RECESSIM

Landis+Gyr GridStream Protocol: Difference between revisions

← Older edit
VisualWikitext
→00FF 2A 55 Meter Data: Changed data tags based on discovery using IWR
 
(45 intermediate revisions by 5 users not shown)
Line 1: Line 1:
[[File:LandisGyrResidentialMeter1.JPG|thumb]]
[[File:LandisGyrResidentialMeter1.JPG|thumb]]


==Reverse Engineering and Analysis==
==Protocol Analysis==
 
Analysis and decoding of the packets used on the Landis+Gyr GridStream mesh network.
<br />
===Packet Structure===
===Packet Structure===


====Sync and Header====
====Sync and Header====
----The sync word that the Landis+Gyr smart meters send is shown below, this can be used in GNU Radio or other tools to receive only packets transmitted by the meters. Note that at the start of the header we begin using start and stop bits. These must be stripped off of the rest of the data packet during processing.
----The Landis+Gyr Gridstream smart meters use a 52 bit sync shown below regardless of Gridstream version. This can be used in GNU Radio along with the header to uniquely identify packets. Note that at the start of the header we begin using start and stop bits. These must be stripped off of the rest of the data packet during processing.
{| class="wikitable"
{| class="wikitable"
|+Sync and Header
|+Sync 52 bits long
! colspan="6" |Sync
! colspan="7" |Sync
! colspan="3" |Header
|-
|-
!0xAA
!0xAA
!0xAA
!0xAA
!0xAA
Line 18: Line 19:
!0xAA
!0xAA
!0xA
!0xA
!0x00
!0xFF
!0x2A
|-
|-
|10101010
|10101010
|10101010
|10101010
|10101010
Line 28: Line 27:
|10101010
|10101010
|1010
|1010
|}
----Of particular note is the difference between versions 1-4 and version 5. In version 5 there are two bits [11] that do not respect the start/stop bit checks of the prior versions. The older protocol expects a 0 start bit, 8 data bits and a 1 stop bit. By violating two consecutive start bits the older versions of GridStream ignore version 5 even if they have the same CRC Adder! This appears to be a way to add backwards compatibility to newer versions of GridStream.
{| class="wikitable"
|+Header for Gridstream
! colspan="2" |Header v1 - v4
! rowspan="3" |
! colspan="2" |Header v5
|-
!0x00
!0xFF (10 bit)
!0x00
!0xFF (11 bit)
|-
|0 '''00000000''' 1
|0 '''00000000''' 1
|0 '''11111111''' 1
|0 '''11111111''' 1
|0 '''00101010''' 1
|0 '''00000000''' 1
|[11] '''11111111''' 1
|}
|}
Using GNU Radio it was found that shortening the Sync requirements a bit and incorporating part of the header leads to the cleanest data for further downstream processing. The modified sync shown in 8 bit chunks is shown below.
----Using GNU Radio it was found that shortening the Sync requirements a bit and incorporating part of the header leads to the cleanest data for further downstream processing. The modified sync in 8 bit chunks is shown below. These two sync's are both loaded into the '''PDU Align''' block and if either one is matched the full packet is passed downstream.
{| class="wikitable"
{| class="wikitable"
|+Sync Word used with GNURadio
|+Sync Word used with GNURadio for v4
!0xAA
!0xAA
!0xAA
!0xAA
!0x00
!0x5F
!0xF
|-
|10101010
|10101010
|00000000
|01011111
|1111
|}
{| class="wikitable"
|+Sync Word used with GNURadio for v5
!0xAA
!0xAA
!0xAA
!0xAA
!0xA0
!0x00
!0x05
!0x7F
!0xFF
!0x1F
|-
|-
|10101010
|10101010
|10101010
|10101010
|10101010
|00000000
|10101010
|01111111
|10100000
|11111
|00000101
|11111111
|}
|}
The final byte of the sync (0x2A) along with it's start and stop bits are discarded as part of the processing.
----<br />
----<br />
====Type, Length and Sub Type====
====Packet Types and Structures====
----So far only two types of packets have been observed, a 0x55 and a 0xD5 packet. Multiple lengths and SubTypes of these are listed below.
----Data is shown in Hexadecimal unless stated otherwise
 
