Digi Connect ME Discovery
I have a Digi Connect ME powered device that I’ve been trying to interface with from Mac OS X, the only platform Digi does not provide their RealPort drivers for. The Digi Connect ME is a serial to ethernet bridge that runs embedded Linux on an ARM processor. Their RealPort driver that doesn’t exist for OS X is a virtual serial port driver which routes data over a TCP connection to the Connect ME where it is de-muxed and sent over TTL serial to your device.
In typical fashion I decided to simply reverse engineer the so called “Advanced Digi Discovery Protocol” or ADDP in able to discover devices on the network. ADDP makes use of UDP broadcast packets sent to port 2362. The packets take the form of a magic character sequence of ‘DIGI’ followed by a two byte sequence number and a series of elements. These elements are of the form: one byte element ID, one byte element length and then element length bytes of data. In the data below, magic characters are in red, sequence numbers are in orange, packet length is in green, element IDs are in blue, element lengths are in purple and element data is in yellow.
The ADDP discovery broadcast UDP packet is structured as follows:
0000 44 49 47 49 00 01 00 06 ff ff ff ff ff ff DIGI..........This packet has sequence 0001 and element 0 has length of 6 with data as six 0xFF bytes.
A network device that implements ADDP data will respond to the device that sent the broadcast on port 1181 with something like the following:
0000 44 49 47 49 00 02 00 60 01 06 00 40 9d 33 d2 94 DIGI...`...@.3..
0010 02 04 XX XX 70 07 03 04 ff ff 00 00 0b 04 00 00 ....p...........
0020 00 00 0d 0f 44 69 67 69 20 43 6f 6e 6e 65 63 74 ....Digi Connect
0030 20 4d 45 10 01 01 07 01 00 08 1e 56 65 72 73 69 ME........Versi
0040 6f 6e 20 38 32 30 30 30 38 35 36 5f 46 36 20 30 on 82000856_F6 0
0050 37 2f 32 31 2f 32 30 30 36 0e 04 00 00 03 03 13 7/21/2006.......
0060 04 00 00 04 03 12 01 01 ........This packet has sequence 0002 and has a length of 0×0060 or 96 bytes – not including the bytes up to this point. Element 1 has length 6 and is the MAC address of the device. Element 2 has length 4 bytes and is the device’s IP. Element 3 has length 4 and is the device’s Netmask. Element 0xB has length 4 and is the device’s Gateway. Element 0xd has 15 bytes and is the device’s name. Element 10 has length 1 and I think it is the number of serial devices. Element 7 has length 1 and is unknown. Element 8 has length 30 and is the device’s Firmware version. Element 0xe has 4 bytes and is has unknown value 0×00000303. Element 0×13 has length 4 and unknown value 0×0000403. Element 0×12 has length 1 and unknown value 1.
I have attached a simple python script that I have written to find DIGI Connect ME enabled devices on your network. Note that it requires that you have the netifaces Python library installed. This should also detect the Connect WI-ME and possibly other DIGI network enabled products.
This entry was posted on Friday, October 24th, 2008 at 7:31 pm PST and is filed under Coding, Hacking. Find similar posts by selecting any of the following tags: . You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
on 3/1/2009 at 12:47 pm PST Pekka Lehtikoski wrote:
Hi John,
Hooking into DIGI’s ADDP may present leagal complications, if used with other manufacturer’s device but DIGI. For now ADDP works ok for me, but it has serious limitations: Besides of Windows Visual Studio, I would like to use ADDP with 64 bit compilers and also other operating systems like linux and Windows CE. Also being limited to DIGI products, is minus. One year we are likely to use something else. It would be nice to find or write open source discovery library, with functionality somewhat similar to ADDP. Should be in plain C for maximum portability and license like MIT or BSD to allow commercial use. What you think?
Best regards,
Pekka Lehtikoski
on 3/8/2009 at 5:49 am PST Jonathan Bush wrote:
Hi John, you dont know me, but my name is Jonathan Bush and Im in my final year of BSc Computer Network Technology at the University of Hertfordshire in the UK.
I’m currently working on my dissertation which uses a Digi Connect Wi-Me to send a serial port over TCP/IP. I just wanted to say thank you for this code, it has helped me no end. Rest assured you will be acknowledged for your contribution!
Unfortunatly I couldnt get it to work under Windows but works perfectly in Linux.
I dont suppose you know anyway to change the ports the device uses as the network I need to use is heavily secured and any “exotic ports” are blocked.
Thanks for the code and any help you can suggest.
JB
on 5/8/2009 at 10:28 pm PST John wrote:
@Jonathan: To the best of my knowledge you cannot change the ADDP port, it wouldn’t make sense for them to let you as it would break all of their discovery tools. You should be able to adapt the python script to work on Windows, I suspect that the part that is not working for you is the netifaces module. If you know what network interface the Digi Device is on then you can just specify that one instead of broadcasting over all interfaces like I do.
@Pekka: I would recommend that you use mDNS aka Bonjour aka Zeroconf. I use it for other networked devices and it works great. There are a few “tiny” implementations for use on embedded devices but their names escape me atm.
on 11/18/2009 at 2:22 am PST Quintin Beukes wrote:
Hey John,
I am also busy analyzing the digi protocol. I was actually busy with the configuration packets (to change the IP settings or reboot the device using the discovery tool) when I came across your web site. These packets all end with a peculiar 5 byte sequence which equals 0×04 and “dbps” (also the default password), which made me research the “dbps”.
I have also not figured out what packet 0×07 is, but I have some of the other packets you were not sure about (like 0×0e, 0×13 and so on). Have a look at the URL I posted as my web site. There is a post on 17 Nov 2009 of what I have found so far. Since the post I have also found some more so by this weekend I should have a complete breakdown of their protocol.
I am almost done with a complete cross platform open source (Apache license) implementation of the Digi Discovery tool. It should be able to do everything Digi does and will once and for all open up their protocol so everyone can manage their Digi devices how they please.
Just figured you might appreciate the extra information. If you’ve since figured out what 0×07 field is for, please let me know. I can’t find anything to pair it up with. Nor their peculiar sending of their default password.
on 11/18/2009 at 4:19 am PST John wrote:
Thanks for the update Quintin! I no longer have any Digi devices to manage so I’m afraid this is as far as I got.
I wish you the best of luck in reverse engineering the rest of the protocol and look forward to seeing an Open Source library!