This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Dear Friends,

Please find the link to a captured TCP transmission between 2 devices (not from internet). The packets of interst are from a devide at 192.0.0.192 to another devide at 192.0.0.200 . (please filter).

https://we.tl/UXE33nmye8

The packets of interest beginn after 21:15:30. Each PSH packet has a "Data" Payload, which I am not able to decode (understand). Some of the packets have AASCII data, which makes sense, but most of it makes no sense. I am inclined to believe that the data is not encrypted.

The "Data" is encoding for some numbers (scientific numbers). The first person who can decode and explain how the data is organised in the packets will get a reward of 500 USD.

Thanks and Regards

asked 27 Oct '17, 15:19

guest1's gravatar image

guest1
11112
accept rate: 0%

Looks a lot like HP-GL/2.

(28 Oct '17, 03:04) Jaap ♦

Dear Friend you may be right. It is indeed an HP machine. Can you help to get it decoded ?

(28 Oct '17, 04:26) guest1

See the Wikipedia page for HP-GL for information about HP-GL and links to HP documents about HP-GL and HP-GL/2.

(29 Oct '17, 13:35) Guy Harris ♦♦

Note also that one port is port 9100; /etc/services on my machine says:

hp-pdl-datastr  9100/udp     # PDL Data Streaming Port
hp-pdl-datastr  9100/tcp     # PDL Data Streaming Port

"PDL" probably stands for "Page Description Language", and the page description language in question is probably HP Printer Command Language. As that Wikipedia page says, "HP-GL/2 and PJL are supported by later versions of PCL.", so the data going over the wire is probably some version of HP PCL, with HP-GL/2 included in it.

See also What is port 9100 & How to print to it.

(29 Oct '17, 17:30) Guy Harris ♦♦

NOTE: as the banner says

This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

and this site may become read-only at some point, so you probably won't get much more help here.

Either you'll have to:

  • decode it yourself by hand, using the documentation for HP PCL and HP-GL;
  • write a Wireshark dissector for HP PCL, and have it dissect port 9100 traffic;
  • have somebody else write the dissector.

(I'm too busy to work on it right now.)

permanent link

answered 29 Oct '17, 17:33

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335195
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×3

question asked: 27 Oct '17, 15:19

question was seen: 393 times

last updated: 29 Oct '17, 17:33

p​o​w​e​r​e​d by O​S​Q​A