Configuration and wifi protocol of the HP 2101nw USB wireless G print server

This device is not really a print server, but rather a USB port forwarder over WLAN. It has a USB micro connection for configuration (config only via USB!) and a normal USB plug for the printer.

Configuration protocol (micro USB port)

USB-ID: 03f0:cd02

Output of ''lusb -v''

Bus 002 Device 006: ID 03f0:cd02 Hewlett-Packard 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x03f0 Hewlett-Packard
  idProduct          0xcd02 
  bcdDevice            0.01
  iManufacturer           1 Sercomm Corporation
  iProduct                2 Wireless Printer Adapter
  iSerial                 3 .
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           39
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              10
Device Status:     0x0000
  (Bus Powered)

The whole configuration works via USB BULK commands
Each packet has the usual 64-bytes URB header 0000 80 47 e3 ad 00 88 ff ff 53 03 01 06 02 00 2d 00 .G……S…..-. 0010 fb 05 de 4e 00 00 00 00 da 3a 05 00 8d ff ff ff …N…..:…… 0020 12 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 ……………. 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….
The general USB communication follows the USB standard, i.e. each communication is always initiated by the USB host, either by sending a packet with the appropriate data or by an empty packet to request data from the client, and answered by the USB client (by either an empty acknowledge packet or by a packet containing the requested data):
- URB_BULK out (URB_SUBMIT), sent by host, containing the command
- URB_BULK out (URB_COMPLETE), returned by host, empty, only 64-bytes header
- URB_BULK in (URB_SUBMIT), sent by host, empty, only 64-bytes header (request data from client)
- URB_BULK in (URB_COMPLETE), returned by host, containing the response data

All responses are split into individual packages with a maximum length of 320 (including the header). If the data is longer, the response is split into multiple packets, each of which has to be requested by an empty URB_BULK in (URB_SUBMIT) by the host.

In the following, only the actual data transferred will be shown, no URB headers and not empty acknowledge/request packets are shown.

USB packet data format

All data packets sent to (OUT) / received from (IN) the device have their own custom header (IN: 12 bytes, OUT: 13 bytes) inside the packet data, which contains one magic byte (@), the size of the data and the boxname („XXXXXXXX“ describing the USB host, or something like „PT9E2D2F“ for the device). After this this 12/13 bytes header follows the actual content of the packet, which consists of \n-separated lines (i.e. 0x0a linefeed). Each entry has the form

OPTIONID [OPTIONNAME]:VALUE

The OPTIONID followed by an ordinary space (0x20). The OPTIONNAME is typically empty when sending data from the USB host to the device. VALUE can be empty or any other string describing the option value.

header format

Header for OUT packets (sent from the USB host to the device):

40 00 ll ll 58 58 58 58 58 58 58 58            @...XXXXXXXX

byte(s)	value	description
0	0x40 (@)	magic byte indicating a command for the device
1	0x00 (\0)	Unknown, always 0
2-3	content length	Length of the packet contents (excluding this header), LITTLE ENDIAN (lower byte first)
4-11	sendername	boxname of the sending USB host (always `XXXXXXXX`)

Header for IN packets (sent from the device to the USB host):

40 00 00 e3 03 50 54 39 45 32 44 32 46         @....PT9E2D2F

byte(s)	value	description
0	0x40 (@)	magic byte indicating a command from the device
1-2	0x0000 (\0\0)	Unknown, always 0
3-4	content length	Length of the packet contents (excluding this header), LITTLE ENDIAN (lower byte first)
5-12	sendername	boxname of the sending device (something like „PT9E2D2F“, „PT“ + last 6 bytes of MAC)

Device option ranges

Range	Command types
0xxx	General system settings (hostname, L1/L2/L3)
4xxx	IP-Address, dhcp, router, etc. settings
5xxx	Unknown (only set, but not returned with configuration
70xx	Infrastructure wireless settings
71xx	Ad-hoc wireless settings
9xxx	Device commands (sent to the device)

Device commands

To send a command (e.g. reset, retrieve config data, etc.) to the device, the same format is used as described above. All commands start with 9xxx and typically don't have any value.

Command	Description	Return value
9002	Reset device	Empty responses (only header) until device is shut down and does not return anything
9100	Request configuration from the device	full device config
9107	Start wlan scan	empty (only header)
9971	Unknown (only called for ad-hoc after network scan)	`1`

USB detection / device capabilities

One USB request (command 9100), returning all configuration options, each on a separate line (0x0a linefeed) character as described above. For a list of all options, see below.

