This page last changed on Apr 22, 2012 by swords.

I'm having a go with KNX/EIB and I'm wondering if anyone can fill in the blanks (?? in last part of CONNECTSTATE_REQUEST, DISCONNECT_REQUEST and common connection header) or spot some errors.

CONNECTION_REQUEST:
06 10 02 05 00 1a | EIBNet/IP Header (length = 6, version = 1.0, service type = CONNECTION_REQUEST, total length = 26)
08 01 c0 a8 0b 17 e7 bd | HPAI control endpoint (length = 8, protocol = UDP, ip = 192.168.11.23, port = 59325)
08 01 c0 a8 0b 17 8c b5 | HPAI data endpoint (length = 8, protocol = UDP, ip = 192.168.11.23, port = 36021)
04 04 02 00 | CRI (length = 4, connection = TUNNELING_CONNECTION, KNX layer = 2, reserved = 0)

CONNECTIONSTATE_REQUEST:
06 10 02 07 00 1a | EIBNet/IP Header (length = 6, version = 1.0, service type = CONNECTIONSTATE_REQUEST, total length = 26)
41 | channel id = 65
00 | reserved
08 01 c0 a8 0b 17 e7 bd | HPAI control endpoint (length = 8, protocol = UDP, ip = 192.168.11.23, port = 59325)
09 08 29 07 01 00 58 be 0d 08 | ??

TUNNELLING_REQUEST
06 10 04 20 00 15 | EIBNet/IP Header (length = 6, version = 1.0, service type = TUNNELLING_REQUEST, total length = 21)
04 41 00 00 | common connection header (length = 4, channel id = 65, sequence = 0, ?? = 0)
11 00 ac f0 00 00 61 01 01 00 00 | cEMI frame

cEMI frame:
11 | L_Data.req
00 | zero
ac | 10101100 (standard frame, reserved, repeat, system broadcast, low, no ack, no error)
f0 | 11110000 (group address, 7 hops, standard frame)
00 00 | src 0 = (0*2048) + (0*256) + (0*1) = 0/0/0
61 01 | dst 24833 = (12*2048) + (1*256) + (1*1) = 12/1/1
01 | length = 1
00 | data = 0

TUNNELLING_ACK
06 10 04 21 00 0a | EIBNet/IP Header (length = 6, version = 1.0, service type = TUNNELLING_ACK, total length = 10)
04 41 00 00 | common connection header (length = 4, channel id = 65, sequence = 0, ?? = 0)

DISCONNECT_REQUEST
06 10 02 09 00 16 | EIBNet/IP Header (length = 6, version = 1.0, service type = DISCONNECT_REQUEST, total length = 22)
41 | channel id = 65
00 | reserved
08 01 c0 a8 0b 17 e7 bd | HPAI control endpoint (length = 8, protocol = UDP, ip = 192.168.11.23, port = 59325)
31 20 30 30 20 30 | ??

I think I've found the answer to the last part of CONNECTIONSTATE_REQUEST and DISCONNECT_REQUEST. It seems as if EIBnetmux is doing something odd. From ETS the length is 16 so the last unknown 10 or 6 are not even there:

06 10 02 07 00 10|EIBNet/IP Header (length = 6, version = 1.0, service type = CONNECTIONSTATE_REQUEST, total length = 16)
44 | channel id = 68
00 | reserved
08 01 c0 a8 0b 35 e1 5f | HPAI control endpoint (length = 8, protocol = UDP, ip = 192.168.11.53, port = 57695)

06 10 02 09 00 10|EIBNet/IP Header (length = 6, version = 1.0, service type = DISCONNECT_REQUEST, total length = 16)
45 | channel id = 69
00 | reserved
08 01 c0 a8 0b 35 ef 96 | HPAI control endpoint (length = 8, protocol = UDP, ip = 192.168.11.53, port = 61334)

So for now that would only leave the service type specific and connection type specific parts from the common connection header unknown.

Posted by swords at Apr 22, 2012 17:03
Document generated by Confluence on Jun 05, 2016 09:30