PTP/IP
This document briefly describes the PTP/IP transfer layer, as reverse
engineered from ethereal packet dumps and glanced from the sparely available
online documentation.
It operates on top of a normal IP networkstack, the connections
are simple TCP/IP socket connection.
Default port is 15740 (same as the ISO standard number for PTP).
There are 2 connections used:
- control & data connection (Initiator (computer) driven)
- event connection (Responder (camera) driven)
The participants communicate in packets, their layout is:
Length | Variable | Notes |
4 | length (little endian) | Length of the whole packet including the header |
4 | type (little endian) | Type, listed below |
length - 8 | data | specific on type |
Observed types:
Type | Direction | Name | Next reply(s) | Payload |
1 |
I->R |
Init_Command_Request |
2 or 5 |
- 16 byte GUID
- xx byte WCHAR computername with terminating \0
|
2 |
R->I |
Init_Command_Ack |
5 or MAINLOOP |
- 4 byte ID (session id, to be used for event connection startup)
- 16 byte GUID (MAC is used here for my camera, and repeated)
- xx byte WCHAR Camera Name with terminating \0
|
3 |
I->R |
Init_Event_Request |
4 or 5 |
- 4 byte ID (from Init_Command_Ack)
|
4 |
R->I |
Init_Event_Ack |
EVENTLOOP |
|
5 |
I->R |
Init_Fail |
End of communication |
- 4 byte error code (unclear meaning)
|
6 |
I->R |
Cmd_Request |
9 -> A/C or 7 |
- 4 byte unknown. set to 1 currently.
- 2 byte PTP command code
- 4 byte Transaction ID
- n x 4 byte PTP command arguments
|
7 |
R->I |
Cmd_Response |
MAINLOOP |
- 2 bytes PTP response code
- 4 bytes Transaction ID
- nr*4 bytes arguments (depending on length of response)
|
8 |
R->I |
Event |
EVENTLOOP |
- 2 byte PTP event code
- ...
Not fully investigated, but similar to PTP event.
|
9 |
R<->I |
Start_Data_Packet |
10,12 |
- 4 byte Transaction ID
- 4 byte Total data download size (without headers)
|
10 |
R<->I |
Data_Packet |
10,12 |
- 4 byte Transaction ID
- length-4-8 bytes payload data
|
11 |
I->R |
Cancel_Transaction |
7 ? |
(Untested yet.) |
12 |
R<->I |
End_Data_Packet |
7 ? |
- 4 byte Transaction ID
- length-4-8 bytes payload data
|
13 |
R<->I |
Ping |
14 |
|
13 |
R<->I |
Pong |
EVENTLOOP |
|
State transitions:
Initial Phase:
Command Connection:
1 | -> 2 | -> MAINLOOP |
| \ 5 | -> EXIT |
Event Connection:
3 | -> 4 | -> EVENTLOOP |
| \ 5 | -> EXIT |
Cameras using PTP/IP:
- Nikon CoolPix P1
- Nikon CoolPix P2
- Nikon CoolPix P3
- Nikon CoolPix P4
- Nikon CoolPix S6
- Kodak EasyShare One
- Canon PowerShot SD430
|