0040  40 00 06 00 58 58 58 58 58 58 58 58 39 31 30 30   @...XXXXXXXX9100
0050  3a 0a                                             :.
    0040  40 00 00 e3 03 50 54 39 45 32 44 32 46 30 30 30   @....PT9E2D2F000
    0050  31 20 42 4f 58 5f 4e 41 4d 45 3a 57 50 54 39 45   1 BOX_NAME:WPT9E
    0060  32 44 32 46 0a 30 30 31 32 20 54 43 50 49 50 5f   2D2F.0012 TCPIP_
    0070  50 20 3a 45 6e 61 62 6c 65 0a 30 31 30 30 20 4c   P :Enable.0100 L
    0080  31 5f 50 52 4f 55 54 3a 50 31 0a 30 31 30 31 20   1_PROUT:P1.0101 
    0090  4c 31 5f 50 52 45 53 54 3a 0a 30 31 30 32 20 4c   L1_PREST:.0102 L
    00a0  31 5f 50 4f 53 54 52 3a 0a 30 31 30 33 20 4c 31   1_POSTR:.0103 L1
    00b0  5f 43 48 47 4c 46 3a 4e 6f 0a 30 31 32 30 20 4c   _CHGLF:No.0120 L
    00c0  32 5f 50 52 4f 55 54 3a 50 31 0a 30 31 32 31 20   2_PROUT:P1.0121 
    00d0  4c 32 5f 50 52 45 53 54 3a 0a 30 31 32 32 20 4c   L2_PREST:.0122 L
    00e0  32 5f 50 4f 53 54 52 3a 0a 30 31 32 33 20 4c 32   2_POSTR:.0123 L2
    00f0  5f 43 48 47 4c 46 3a 4e 6f 0a 30 31 34 30 20 4c   _CHGLF:No.0140 L
    0100  33 5f 50 52 4f 55 54 3a 50 31 0a 30 31 34 31 20   3_PROUT:P1.0141 
    0110  4c 33 5f 50 52 45 53 54 3a 0a 30 31 34 32 20 4c   L3_PREST:.0142 L
    0120  33 5f 50 4f 53 54 52 3a 0a 30 31 34 33 20 4c 33   3_POSTR:.0143 L3
    0130  5f 43 48 47 4c 46 3a 4e 6f 0a 34 30 30 30 20 49   _CHGLF:No.4000 I
    0040  50 5f 41 44 44 52 3a 30 2e 30 2e 30 2e 30 0a 34   P_ADDR:0.0.0.0.4
    0050  30 30 31 20 47 41 54 45 57 41 59 3a 30 2e 30 2e   001 GATEWAY:0.0.
    0060  30 2e 30 0a 34 30 30 32 20 4d 41 53 4b 20 20 20   0.0.4002 MASK   
    0070  3a 30 2e 30 2e 30 2e 30 0a 34 30 31 30 20 54 43   :0.0.0.0.4010 TC
    0080  50 5f 49 4e 54 3a 30 0a 34 30 31 31 20 54 43 50   P_INT:0.4011 TCP
    0090  5f 43 4e 54 3a 30 0a 34 30 31 32 20 57 49 4e 53   _CNT:0.4012 WINS
    00a0  5f 49 50 3a 30 2e 30 2e 30 2e 30 0a 34 30 32 30   _IP:0.0.0.0.4020
    00b0  20 44 48 43 50 5f 4d 4f 44 45 3a 45 6e 61 62 6c    DHCP_MODE:Enabl
    00c0  65 0a 37 30 30 30 20 53 53 49 44 3a 6b 61 69 6e   e.7000 SSID:kain
    00d0  68 6f 66 65 72 0a 37 30 30 31 20 44 4f 4d 41 49   hofer.7001 DOMAI
    00e0  4e 3a 31 30 0a 37 30 30 32 20 43 48 41 4e 4e 45   N:10.7002 CHANNE
    00f0  4c 3a 36 0a 37 30 30 33 20 53 45 43 4d 4f 44 45   L:6.7003 SECMODE
    0100  3a 32 0a 37 30 30 34 20 4b 45 59 5f 4c 45 4e 3a   :2.7004 KEY_LEN:
    0110  30 0a 37 30 30 35 20 44 45 46 41 55 4c 54 4b 45   0.7005 DEFAULTKE
    0120  59 3a 30 0a 37 30 30 36 20 4b 45 59 30 3a 0a 37   Y:0.7006 KEY0:.7
    0130  30 30 37 20 4b 45 59 31 3a 0a 37 30 30 38 20 4b   007 KEY1:.7008 K
    0040  45 59 32 3a 0a 37 30 30 39 20 4b 45 59 33 3a 0a   EY2:.7009 KEY3:.
    0050  37 30 31 32 20 41 55 54 48 45 4e 3a 31 0a 37 30   7012 AUTHEN:1.70
    0060  31 33 20 4d 4f 44 45 3a 30 0a 37 30 31 34 20 4c   13 MODE:0.7014 L
    0070  49 4e 4b 49 4e 46 4f 3a 53 54 41 54 45 3a 44 69   INKINFO:STATE:Di
    0080  73 63 6f 6e 6e 65 63 74 65 64 3b 43 48 41 4e 4e   sconnected;CHANN
    0090  45 4c 3a 36 3b 54 58 52 41 54 45 3a 30 3b 54 58   EL:6;TXRATE:0;TX
    00a0  3a 30 3b 52 58 3a 30 3b 51 55 41 4c 49 54 59 3a   :0;RX:0;QUALITY:
    00b0  4e 6f 74 20 41 70 70 6c 69 63 61 62 6c 65 3b 53   Not Applicable;S
    00c0  54 52 45 4e 47 54 48 3a 4e 6f 74 20 41 70 70 6c   TRENGTH:Not Appl
    00d0  69 63 61 62 6c 65 3b 0a 37 30 31 37 20 57 50 41   icable;.7017 WPA
    00e0  3a 57 50 41 32 0a 37 30 31 38 20 50 53 4b 41 4c   :WPA2.7018 PSKAL
    00f0  53 45 54 3a 30 0a 37 30 31 39 20 50 53 4b 4b 45   SET:0.7019 PSKKE
    0100  59 3a 72 65 69 6e 68 6f 6c 64 0a 37 30 32 30 20   Y:reinhold.7020 
    0110  50 53 4b 41 4c 3a 54 4b 49 50 3b 41 45 53 3b 0a   PSKAL:TKIP;AES;.
    0120  37 30 32 31 20 53 55 52 56 45 59 3a 0a 37 30 32   7021 SURVEY:.702
    0130  33 20 57 50 41 32 41 4c 3a 54 4b 49 50 3b 41 45   3 WPA2AL:TKIP;AE
    0040  53 3b 0a 37 30 32 34 20 53 54 41 4d 4f 44 45 3a   S;.7024 STAMODE:
    0050  30 0a 37 30 32 35 20 41 50 43 48 41 4e 4e 45 4c   0.7025 APCHANNEL
    0060  3a 36 0a 37 30 32 36 20 43 48 4d 4f 44 45 3a 31   :6.7026 CHMODE:1
    0070  0a 37 30 33 30 20 57 4c 4d 4f 44 45 3a 30 0a 37   .7030 WLMODE:0.7
    0080  31 30 30 20 41 50 53 53 49 44 3a 57 50 54 5f 35   100 APSSID:WPT_5
    0090  30 34 35 35 41 0a 37 31 30 33 20 41 50 53 45 43   0455A.7103 APSEC
    00a0  4d 4f 44 45 3a 30 0a 37 31 30 34 20 41 50 4b 45   MODE:0.7104 APKE
    00b0  59 5f 4c 45 4e 3a 30 0a 37 31 30 35 20 41 50 44   Y_LEN:0.7105 APD
    00c0  45 46 41 55 4c 54 4b 45 3a 30 0a 37 31 30 36 20   EFAULTKE:0.7106 
    00d0  41 50 4b 45 59 30 3a 0a 37 31 30 37 20 41 50 4b   APKEY0:.7107 APK
    00e0  45 59 31 3a 0a 37 31 30 38 20 41 50 4b 45 59 32   EY1:.7108 APKEY2
    00f0  3a 0a 37 31 30 39 20 41 50 4b 45 59 33 3a 0a 37   :.7109 APKEY3:.7
    0100  31 31 32 20 41 50 41 55 54 48 45 4e 3a 31 0a 37   112 APAUTHEN:1.7
    0110  31 31 38 20 41 50 50 53 4b 41 4c 53 45 54 3a 30   118 APPSKALSET:0
    0120  0a 37 31 31 39 20 41 50 50 53 4b 4b 45 59 3a 0a   .7119 APPSKKEY:.

