177-192 |     | FIXME: Unknown (''02 03 00 ff ff ff  01 07 01 02 02 07 01 02'') |
-All other bytes are 0x00. Their meaning is not yet known.
@@ Zeile 787: / Zeile 878: @@
 c 65 6e 74 0d 0a 0c                             lent...
-++The response as human-readable text|
+++++The response as human-readable text|
   Hardware ID:594A348C2C
   Firmware Version:1403
@@ Zeile 807: / Zeile 898: @@
     Signal Strength:Excellent
   .
-++
+++++
+==== (f) Request Wireless information ====
+Information about the wireless connection of the print server is obtained via the 9106 config variable:
+00 06 00 50 54 39 45  32 44 32 46 39 31 30 36 @...PT9E 2D2F9106
+a 0a                                            :.
+00 00 95 02 50 54 39  45 32 44 32 46 37 30 30 @....PT9 E2D2F700
+20 53 53 49 44 3a 6b  61 69 6e 68 6f 66 65 72 0 SSID:k ainhofer
+a 37 30 30 31 20 44 4f  4d 41 49 4e 3a 31 30 0a .7001 DO MAIN:10.
+30 30 32 20 43 48 41  4e 4e 45 4c 3a 30 0a 37 7002 CHA NNEL:0.7
+30 33 20 53 45 43 4d  4f 44 45 3a 32 0a 37 30 003 SECM ODE:2.70
+      [...]
+The response contains all 7xxx variables of the device configuration (see the USB configuration above). This includes the wireless PASSPHRASE IN CLEAR TEXT!!!!
+==== (g) Unknown call ====
+The 9971 config call:
+00 06 00 50 54 39 45  32 44 32 46 39 39 37 31 @...PT9E 2D2F9971
+a 0a                                            :.
+00 00 01 00 50 54 39  45 32 44 32 46 31       @....PT9 E2D2F1
+Return value: ''1''
+This call is also called during USB configuration, after the network is scanned for ad-hoc setup.
+==== (h) Connecting to and locking the printer ====
+A SBSU 0x0002 command is used on TCP port 34447 to connect the printer to the current PC and lock the device for use with the PC:
+42 53 55 02 00 31 30  2e 30 2e 30 2e 35 00 00 SBSU..10 .0.0.5..
+00 00 00 38 f4 57 49  4e 53 54 45 49 4e 00 00 ....8.WI NSTEIN..
+c f2 f6 00 be b0 01 10  68 f3 f6 00 20 e9 91 7c |....... h... ..|
+00 92 7c ff ff ff ff  5d 00 92 7c 67 a4 01 10 `..|.... ]..|g...
+00 bc 00 00 00 00 00  86 a4 01 10 28 8b 5d 1d ........ ....(.].
+2f 39 00 30 f4 00 00  00 00 00 00             0/9.0... ....
+42 53 55 02 00 00 00  31 30 2e 30 2e 30 2e 35 SBSU.... 10.0.0.5
+00 00 00 00 00 38 f4  57 49 4e 53 54 45 49 4e ......8. WINSTEIN
+00 7c f2 f6 00 be b0  01 10 68 f3 f6 00 20 e9 ..|..... ..h... .
+7c 60 00 92 7c ff ff  ff ff 5d 00 92 7c 67 a4 .|`..|.. ..]..|g.
+10 00 00 bc 00 00 00  00 00 86 a4 01 10 28 8b ........ ......(.
+d 1d 30 2f 39 00 30 f4                          ].0/9.0.
+Data format: Request and response have basically the same data, the response has 2 additional 0x00 bytes at position 6-7, while the request has 6 padding 0x00 bytes at the end.
+^ bytes ^ value ^ description ^
+|  0-3  | ''SBSU'' | magic header indicating a USBS communication packet over TCP/UDP |
+|  6-19  | IP-address | IP-address (as string) of the locking PC |
+|  20-21   |  0x38 0xf4  | FIXME: Unknown |
+|  22-31   |     | hostname of the locking PC |
+|  31-83   |     | FIXME: Unknown |
+==== (i) FIXME: UNKNOWN, USB over TCP ====
+TCP port 34448
+Each packet of the TCP stream uses the PSH,ACK flags, so each packet is followed by an empty ACK packet in the network communication! These ACK packets are not shown here.