So far only two types of packets have been observed, a 0x55 and a 0xD5 packet. Multiple lengths and SubTypes of these exist, a few are listed below.
{| class="wikitable"
{| class="wikitable"
|+
|+
!
!
!Start of
Frame
!Type
!Type
!SubType
!Sub Type
!Length
!Sequence
!Packets Purpose
! colspan="2" |Packets Purpose
|-
|-
!1
!
|0x55
|00FF
|0x30
|00
|0x0023
|81 or 85
|Report up-time and other unknown data
|1 Byte
| colspan="2" |Report Power Usage (Device Control Word DCW)
|-
|-
!2
!
|0x55
|00FF
|0x30
|01
|0x0028
|81 or 85
|
|1 Byte
| colspan="2" |Report Power Usage (Device Control Word DCW)
|-
|-
! colspan="4" |
!
!
|00FF
|02
|81 or 85
|1 Byte
| colspan="2" |Report Power Usage (Device Control Word DCW)
|-
|-
!3
!
|0xD5
|00FF
|0x21
|03
|0x0016
|81 or 85
|
|1 Byte
|-
| colspan="2" |Report Power Usage (Device Control Word DCW)
!4
|0xD5
|0x21
|0x0017
|
|-
|-
! colspan="4" |
!
!
!Start of
Frame
!Type
!Sub Type
!Length
!Unknown
!Packets Purpose
|-
|-
!5
!1
|0xD5
|00FF
|0x29
|2A
|0x0016
|55
|
|0023
|30
|Report up-time and other unknown data
|-
|-
!6
!2
|0xD5
|00FF
|0x29
|2A
|0x0017
|D5
|
|0047
|51
|Includes Epoch and Uptime
|-
|-
! colspan="4" |
!3
!
|00FF
|-
|2A
!7
|D5
|0xD5
|00FD
|0x51
|C0
|0x0047
|
|-
!8
|0xD5
|0xC0
|0x00FD
|
|
|}
|}
Line 123: Line 153:
----<br />
----<br />
====Data====
====Data====
----Add data here
----Data varies per packet type but a common theme is the 0x55 packets appear to be broadcasts from the meters with only their own ID. 0xD5 packets usually contain two ID's and appear to be how data is routed across the network. Sometimes one of the meter ID's in a 0xD5 packet is FFFFFFFF which may be a broadcast packet. This was observed when packets were sent that appear to be updating the system time of the meters.
----<br />
----<br />
====Checksum====
====Checksum====
----
----
C++ source code below used to calculate the CRC, different providers use a different initial CRC value. Assume this is to segment traffic, unsure if Routers/Collectors are shared by different providers to return traffic or not.  
C++ source code below used to calculate the CRC, different energy providers use a different initial CRC value. Assume this is to segment traffic, unsure if Routers/Collectors are shared by different providers to return traffic or not.  


<syntaxhighlight lang="c++">
<syntaxhighlight lang="c++">
Line 144: Line 174:
}
}
</syntaxhighlight>
</syntaxhighlight>
----<br />
----


===Captured Meter Data===
===Captured Meter Data===
Line 155: Line 185:
----
----