The configuration data in human-readable form:

0001 BOX_NAME:WPT9E2D2F
0012 TCPIP_P :Enable
0100 L1_PROUT:P1
0101 L1_PREST:
0102 L1_POSTR:
0103 L1_CHGLF:No
0120 L2_PROUT:P1
0121 L2_PREST:
0122 L2_POSTR:
0123 L2_CHGLF:No
0140 L3_PROUT:P1
0141 L3_PREST:
0142 L3_POSTR:
0143 L3_CHGLF:No
4000 IP_ADDR:0.0.0.0
4001 GATEWAY:0.0.0.0
4002 MASK   :0.0.0.0
4010 TCP_INT:0
4011 TCP_CNT:0
4012 WINS_IP:0.0.0.0
4020 DHCP_MODE:Enable
7000 SSID:kainhofer
7001 DOMAIN:10
7002 CHANNEL:6
7003 SECMODE:2
7004 KEY_LEN:0
7005 DEFAULTKEY:0
7006 KEY0:
7007 KEY1:
7008 KEY2:
7009 KEY3:
7012 AUTHEN:1
7013 MODE:0
7014 LINKINFO:STATE:Disconnected;CHANNEL:6;TXRATE:0;TX:0;RX:0;QUALITY:Not Applicable;STRENGTH:Not Applicable;
7017 WPA:WPA2
7018 PSKALSET:0
7019 PSKKEY:reinhold
7020 PSKAL:TKIP;AES;
7021 SURVEY:
7023 WPA2AL:TKIP;AES;
7024 STAMODE:0
7025 APCHANNEL:6
7026 CHMODE:1
7030 WLMODE:0
7100 APSSID:WPT_50455A
7103 APSECMODE:0
7104 APKEY_LEN:0
7105 APDEFAULTKE:0
7106 APKEY0:
7107 APKEY1:
7108 APKEY2:
7109 APKEY3:
7112 APAUTHEN:1
7118 APPSKALSET:0
7119 APPSKKEY:

Example when print server is connected to a WLAN:

@....PT9E2D2F
0001 BOX_NAME:WPT9E2D2F
0012 TCPIP_P :Enable
0100 L1_PROUT:P1
0101 L1_PREST:
0102 L1_POSTR:
0103 L1_CHGLF:No
0120 L2_PROUT:P1
0121 L2_PREST:
0122 L2_POSTR:
0123 L2_CHGLF:No
0140 L3_PROUT:P1
0141 L3_PREST:
0142 L3_POSTR:
0143 L3_CHGLF:No
4000 IP_ADDR:128.131.192.44
4001 GATEWAY:128.131.192.1
4002 MASK   :255.255.248.0
4010 TCP_INT:0
4011 TCP_CNT:0
4012 WINS_IP:0.0.0.0
4020 DHCP_MODE:Enable
7000 SSID:tunet
7001 DOMAIN:10
7002 CHANNEL:5
7003 SECMODE:0
7004 KEY_LEN:0
7005 DEFAULTKEY:0
7006 KEY0:
7007 KEY1:
7008 KEY2:
7009 KEY3:
7012 AUTHEN:1
7013 MODE:0
7014 LINKINFO:STATE:Associated - BSS ID = B4:A4:E3:B4:F7:23;SSID:tunet;CHANNEL:5;TXRATE:48;TX:0;RX:1440;QUALITY:Low(20%);STRENGTH:Low(20%);
7017 WPA:WPA2
7018 PSKALSET:0
7019 PSKKEY:
7020 PSKAL:TKIP;AES;
7021 SURVEY:
7023 WPA2AL:TKIP;AES;
7024 STAMODE:0
7025 APCHANNEL:5
7026 CHMODE:1
7030 WLMODE:0
7100 APSSID:WPT_50455A
7103 APSECMODE:0
7104 APKEY_LEN:0
7105 APDEFAULTKE:0
7106 APKEY0:
7107 APKEY1:
7108 APKEY2:
7109 APKEY3:
7112 APAUTHEN:1
7118 APPSKALSET:0
7119 APPSKKEY:

Retrieving WLAN access points

A 9107 command initiates a WIFI scan on the device
- after 5 seconds, the full configuration is requested (9100 command).
- The results of the scan are stored in the 7021 SURVEY variable.
- If that variable is empty, the 9107 wifi scan and the 9100 are repeated
Break when the survey returns results.

0040  40 00 07 00 58 58 58 58 58 58 58 58 39 31 30 37   @...XXXXXXXX9107
0050  3a 0d 0a                                          :..
    0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
[5 seconds pause]
0040  40 00 07 00 58 58 58 58 58 58 58 58 39 31 30 30   @...XXXXXXXX9100
0050  3a 0d 0a                                          :..
    0040  40 00 00 e3 03 50 54 39 45 32 44 32 46 30 30 30   @....PT9E2D2F000
    0050  31 20 42 4f 58 5f 4e 41 4d 45 3a 57 50 54 39 45   1 BOX_NAME:WPT9E
    [...]
    0120  37 30 32 31 20 53 55 52 56 45 59 3a 65 64 75 72   7021 SURVEY:edur
    0130  6f 61 6d 0c 62 34 61 34 65 33 62 34 66 37 32 30   oam.b4a4e3b4f720
    0040  2c 35 2c 47 2c 38 2c 31 30 2c 30 0b 77 6c 61 6e   ,5,G,8,10,0.wlan
    0050  69 70 73 65 63 0c 62 34 61 34 65 33 62 34 66 37   ipsec.b4a4e3b4f7
    0060  32 31 2c 35 2c 47 2c 30 2c 32 30 2c 30 0b 61 6d   21,5,G,0,20,0.am
    0070  61 63 69 2e 61 74 0c 30 30 31 64 37 65 33 30 64   aci.at.001d7e30d
    0080  38 30 62 2c 36 2c 47 2c 34 2c 31 30 2c 30 0b 55   80b,6,G,4,10,0.U
    0090  50 43 30 31 31 30 32 35 0c 30 30 31 65 36 39 36   PC011025.001e696
    00a0  32 64 31 66 61 2c 31 2c 47 2c 31 2c 31 30 2c 30   2d1fa,1,G,1,10,0
    00b0  0b 74 75 6e 65 74 0c 62 34 61 34 65 33 62 34 66   .tunet.b4a4e3b4f
    00c0  37 32 33 2c 35 2c 47 2c 30 2c 31 30 2c 30 0b 0a   723,5,G,0,10,0..
    [...]

