This is a static archive of our old Q&A Site. Please post any new questions and answers at

Decode Packet: 500 USD Reward


Dear Friends,

Please find the link to a captured TCP transmission between 2 devices (not from internet). The packets of interst are from a devide at to another devide at . (please filter).

The packets of interest beginn after 21:15:30. Each PSH packet has a "Data" Payload, which I am not able to decode (understand). Some of the packets have AASCII data, which makes sense, but most of it makes no sense. I am inclined to believe that the data is not encrypted.

The "Data" is encoding for some numbers (scientific numbers). The first person who can decode and explain how the data is organised in the packets will get a reward of 500 USD.

Thanks and Regards

asked 27 Oct '17, 15:19

guest1's gravatar image

accept rate: 0%

Looks a lot like HP-GL/2.

(28 Oct '17, 03:04) Jaap ♦

Dear Friend you may be right. It is indeed an HP machine. Can you help to get it decoded ?

(28 Oct '17, 04:26) guest1

See the Wikipedia page for HP-GL for information about HP-GL and links to HP documents about HP-GL and HP-GL/2.

(29 Oct '17, 13:35) Guy Harris ♦♦

Note also that one port is port 9100; /etc/services on my machine says:

hp-pdl-datastr  9100/udp     # PDL Data Streaming Port
hp-pdl-datastr  9100/tcp     # PDL Data Streaming Port

"PDL" probably stands for "Page Description Language", and the page description language in question is probably HP Printer Command Language. As that Wikipedia page says, "HP-GL/2 and PJL are supported by later versions of PCL.", so the data going over the wire is probably some version of HP PCL, with HP-GL/2 included in it.

See also What is port 9100 & How to print to it.

(29 Oct '17, 17:30) Guy Harris ♦♦

One Answer:


NOTE: as the banner says

This is our old Q&A Site. Please post any new questions and answers at

and this site may become read-only at some point, so you probably won't get much more help here.

Either you'll have to:

  • decode it yourself by hand, using the documentation for HP PCL and HP-GL;
  • write a Wireshark dissector for HP PCL, and have it dissect port 9100 traffic;
  • have somebody else write the dissector.

(I'm too busy to work on it right now.)

answered 29 Oct '17, 17:33

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%