+Requesting various USB descriptors:
+b 00 02 00 00 00 00 01  00 00 00 00 12 00 00 00 ........ ........
+00 00 00 01 00 00 00                          ........
+42 52 55 12 00 00 00  02 00 00 00 00 00 00 00 RBRU.... ........
+00 00 00 12 01 00 02  00 00 00 40 2b 13 89 20 ........ ...@+..
+01 01 02 03 01                                ......
+b 00 02 00 00 00 00 03  00 00 00 00 04 00 00 00 ........ ........
+00 00 00 02 00 00 00                          ........
+42 52 55 04 00 00 00  02 00 00 00 00 00 00 00 RBRU.... ........
+00 00 00 04 03 09 04                          ........
+b 00 02 00 00 00 03 03  09 04 00 00 ff 00 00 00 ........ ........
+00 00 00 03 00 00 00                          ........
+42 52 55 0c 00 00 00  02 00 00 32 00 00 00 00 RBRU.... ...2....
+00 00 00 0c 03 31 00  33 00 35 00 34 00 39 00 ......1. 3.5.4.9.
+b 00 02 ff 00 00 00 01  00 00 00 00 12 00 00 00 ........ ........
+00 00 00 04 00 00 00                          ........
+42 52 55 12 00 00 00  02 00 00 3a 04 00 00 00 RBRU.... ...:....
+00 00 00 12 01 00 02  00 00 00 40 2b 13 89 20 ........ ...@+..
+01 01 02 03 01                                ......
+b 00 02 ff 00 00 00 02  00 00 00 00 09 00 00 00 ........ ........
+00 00 00 05 00 00 00                          ........
+42 52 55 09 00 00 00  02 00 00 41 05 00 00 00 RBRU.... ...A....
+00 00 00 09 02 55 00  03 01 00 c0 01          ......U. .....
+b 00 02 ff 00 00 00 02  00 00 00 00 55 00 00 00 ........ ....U...
+00 00 00 06 00 00 00                          ........
+42 52 55 55 00 00 00  02 00 00 32 06 00 00 00 RBRUU... ...2....
+00 00 00 09 02 55 00  03 01 00 c0 01 09 04 00 ......U. ........
+03 ff ff ff 00 07 05  03 02 40 00 00 07 05 84 ........ ..@.....
+40 00 00 07 05 85 02  40 00 00 09 04 01 00 02 .@...... @.......
+01 02 00 07 05 01 02  40 00 00 07 05 82 02 40 ........ @......@
+00 09 04 02 00 02 07  01 02 00 07 05 06 02 40 ........ .......@
+00 07 05 87 02 40 00  00                      ......@. .
+00 02 00 00 00 01 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 07 00 00 00                          ........
+00 02 01 00 00 01 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 07 00 00 00                          ........
+42 52 55 64 00 00 00  02 00 00 00 07 00 00 00 RBRUd... ........
+00 00 00 ff ff ff 03  03 02 40 00 00 00 84 02 ........ ..@.....
+00 00 00 85 02 40 00  00 00 00 00 00 00 00 00 @.....@. ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00                          ........
+42 52 55 64 00 00 00  02 00 00 00 07 00 00 00 RBRUd... ........
+00 00 00 07 01 02 02  01 02 40 00 00 00 82 02 ........ ..@.....
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 @....... ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00                          ........
+00 02 02 00 00 01 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 07 00 00 00                          ........
+42 52 55 64 00 00 00  02 00 00 00 07 00 00 00 RBRUd... ........
+00 00 00 07 01 02 02  06 02 40 00 00 00 87 02 ........ ..@.....
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 @....... ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
+00 00 00 00 00 00 00                          ........
+==== (j) USB CONTROL in (printer desc) ====
+TCP port 34448
+Each packet of the TCP stream uses the PSH,ACK flags, so each packet is followed by an empty ACK packet in the network communication! These ACK packets are not shown here.
+b 00 02 ff 00 03 00 00  00 00 00 01 f1 03 00 00 ........ ........
+c 00 00 00 0c 00 00 00                          ........