Format of the 7021 SURVEY variable:

SSID[formfeed 0x0c]MAC-address,channel,A/B/G,encryption,signal,AP/Adhoc[linetab 0x0b]

where

variable
SSID	String containing the SSID of the access point or ad-hoc network
MAC-address	hex-string of AP MAC address (lower-case) without : delimiters
channel	wifi channel (0-11)
A/B/G	Wifi version (A, B, G)
encryption	0=None, 1=WEP, 4=WPA2-PSK, 6=WPA2-PSK, 7=WPA-PSK, 8=WPA2
signal	0/10/20/30/40/50 (max.50)
AP/Adhoc	o=AP, 1=Ad-hoc network

Above example in human-readable format:

eduroam[formfeed]b4a4e3b4f720,5,G,8,10,0[linetab]
wlanipsec[formfeed]b4a4e3b4f721,5,G,0,20,0[linetab]
amaci.at[formfeed]001d7e30d80b,6,G,4,10,0[linetab]
UPC011025[formfeed]001e6962d1fa,1,G,1,10,0[linetab]
tunet[formfeed]b4a4e3b4f723,5,G,0,10,0[linetab]

Ad-hoc network

Network discovery works with the same 9100 and 9107 commands, but afterwards one additional 9971 command is sent:

0040  40 00 06 00 58 58 58 58 58 58 58 58 39 39 37 31   @...XXXXXXXX9971
0050  3a 0a                                             :.
    0040  40 00 00 01 00 50 54 39 45 32 44 32 46 31         @....PT9E2D2F1

Setting the wlan access point

Changing settings on the device works by simply sending a new configuration file containing only those options that should be changed. Example: WLAN settings: ESSID „tunet“, no encryption or authentication, addresses via DHCP

0040  40 00 09 01 58 58 58 58 58 58 58 58 34 30 30 30   @...XXXXXXXX4000
0050  20 3a 30 2e 30 2e 30 2e 30 0a 34 30 30 31 20 3a    :0.0.0.0.4001 :
0060  30 2e 30 2e 30 2e 30 0a 34 30 30 32 20 3a 30 2e   0.0.0.0.4002 :0.
0070  30 2e 30 2e 30 0a 34 30 32 30 20 3a 45 6e 61 62   0.0.0.4020 :Enab
0080  6c 65 0a 34 30 32 31 20 3a 45 6e 61 62 6c 65 0a   le.4021 :Enable.
0090  34 30 32 32 20 3a 45 6e 61 62 6c 65 0a 35 30 30   4022 :Enable.500
00a0  30 20 3a 0a 35 30 30 33 20 3a 0a 35 31 30 31 20   0 :.5003 :.5101 
00b0  3a 0a 35 31 30 32 20 3a 0a 35 31 30 34 20 3a 0a   :.5102 :.5104 :.
00c0  35 31 30 33 20 3a 0a 37 30 30 30 20 3a 74 75 6e   5103 :.7000 :tun
00d0  65 74 0a 37 30 30 31 20 3a 0a 37 30 30 32 20 3a   et.7001 :.7002 :
00e0  35 0a 37 30 30 33 20 3a 30 0a 37 30 30 34 20 3a   5.7003 :0.7004 :
00f0  30 0a 37 30 30 35 20 3a 30 0a 37 30 30 36 20 3a   0.7005 :0.7006 :
0100  0a 37 30 30 37 20 3a 0a 37 30 30 38 20 3a 0a 37   .7007 :.7008 :.7
0110  30 30 39 20 3a 0a 37 30 31 32 20 3a 31 0a 37 30   009 :.7012 :1.70
0120  31 33 20 3a 30 0a 37 30 31 38 20 3a 30 0a 37 30   13 :0.7018 :0.70
0130  31 39 20 3a 0a 37 30 32 34 20 3a 30 0a 37 30 32   19 :.7024 :0.702
0040  35 20 3a 35 0a 37 30 32 36 20 3a 31 0a 37 30 33   5 :5.7026 :1.703
0050  30 20 3a 30 0a                                    0 :0.
    [empty response]
0040  40 00 06 00 58 58 58 58 58 58 58 58 39 30 30 32   @...XXXXXXXX9002
0050  3a 0a                                             :.
    1.) 0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
    2.) 0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
    3.) [empty]

Human-readable form of the config data sent to the device:

@...XXXXXXXX
4000 :0.0.0.0
4001 :0.0.0.0
4002 :0.0.0.0
4020 :Enable
4021 :Enable
4022 :Enable
5000 :
5003 :
5101 :
5102 :
5104 :
5103 :
7000 :tunet
7001 :
7002 :5
7003 :0
7004 :0
7005 :0
7006 :
7007 :
7008 :
7009 :
7012 :1
7013 :0
7018 :0
7019 :
7024 :0
7025 :5
7026 :1
7030 :0

Ad-hoc network settings

0040  40 00 79 00 58 58 58 58 58 58 58 58 37 30 32 34   @.y.XXXXXXXX7024
0050  20 3a 31 0a 37 30 32 35 20 3a 36 0a 37 30 32 36    :1.7025 :6.7026
0060  20 3a 31 0a 37 30 33 30 20 3a 31 0a 37 31 30 30    :1.7030 :1.7100
0070  20 3a 72 65 69 6e 68 6f 63 0a 37 31 30 33 20 3a    :reinhoc.7103 :
0080  30 0a 37 31 30 34 20 3a 30 0a 37 31 30 35 20 3a   0.7104 :0.7105 :
0090  30 0a 37 31 30 36 20 3a 0a 37 31 30 37 20 3a 0a   0.7106 :.7107 :.
00a0  37 31 30 38 20 3a 0a 37 31 30 39 20 3a 0a 37 31   7108 :.7109 :.71
00b0  31 32 20 3a 31 0a 37 31 31 38 20 3a 30 0a 37 31   12 :1.7118 :0.71
00c0  31 39 20 3a 0a                                    19 :.
    [empty response]
0040  40 00 06 00 58 58 58 58 58 58 58 58 39 30 30 32   @...XXXXXXXX9002
0050  3a 0a                                             :.
    1.) 0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
    2.) 0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
    3.) [empty]

Human-readable form of the config data sent to the device:

@.y.XXXXXXXX
7024 :1
7025 :6
7026 :1
7030 :1
7100 :reinhoc
7103 :0
7104 :0
7105 :0
7106 :
7107 :
7108 :
7109 :
7112 :1
7118 :0
7119 :

Resetting the device

The device is reset with the 9002 command, but the timing is extremely relevant to prevent USB errors and/or USB interface being still held open.

