NBX protocol

The 3com phones use a protocol that runs at the ether layer.

struct packet {
    char dest[6];   // ehter addr
    char src[6];    // ehter addr
    short proto;    // always 0x8868
    short type; //'HA'..'HB'..'HC'...
    char orig[6];   // ehter addr
    short seq;
    unsigned char data[4];  // its bigger...
};

The 'H' may be because its Henry Houh's protocol. The letter after the 'H' is one of these:

• 'A' 0x41 Voice packet
• 'H' 0x48 Ack. This is sent as an answer for every directed packet.
• 'R' 0x52 Request packet
  Phone send these when their buttons are pressed
• 'E' 0x45 Error packet. Sent durring init
• 'I' 0x49 Sent durring init
• 'Y' 0x51 Sent durring init
• 'T' 0x54
• 'U' 0x55 update
  Its broadcast every second and sometimes to specific phones.

      H H Ether  address snum      chan  dev
8868 4848 00e0 bb03 d0b1 0001 95ec 0001 0004
8868 4848 00e0 bb03 d0b1 0001 95ec 0001 0004

Proto h h Ether  address seq  0001 0001 dev
8868 4848 00e0 bb04 27c5 d873 0001 0001 0005 [ filler ....]

The error is sent to the address inside the recieved packet and not the source address. This menas you cna fake mssages without setting your own ether address to the ncp. Ifyou want to fake a message to a phone ,you should set the internal address to the ncp.

      H E Ether  address snum flag chan  dev error code
8868 4848 00e0 bb03 d0b1 0001 95ec 0001 0004
8868 4845 00e0 bb04 27c5 0400 0101 0001 0005 ffff 8002

H R  Ether  address snum 
4852 00e0 bb0b d8be d722 
                         0001 0101 0000
0005 0202 80b3 0027 0000 0007 0007 ffff
1107 00ff 0007 0017 0017 ffff 
                              Ring
                              1207 
                                   00ff
0007 5500 00
            Button lights
            03 0000 f003 000f fff0      
			           ????
                                   0220
Display Text....
2020 2020 2020 2020 2020 2020 2020 2020
2020 2020 2020 2020 2020 2020 2020 2020
2020 2020 2020 2020 2020 2020 2020 2020
2020 2020 2020 2020 2020 2020 2020 2020
What to display
          CC          TT 
0000 0101 0000 0101 0000 0101 0000

What to display sets the default display settings. CC=1 for a clock with seconds, TT=01 for a count up call timer

The voice packets 'A' may be scambled. I'm not sure how that is done. They are 8kbytes/sec packets (ISDN rate). The music on hold packets hold are 192 bytes.

case    'A':    //// Voice Packet
// mulaw encoded 8 bit packets
//printf("HA\n");
//write(sound, &d[12], 192);
printf("A%d %d",d[10]*256+d[11],count);
//fprintf(out,"%c",'X');
for(i=12;i<192+12;i++) {
//printf("%02x",d[i]);
//fprintf(out,"%d,\n",d[i]);
fprintf(out,"%c",d[i]);
}
printf("\n");
break;

This expame has 4 known phones
8868 4855 00e0 bb0b d8be eaf9
0001 0101 0000 0000 0001 80b3 0000 0000 c0a8
69be 07d2 0709 150f 1f40 0300 0000 0200
 cnt PPPP  P=One nibble per phone that is on line upto cnt
0002 3300 0600 0006 0000 0000 0000 0900
0000

5 phones:
0001 8868 4855 00e0 bb0b d8be 62fb 0001
0101 0000 0000 0001 80b3 0000 0000 c0a8
69be 07d2 0709 151a c350 0300 0000 0200
0004 0300 0000 0600 0006 0000 0000 0000
0900 0000

6 phones:
0001 8868 4855 00e0 bb0b d8be 99fb 0001
0101 0000 0000 0001 80b3 0000 0000 c0a8
69be 07d2 0709 151c 84d0 0300 0000 0200
0004 0000 0000 0600 0006 0000 0000 0000
0900 0000

// 'U' decoding
//data[0..5] is the dest address
//dec11 213 ???????               h
//0c0b 0e0b e2900300 00000200 000e3000
//48   50   52       56           60
// real structure is:
// 2:  0x0200
//     2 byte size (rounded to words)
// ... each phone is 4 bits
//     phones are '3'
case    'U':    //// 0x55 update
//// broadcast every second or so
//// sometimes to specifc phones
printf("Update: \n");
for(i=14+32;i<s;i++) {
printf( "%02x",data[i]);
if(i%4==1) printf(" ");
}

printf("%s %d %d:%02d  %d \n",Months[data[14+32]],
data[47], data[48]%12, data[49], data[50], data[51]);

ph_cnt=0;
printf("type of table=%04x\n",data[59-2]+data[58-2]*256);
printf("size of table=%d\n",data[59]+data[58]*256);
for(i=60;i<72;i++) {
int a,b;
a=b=data[i];
a=a>>4;
b=b&0xf;
if(a) ph_cnt++;
if(b) ph_cnt++;
if(a)
printf("phone %d (%s) on a %x (%02x)\n",(i-60)*2,
Phones[(i-60)*2],a,data[i]);
if(b)
printf("phone %d (%s) on a %x (%02x)\n",(i-60)*2+1,
Phones[(i-60)*2+1],b,data[i]);
}
printf("%d phones on line\n",ph_cnt);
break;

This (goggle for nbx nboss) claims that the NBX uses: 5.Internal NBX100 Protocols
MULAW Scrambled & unscrambled, Unreliable 192 bytes per frame.
MULAW Scrambled, Unreliable 192 bytes per frame.
MULAW Unscrambled, reliable
IMA ADPCM Scrambled/Unscrambled,

They also claim With multiple pseudo-TLIMs, each pseudo TLIM will require a separate MAC address. It seems convenient to tie this MAC address specification to licensing. A license is a file that has pseudo TLIM MAC addresses along with the NBOSS MAC address encrypted in it. Therefore a license only works with one NCP, and two gateways on the same NCP cannot use the same license. [ Someone can pirate a single channel version easily, but to run multiple channels, they’d need a PC per channel.]