PTP/IP protocol - briefly reverse engineered
Keywords: gphoto libgphoto2 linux ptpip ptp/ip ptp

# PTP/IP

This document briefly describes the PTP/IP transfer layer, as reverse engineered from ethereal packet dumps and glanced from the sparely available online documentation.

It operates on top of a normal IP networkstack, the connections are simple TCP/IP socket connection.

Default port is 15740 (same as the ISO standard number for PTP).

There are 2 connections used:

- control & data connection (Initiator (computer) driven)
- event connection (Responder (camera) driven)

The participants communicate in packets, their layout is:

Length | Variable | Notes
--- | --- | ---
4 | length (little endian) | Length of the whole packet including the header
4 | type (little endian) | Type, listed below
length - 8 | data | specific on type

Observed types:

Type | Direction | Name | Next reply(s) | Payload
--- | --- | --- | --- | ---
1 | I->R | Init_Command_Request | 2 or 5 | 16 byte GUID xx byte WCHAR computername with terminating \0
2 | R->I | Init_Command_Ack | 5 or MAINLOOP | 4 byte ID (session id, to be used for event connection startup) 16 byte GUID (MAC is used here for my camera, and repeated) xx byte WCHAR Camera Name with terminating \0
3 | I->R | Init_Event_Request | 4 or 5 | 4 byte ID (from Init_Command_Ack)
4 | R->I | Init_Event_Ack | EVENTLOOP | No payload.
5 | I->R | Init_Fail | End of communication | 4 byte error code (unclear meaning)
6 | I->R | Cmd_Request | 9 -> A/C or 7 | 4 byte unknown. set to 1 currently. 2 byte PTP command code 4 byte Transaction ID n x 4 byte PTP command arguments
7 | R->I | Cmd_Response | MAINLOOP | 2 bytes PTP response code 4 bytes Transaction ID nr*4 bytes arguments (depending on length of response)
8 | R->I | Event | EVENTLOOP | 2 byte PTP event code ... Not fully investigated, but similar to PTP event.
9 | R<->I | Start_Data_Packet | 10,12 | 4 byte Transaction ID 4 byte Total data download size (without headers)
10 | R<->I | Data_Packet | 10,12 | 4 byte Transaction ID length-4-8 bytes payload data
11 | I->R | Cancel_Transaction | 7 ? | (Untested yet.) 4 bytes Transaction ID
12 | R<->I | End_Data_Packet | 7 ? | 4 byte Transaction ID length-4-8 bytes payload data
13 | R<->I | Ping | 14 | No payload.
13 | R<->I | Pong | EVENTLOOP | No payload.

State transitions:

Initial Phase:

Command Connection:

1 | -> 2 | -> MAINLOOP
| \ 5 | -> EXIT

Event Connection:

3 | -> 4 | -> EVENTLOOP
| \ 5 | -> EXIT

Cameras using PTP/IP:

- Nikon CoolPix P1
- Nikon CoolPix P2
- Nikon CoolPix P3
- Nikon CoolPix P4
- Nikon CoolPix S6
- Kodak EasyShare One
- Canon PowerShot SD430