0040  40 00 06 00 58 58 58 58 58 58 58 58 39 30 30 32   @...XXXXXXXX9002
0050  3a 0a                                             :.
    1.) 0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
    2.) 0040  40 00 00 00 00 50 54 39 45 32 44 32 46            @....PT9E2D2F
    3.) [empty]

All configuration variables

Var.ID	Var.Name	value	comments
0001	„BOX_NAME“	WPT9E2D2F
0012	„TCPIP_P „	Enable
0100	„L1_PROUT“	P1
0101	„L1_PREST“
0102	„L1_POSTR“
0103	„L1_CHGLF“	No
0120	„L2_PROUT“	P1
0121	„L2_PREST“
0122	„L2_POSTR“
0123	„L2_CHGLF“	No
0140	„L3_PROUT“	P1
0141	„L3_PREST“
0142	„L3_POSTR“
0143	„L3_CHGLF“	No
4000	„IP_ADDR“	128.131.192.44
4001	„GATEWAY“	128.131.192.1
4002	„MASK „	255.255.248.0
4010	„TCP_INT“	0
4011	„TCP_CNT“	0
4012	„WINS_IP“	0.0.0.0
4020	„DHCP_MODE“	Enable
4021	-	Enable	: Unknown
4022	-	Enable	: Unknown
5000	-		: Unknown
5003	-		: Unknown
5101	-		: Unknown
5102	-		: Unknown
5103	-		: Unknown
5104	-		: Unknown
7000	„SSID“	tunet
7001	„DOMAIN“	10
7002	„CHANNEL“	5
7003	„SECMODE“	0
7004	„KEY_LEN“	0
7005	„DEFAULTKEY“	0
7006	„KEY0“
7007	„KEY1“
7008	„KEY2“
7009	„KEY3“
7012	„AUTHEN“	1
7013	„MODE“	0
7014	„LINKINFO“	STATE:Associated - BSS ID = B4:A4:E3:B4:F7:23;SSID:tunet;CHANNEL:5;TXRATE:48;TX:0;RX:1440;QUALITY:Low(20%);STRENGTH:Low(20%);
7017	„WPA“	WPA2
7018	„PSKALSET“	0
7019	„PSKKEY“
7020	„PSKAL“	TKIP;AES;
7021	„SURVEY“
7023	„WPA2AL“	TKIP;AES;
7024	„STAMODE“	0
7025	„APCHANNEL“	5
7026	„CHMODE“	1
7030	„WLMODE“	0
7100	„APSSID“	WPT_50455A
7103	„APSECMODE“	0
7104	„APKEY_LEN“	0
7105	„APDEFAULTKE“	0
7106	„APKEY0“
7107	„APKEY1“
7108	„APKEY2“
7109	„APKEY3“
7112	„APAUTHEN“	1
7118	„APPSKALSET“	0
7119	„APPSKKEY“

Network communication protocol (USB port forwarding over WLAN)

There are three different types of communications:

Device information requests: UDP port 34444 (data format: “@\0[len][DEVNAME][OPTIONID]:[VALUE]\n“)
Detection, configuration and locking: TCP & UDP port 34447 (data format: „SBSU[Cmd][args]“)
USB over TCP: TCP port 34448 (data format: [type][18byte header], Response „RBRU[len]…“)

TCP Ports 34447, 34448 and 34450 are open and used
UDP Ports 34444 and 34447 are used for discovery broadcast and other device communication

General communication packet structure for print server communication

The communication with the print server itself uses UDP port 34444 and a header and packet structure of the form described for the USB communication above.

Structure of OUT packets (sent from the PC to the print server):

40 00 ll ll 50 54 39 45 32 44 32 46 __ __ __...       @...PT9E2D2F___...

byte(s)	value	description
0	0x40 (@)	magic byte indicating a command for the device
1	0x00 (\0)	Unknown, always 0
2-3	content length	Length of the packet contents (excluding this header), LITTLE ENDIAN (lower byte first)
4-11	sendername	RECEIVING USB host (e.g. `PT9E2D2F`)
12-…	packet contents	format is again the config-file format described with the USB device configuration

Structure IN packets (sent from the device to the USB host):

40 00 00 e3 03 50 54 39 45 32 44 32 46 __ __ __...        @....PT9E2D2F___...

byte(s)	value	description
0	0x40 (@)	magic byte indicating a command from the device
1-2	0x0000 (\0\0)	Unknown, always 0
3-4	content length	Length of the packet contents (excluding this header), LITTLE ENDIAN (lower byte first)
5-12	sendername	boxname of the sending device (something like „PT9E2D2F“, „PT“ + last 6 bytes of MAC)
12-…	packet contents	config-file format described under the USB device configuration

Known config request calls are:

OPTIONID	description
9010	Hardware information (MAC, IP, wireless information etc.)
9801	request MAC address

Communication packet structure for printer communication (through print server)

The communication with the printer uses UDP/TCP ports 34447 and a header of the form

SBSU[Cmd][args]

where Cmd is a 2-byte (little endian) command and args is command-specific data of variable length. The response from the device has the same header and contains the response as args. The inial SBSU is the magic string USBS in little endian.

Known Commands are:

Cmd	description
0x0001	request device status, returns printserver name, connected printer and … TODO
0x0007	??

USB over TCP packet structure (TCP port 34448)

The USB over TCP communication with the printer uses TCP port 34448.