+42 52 55 36 00 00 00  02 00 00 00 0c 00 00 00 RBRU6... ........
+c 00 00 00 00 36 4d 46  47 3a 4b 4f 4e 49 43 41 .....6MF G:KONICA
+4d 49 4e 4f 4c 54 41  3b 43 4d 44 3a 47 44 49  MINOLTA ;CMD:GDI
+b 4d 44 4c 3a 6d 63 31  36 39 30 4d 46 3b 43 4c ;MDL:mc1 690MF;CL
+3a 50 52 49 4e 54 45  52 3b                   S:PRINTE R;
+b 00 02 ff 00 03 00 00  00 00 00 02 f1 03 00 00 ........ ........
+d 00 00 00 0d 00 00 00                          ........
+42 52 55 3c 00 00 00  02 00 00 00 0d 00 00 00 RBRU<... ........
+d 00 00 00 00 3c 4d 46  47 3a 4b 4f 4e 49 43 41 .....<MF G:KONICA
+4d 49 4e 4f 4c 54 41  3b 43 4d 44 3a 47 44 49  MINOLTA ;CMD:GDI
+b 4d 44 4c 3a 6d 63 31  36 39 30 4d 46 20 28 46 ;MDL:mc1 690MF (F
+58 29 3b 43 4c 53 3a  50 52 49 4e 54 45 52 3b AX);CLS: PRINTER;
+==== (k) Disconnecting and Unlocking the printer
+TCP port 34447
+42 53 55 03 00 00 00                          SBSU....
@@ Zeile 813: / Zeile 1056: @@
 Starting setup programm in Windows to detect all devices, no printer plugged in:
-  - a) a) a)   ... SBSU 0x0001 (status) broadcasts, response from device (port 34447)
+  - a) a) a)   ... SBSU 0x0001 (status) broadcasts, response from device (UDP port 34447)
-  - c) c) c)   ... 9801: MAC request + response  (port 34444)
+  - c) c) c)   ... 9801: MAC request + response  (UDP port 34444)
-  - a) a)...   ... SBSU 0x0001 (status) request to known IP-address, repeated until printer is plugged in (response contains printer information) or timeout is reached (port 34447)
+  - a) a)...   ... SBSU 0x0001 (status) request to known IP-address, repeated until printer is plugged in (response contains printer information) or timeout is reached (UDP port 34447)
 When a printer is plugged in:
-  - a)         ... SBSU 0x0001 (status) request to known IP-address, response contains printer information (port 34447)
+  - a)         ... SBSU 0x0001 (status) request to known IP-address, response contains printer information (UDP port 34447)
-  - d)         ... SBSU 0x0007 (some USB descriptor) (port 34447)
+  - d)         ... SBSU 0x0007 (some USB descriptor) (UDP port 34447)
-  - a)...      ... Some status broadcasts and some requests to the known IP (port 34447)
+  - a)...      ... Some status broadcasts and some requests to the known IP (UDP port 34447)
-  - e)
+  - e)         ... 9010: Hardware information (UDP port 34444)
+  - f)         ... 9106: Wireless information (UDP port 34444)
+  - g)         ... 9971: Unknown (UDP port 34444)
+  - f)         ... 9106: Wireless information (UDP port 34444)
+  - a)d)repeated ... SBSU 0x0001/0x0007 repeated every 3 seconds (as long as the print server is connected) (UDP port 34447)
+Print server device info:
+  - e)f) e)f) c) f)g)f) ... device info (UDP port 34444)
+  - d)         ... SBSU 0x0007 (some USB descriptor) (UDP port 34447)
+Establishing a connection to the printer through the utility on Windows:
+  - h)         ... SBSU 0x0002 (connect/lock) (TCP port 34447)
+  - a)         ... SBSU 0x0001 (status), showing the successfull lock (UDP port 34447)
+  - i)         ... USB descriptor requests, response ''RBSU'' (TCP port 34448)
+long pause
+  - j)         ... USB CONTROL in (printer desc requested) (TCP port 34448)
+Unlocking/disconnecting the printer through the utility on Windows:
+  - k)         ... SBSU 0x0003 (disconnect) (TCP port 34447)
+  - a)         ... SBSU 0x0001 (status), showing the unlock (UDP port 34447)