Example:

0b 00 02 00 00 00 00 01  00 00 00 00 12 00 00 00 ........ ........
00 00 00 00 01 00 00 00                          ........ 
    52 42 52 55 12 00 00 00  02 00 00 00 00 00 00 00 RBRU.... ........
    01 00 00 00 12 01 00 02  00 00 00 40 2b 13 89 20 ........ ...@ .. 
    00 01 01 02 03 01                                ......

The packets sent to the printer have a length of 24 bytes, first byte seems to be the command. After the header comes the actual USB packet contents (empty for USB control calls).

bytes	description
0	command: 0x00=GET interface information (), 0x09=BULK , 0x0b=GET DESCRIPTOR, 0x1b=URB_CONTROL In
1-5	: UNKNOWN
3	For GET interface information: Interface to request info for (0x00, 0x01, 0x02)
6	For GET DESCRIPTOR: DESCRIPTOR index, Otherwise: UNKNOWN
7	For GET DESCRIPTOR: DESCRIPTOR type (0x01=DEVICE, 0x02=CONFIGURATION, 0x03=STRING), Otherwise: UNKNOWN
8-9	: UNKNOWN, for URB_CONTROL In: wValue, for STRING DESCRIPTOR: languageId
10-11	: UNKNOWN, for URB_CONTROL In: wIndex
12-15	For GET DESCRIPTOR: expected data length (excluding response header), URB_CONTROL In: URB length or wLength, little endian
16-19	serial (little endian): sometimes 0x00000000, mostly equal to bytes 20-23
20-23	serial (little endian): Incremented with each USB command

The resonse packets will quote bytes 16-23 (even if 16-19 is 0x00)

The response packets have a 16 bytes head, after which the contents of the USB packet are sent.

byte	description
0-3	`RBRU` magic („URBR“ in little endian)
4-7	length of the packet data after the header (excluding this header)
8-10	: UNKNOWN, mostly 0x02 0x00 0x00
11	: UNKNOWN (values 0x00, 0x32, 0x3a, 0x41)
12-19	Bytes 16-23 of the request (serial)
20-…	USB packet contents

(a) (Broadcast) Device detection & device status

This command is used for

detecting all available printer servers in the network (UDP broadcast), and for
obtaining the status of one particular print server (UDP packet to one IP address).

UDP packet to port 34447 on address 255.255.255.255 (broadcast) or one particular IP address.

Packet type: SBSU command 0x0001 (status)

Response: either no response at all (i.e. no print server), or a SBSU 0x0001 response giving details about the connected printer.

If no printer is connected, the response looks like:

53 42 53 55 01 00                                SBSU..
    53 42 53 55 01 00 57 50  54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F.
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00             ........ ....

If a printer is plugged in, the response looks like:

53 42 53 55 01 00                                SBSU..
    53 42 53 55 01 00 57 50  54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F.
    00 00 00 00 00 00 6d 63  31 36 39 30 4d 46 00 00 ......mc 1690MF..
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  01 00 00 00 2b 13 89 20 ........ ....+.. 
    00 01 02 03 00 ff ff ff  01 07 01 02 02 07 01 02 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00             ........ ....

If the Windows driver has the device connected and locked, the response looks:

    53 42 53 55 01 00 57 50  54 39 45 32 44 32 46 00 SBSU..WP T9E2D2F.
    00 00 00 00 00 00 6d 63  31 36 39 30 4d 46 00 00 ......mc 1690MF..
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 31 30  2e 30 2e 30 2e 35 00 00 ......10 .0.0.5..
    00 00 00 00 00 00 57 49  4e 53 54 45 49 4e 00 00 ......WI NSTEIN..
    7c f2 f6 00 be b0 01 10  68 f3 f6 00 20 e9 91 7c |....... h... ..|
    60 00 92 7c ff ff ff ff  5d 00 92 7c 67 a4 01 10 `..|.... ]..|g...
    00 00 bc 00 00 00 00 00  86 a4 01 10 28 8b 5d 1d ........ ....(.].
    30 2f 39 00 30 f4 00 00  01 00 00 00 2b 13 89 20 0/9.0... ....+.. 
    00 01 02 03 00 ff ff ff  01 07 01 02 02 07 01 02 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00             ........ ....

The structure of the response is:

byte	value	description
0-3	`SBSU`	magic header indicating a USBS communication packet over UDP
4-5	0x0001 (little endian)	Response to 0x0001 status request
6-22	`WPT9E2D2F`	device name of the print server (`WPT` + last 9 bytes of MAC), padded with 0x00 to 16 bytes
23-?		printer name (e.g. `mc1690MF`), padded with 0x00
86-101	`10.0.0.4`	IP-address (as string) of the locking PC, 0x00 if not connected
102-111		Hostname of the locking PC, 0x00 if not connected
112-168		Locking data (as sent with the SBSU 0x07 locking command)
169-172	serial	0x01; if printer is connected/locked, incremented with each status request (every 3 seconds)
173-174		USB Vendor ID (little endian)
175-176		USB Product ID (little endian)
USB device interface information:
177	iConfiguration(?)
178	bConfigurationValue(?)
179	bDescriptorType(?)
180	bNumInterfaces	Nr. of interfaces
181-…		interface info (4 bytes per interface)
	bInterfaceNumber	Byte 0: ifNumber
	bInterfaceClass	Byte 1: ifClass
	bInterfaceSubClass	Byte 2: ifSubclass
	bInterfaceProtocol	Byte 3: ifProto

All other bytes are 0x00. Their meaning is not yet known.

(b) Device detection over SNMP

Already known devices (IP saved in Windows helper utility) are also polled/detected via SNMP:

No. Time Source Destination Protocol Length Info

  40 30.470445   128.130.51.116        10.0.0.5              SNMP     119    get-request 1.3.6.1.2.1.25.3.2.1.5.1 \
                                               1.3.6.1.2.1.25.3.5.1.1.1 1.3.6.1.2.1.25.3.5.1.2.1

(c) MAC-address request

Once a response from a print server is obtained, the MAC address of the device is requested via a 9801 config request:

40 00 07 00 70 74 39 65  32 64 32 66 39 38 30 31 @...pt9e 2d2f9801
3a 20 0a                                         : .
    40 00 00 11 00 50 54 39  45 32 44 32 46 30 30 3a @....PT9 E2D2F00:
    31 37 3a 30 38 3a 39 45  3a 32 44 3a 32 46       17:08:9E :2D:2F

Packet format: USB OUT packet header, then 9801 config option request (7 bytes data)

Return data: USB IN packet header, then MAC-address of the print server as a string (11 bytes data)

(d) USB descriptor (0x0007)

SBSU 0x0007 request, return USB descriptor (mostly 13549):

53 42 53 55 07 00 00 00                          SBSU.... 
    53 42 53 55 07 00 00 00  00 00 00 00 00 00 00 00 SBSU.... ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 31 33  35 34 39 00 00 00 00 00 ......13 549.....
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00                                ......

The structure of the response is:

byte	value	description
0-3	`SBSU`	magic header indicating a USBS communication packet over UDP
4-5	0x0007 (little endian)	Response to 0x0007 request
6-37	16 bytes	USB device description
38-42	16 bytes	USB device serial number (as string)

(e) Request basic print server hardware information

Print server hardware information is requested via a 9010 config request:

40 00 07 00 50 54 39 45  32 44 32 46 39 30 31 30 @...PT9E 2D2F9010
3a 0a 00                                         :..
    40 00 00 aa 01 50 54 39  45 32 44 32 46 48 61 72 @....PT9 E2D2FHar
    64 77 61 72 65 20 49 44  3a 35 39 34 41 33 34 38 dware ID :594A348
    43 32 43 0d 0a 46 69 72  6d 77 61 72 65 20 56 65 C2C..Fir mware Ve
    72 73 69 6f 6e 3a 31 34  30 33 0d 0a 4d 41 43 20 rsion:14 03..MAC
    41 64 64 72 65 73 73 3a  30 30 2d 31 37 2d 30 38 Address: 00-17-08
    2d 39 45 2d 32 44 2d 32  46 0d 0a 50 72 6f 74 6f -9E-2D-2 F..Proto
    63 6f 6c 20 49 44 3a 38  30 34 32 0d 0a 44 65 66 col ID:8 042..Def
    61 75 6c 74 20 4e 61 6d  65 3a 57 50 54 39 45 32 ault Nam e:WPT9E2
    44 32 46 0d 0a 53 65 72  76 65 72 20 4e 61 6d 65 D2F..Ser ver Name
    3a 50 48 4f 54 4f 53 4d  41 52 54 0d 0a 54 43 50 :PHOTOSM ART..TCP
    2f 49 50 20 49 6e 66 6f  3a 0d 0a 49 50 20 41 64 /IP Info :..IP Ad
    64 72 65 73 73 3a 31 30  2e 30 2e 30 2e 34 0d 0a dress:10 .0.0.4..
    53 75 62 6e 65 74 20 4d  61 73 6b 3a 32 35 35 2e Subnet M ask:255.
    32 35 35 2e 32 35 35 2e  30 0d 0a 47 61 74 65 77 255.255. 0..Gatew
    61 79 20 41 64 64 72 65  73 73 3a 31 30 2e 30 2e ay Addre ss:10.0.
    30 2e 31 33 38 0d 0a 57  49 52 45 4c 45 53 53 20 0.138..W IRELESS
    49 6e 66 6f 3a 0d 0a 20  20 53 74 61 74 69 6f 6e Info:..   Station
    20 4e 61 6d 65 3a 30 30  2d 31 37 2d 30 38 2d 39  Name:00 -17-08-9
    45 2d 32 44 2d 32 46 0d  0a 20 20 53 53 49 44 3a E-2D-2F. .  SSID:
    6b 61 69 6e 68 6f 66 65  72 0d 0a 20 20 42 53 53 kainhofe r..  BSS
    49 44 3a 33 30 3a 33 39  3a 46 32 3a 35 32 3a 41 ID:30:39 :F2:52:A
    44 3a 37 36 0d 0a 20 20  43 68 61 6e 6e 65 6c 20 D:76..   Channel
    4e 6f 3a 33 0d 0a 20 20  4e 65 74 77 6f 72 6b 20 No:3..   Network
    54 79 70 65 3a 49 6e 66  72 61 73 74 72 75 63 74 Type:Inf rastruct
    75 72 65 0d 0a 20 20 4c  69 6e 6b 20 51 75 61 6c ure..  L ink Qual
    69 74 79 3a 4c 6f 77 0d  0a 20 20 53 69 67 6e 61 ity:Low. .  Signa
    6c 20 53 74 72 65 6e 67  74 68 3a 45 78 63 65 6c l Streng th:Excel
    6c 65 6e 74 0d 0a 0c                             lent...

The response as human-readable text

Hardware ID:594A348C2C
Firmware Version:1403
MAC Address:00-17-08-9E-2D-2F
Protocol ID:8042
Default Name:WPT9E2D2F
Server Name:PHOTOSMART
TCP/IP Info:
IP Address:10.0.0.4
Subnet Mask:255.255.255.0
Gateway Address:10.0.0.138
WIRELESS Info:
  Station Name:00-17-08-9E-2D-2F
  SSID:kainhofer
  BSSID:30:39:F2:52:AD:76
  Channel No:3
  Network Type:Infrastructure
  Link Quality:Low
  Signal Strength:Excellent
.

(f) Request Wireless information

Information about the wireless connection of the print server is obtained via the 9106 config variable:

40 00 06 00 50 54 39 45  32 44 32 46 39 31 30 36 @...PT9E 2D2F9106
3a 0a                                            :.
    40 00 00 95 02 50 54 39  45 32 44 32 46 37 30 30 @....PT9 E2D2F700
    30 20 53 53 49 44 3a 6b  61 69 6e 68 6f 66 65 72 0 SSID:k ainhofer
    0a 37 30 30 31 20 44 4f  4d 41 49 4e 3a 31 30 0a .7001 DO MAIN:10.
    37 30 30 32 20 43 48 41  4e 4e 45 4c 3a 30 0a 37 7002 CHA NNEL:0.7
    30 30 33 20 53 45 43 4d  4f 44 45 3a 32 0a 37 30 003 SECM ODE:2.70
    [...]

The response contains all 7xxx variables of the device configuration (see the USB configuration above). This includes the wireless PASSPHRASE IN CLEAR TEXT!!!!

(g) Unknown call

The 9971 config call:

40 00 06 00 50 54 39 45  32 44 32 46 39 39 37 31 @...PT9E 2D2F9971
3a 0a                                            :.
    40 00 00 01 00 50 54 39  45 32 44 32 46 31       @....PT9 E2D2F1

Return value: 1

This call is also called during USB configuration, after the network is scanned for ad-hoc setup.

(h) Connecting to and locking the printer

A SBSU 0x0002 command is used on TCP port 34447 to connect the printer to the current PC and lock the device for use with the PC:

53 42 53 55 02 00 31 30  2e 30 2e 30 2e 35 00 00 SBSU..10 .0.0.5..
00 00 00 00 38 f4 57 49  4e 53 54 45 49 4e 00 00 ....8.WI NSTEIN..
7c f2 f6 00 be b0 01 10  68 f3 f6 00 20 e9 91 7c |....... h... ..|
60 00 92 7c ff ff ff ff  5d 00 92 7c 67 a4 01 10 `..|.... ]..|g...
00 00 bc 00 00 00 00 00  86 a4 01 10 28 8b 5d 1d ........ ....(.].
30 2f 39 00 30 f4 00 00  00 00 00 00             0/9.0... ....
    53 42 53 55 02 00 00 00  31 30 2e 30 2e 30 2e 35 SBSU.... 10.0.0.5
    00 00 00 00 00 00 38 f4  57 49 4e 53 54 45 49 4e ......8. WINSTEIN
    00 00 7c f2 f6 00 be b0  01 10 68 f3 f6 00 20 e9 ..|..... ..h... .
    91 7c 60 00 92 7c ff ff  ff ff 5d 00 92 7c 67 a4 .|`..|.. ..]..|g.
    01 10 00 00 bc 00 00 00  00 00 86 a4 01 10 28 8b ........ ......(.
    5d 1d 30 2f 39 00 30 f4                          ].0/9.0.

Data format: Request and response have basically the same data, the response has 2 additional 0x00 bytes at position 6-7, while the request has 6 padding 0x00 bytes at the end.

bytes	value	description
0-3	`SBSU`	magic header indicating a USBS communication packet over TCP/UDP
6-19	IP-address	IP-address (as string) of the locking PC
20-21	0x38 0xf4	: Unknown
22-31		hostname of the locking PC
31-83		: Unknown

(i) FIXME: UNKNOWN, USB over TCP

TCP port 34448

Each packet of the TCP stream uses the PSH,ACK flags, so each packet is followed by an empty ACK packet in the network communication! These ACK packets are not shown here.

Requesting various USB descriptors:

0b 00 02 00 00 00 00 01  00 00 00 00 12 00 00 00 ........ ........
00 00 00 00 01 00 00 00                          ........ 
    52 42 52 55 12 00 00 00  02 00 00 00 00 00 00 00 RBRU.... ........
    01 00 00 00 12 01 00 02  00 00 00 40 2b 13 89 20 ........ ...@+.. 
    00 01 01 02 03 01                                ......
0b 00 02 00 00 00 00 03  00 00 00 00 04 00 00 00 ........ ........
00 00 00 00 02 00 00 00                          ........ 
    52 42 52 55 04 00 00 00  02 00 00 00 00 00 00 00 RBRU.... ........
    02 00 00 00 04 03 09 04                          ........ 
0b 00 02 00 00 00 03 03  09 04 00 00 ff 00 00 00 ........ ........
00 00 00 00 03 00 00 00                          ........ 
    52 42 52 55 0c 00 00 00  02 00 00 32 00 00 00 00 RBRU.... ...2....
    03 00 00 00 0c 03 31 00  33 00 35 00 34 00 39 00 ......1. 3.5.4.9.
0b 00 02 ff 00 00 00 01  00 00 00 00 12 00 00 00 ........ ........
04 00 00 00 04 00 00 00                          ........ 
    52 42 52 55 12 00 00 00  02 00 00 3a 04 00 00 00 RBRU.... ...:....
    04 00 00 00 12 01 00 02  00 00 00 40 2b 13 89 20 ........ ...@+.. 
    00 01 01 02 03 01                                ......
0b 00 02 ff 00 00 00 02  00 00 00 00 09 00 00 00 ........ ........
05 00 00 00 05 00 00 00                          ........ 
    52 42 52 55 09 00 00 00  02 00 00 41 05 00 00 00 RBRU.... ...A....
    05 00 00 00 09 02 55 00  03 01 00 c0 01          ......U. .....
0b 00 02 ff 00 00 00 02  00 00 00 00 55 00 00 00 ........ ....U...
06 00 00 00 06 00 00 00                          ........ 
    52 42 52 55 55 00 00 00  02 00 00 32 06 00 00 00 RBRUU... ...2....
    06 00 00 00 09 02 55 00  03 01 00 c0 01 09 04 00 ......U. ........
    00 03 ff ff ff 00 07 05  03 02 40 00 00 07 05 84 ........ ..@.....
    02 40 00 00 07 05 85 02  40 00 00 09 04 01 00 02 .@...... @.......
    07 01 02 00 07 05 01 02  40 00 00 07 05 82 02 40 ........ @......@
    00 00 09 04 02 00 02 07  01 02 00 07 05 06 02 40 ........ .......@
    00 00 07 05 87 02 40 00  00                      ......@. .
00 00 02 00 00 00 01 00  00 00 00 00 00 00 00 00 ........ ........
07 00 00 00 07 00 00 00                          ........ 
00 00 02 01 00 00 01 00  00 00 00 00 00 00 00 00 ........ ........
07 00 00 00 07 00 00 00                          ........ 
    52 42 52 55 64 00 00 00  02 00 00 00 07 00 00 00 RBRUd... ........
    07 00 00 00 ff ff ff 03  03 02 40 00 00 00 84 02 ........ ..@.....
    40 00 00 00 85 02 40 00  00 00 00 00 00 00 00 00 @.....@. ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00                          ........ 
    52 42 52 55 64 00 00 00  02 00 00 00 07 00 00 00 RBRUd... ........
    07 00 00 00 07 01 02 02  01 02 40 00 00 00 82 02 ........ ..@.....
    40 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 @....... ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00                          ........ 
00 00 02 02 00 00 01 00  00 00 00 00 00 00 00 00 ........ ........
07 00 00 00 07 00 00 00                          ........ 
    52 42 52 55 64 00 00 00  02 00 00 00 07 00 00 00 RBRUd... ........
    07 00 00 00 07 01 02 02  06 02 40 00 00 00 87 02 ........ ..@.....
    40 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 @....... ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
    00 00 00 00 00 00 00 00                          ........

(j) USB CONTROL in (printer desc)