====0x55 Meter Data====
====00FF 2A 55 Meter Data====
The data below was captured from the same meter (F0EE36DB) and shows some of the values that can change with each transmission. Different meters have different fixed data and some of the data changes less frequently as well.
The data below was captured from the same meter (F0EE36DB) and shows some of the values that can change with each transmission. Different meters have different fixed data and some of the data changes less frequently as well.
{| class="wikitable"
{| class="wikitable"
|+
|+
0x55 Captured packets from Meter F0EE36DB
0x55 Captured packets from Meter F0EE36DB (Oncor)
! rowspan="3" |Pkt
! rowspan="3" |Pkt
!0
!1
!1
!2
!2
!3
!3
|
!4
!4
!5
!5
Line 178: Line 208:
!15
!15
!16
!16
|
!17
!18
|-
|-
! colspan="3" |Not part of CRC calc
! colspan="4" |Not part of CRC calc
|
! colspan="9" |Data Packet
! colspan="13" |Data
! colspan="3" |Trailing 6 Bytes
|
!
! colspan="2" |
|-
|-
!Header
!Start of
Frame
!Type
!Type
!SubType
!Length
!Length
|
!SubType
!Unknown
!Unknown
!Unknown
!Unknown
!Unknown
!Unknown
!WAN Address
!Counter
!Counter
!Uptime (seconds)
!Uptime
!Unknown
!Unknown
!Meter ID
!LAN Address
!Unknown
!Unknown
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Unknown
!Unknown
!Checksum
|
!CRC
!Trailing
!Trailing
|-
|-
|1
!1
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''0C'''
|'''0C'''
|'''0001ECBF'''
|'''0001ECBF'''
Line 224: Line 247:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''04384F'''
|'''384F'''
|7E80
|7E80
! rowspan="10" |
|0896
|0896
|04
|04
|-
|-
|2
!2
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''16'''
|'''16'''
|'''0001ECC6'''
|'''0001ECC6'''
Line 246: Line 266:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''043AC5'''
|'''3AC5'''
|7E80
|7E80
|F47E
|F47E
|04
|04
|-
|-
|3
!3
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''2A'''
|'''2A'''
|'''0001ED05'''
|'''0001ED05'''
Line 267: Line 285:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''041207'''
|'''1207'''
|7E80
|7E80
|A412
|A412
|04
|04
|-
|-
|4
!4
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''34'''
|'''34'''
|'''0001ED29'''
|'''0001ED29'''
Line 288: Line 304:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''041FF9'''
|'''1FF9'''
|7E80
|7E80
|D9C4
|D9C4
|04
|04
|-
|-
|5
!5
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''38'''
|'''38'''
|'''0001ED37'''
|'''0001ED37'''
Line 309: Line 323:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''042571'''
|'''2571'''
|7E80
|7E80
|963C
|963C
|04
|04
|-
|-
|6
!6
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''42'''
|'''42'''
|'''0001ED5C'''
|'''0001ED5C'''
Line 330: Line 342:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''0433A9'''
|'''33A9'''
|7E80
|7E80
|8384
|8384
|04
|04
|-
|-
|7
!7
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''4C'''
|'''4C'''
|'''0001ED60'''
|'''0001ED60'''
Line 351: Line 361:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''04354D'''
|'''354D'''
|7E80
|7E80
|2CB6
|2CB6
|04
|04
|-
|-
|8
!8
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''4E'''
|'''4E'''
|'''0001ED79'''
|'''0001ED79'''
Line 372: Line 380:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''043F25'''
|'''3F25'''
|7E80
|7E80
|871A
|871A
|04
|04
|-
|-
|9
!9
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''60'''
|'''60'''
|'''0001EDA6'''
|'''0001EDA6'''
Line 393: Line 399:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''040F05'''
|'''0F05'''
|7E80
|7E80
|25C9
|25C9
|04
|04
|-
|-
|10
!10
|00FF2A
|00FF
|2A
|55
|55
|0023
|0023
!
|30
|30
|FFFFFFFFFFFF
|FFFFFFFFFFFF
|50
|50CF8DD9E2C0
|CF8DD9E2
|C0
|'''6A'''
|'''6A'''
|'''0001EDCD'''
|'''0001EDCD'''
Line 414: Line 418:
|F0EE36DB
|F0EE36DB
|0100
|0100
|2132
|213204
|'''041E55'''
|'''1E55'''
|7E80
|7E80
|F33F
|F33F
|04
|04
|}
|}
1) Header = 0x00FF2A
[[File:55 Packet Timing Analysis.png|thumb|600x600px|Field 15 Timing Analysis  -Anonymous]]
 
Commentary on the data fields above, they have been grouped based on sample analysis but this could be wrong. If you see a new pattern not noticed before you may be correct.
2) Packet Type = 0x55
 
3) Packet Length = 0x0023
 
4) SubType = 0x30
 
5) Unknown = FFFFFFFFFFFF (Empty Data Slot?)
 
6) Unknown = 0x50
 
7) Unknown = CF8DD9E2 (Appears to either be location identifier or duplicate meter ID in some cases)
 
8) Unknown = C0
 
9) Counter = '''02''' (Increments some amount with each transmission and rolls over at 0xFF)
 
10) Uptime = 0x'''0001ECA3''' (Value in seconds since meter powered on, easy way to see last time there was an outage!)
 
11) Unknown Identifier #5 = 0xA483
 
12) Meter ID = 0xF0EE36DB
 
13) Unknown = 0x0100


14) Unknown = 0x2132
*Field 5 - Never observed a packet with this length and subtype that wasn't all FF's


15) Unknown = 0x'''042D19'''
*Field 6 - WAN Address - Oncor uses GPS coordinates, CoServ uses LAN with padding of some kind.  The open source [https://github.com/beroset/gpsdecode gpsdecode] library shows one way to translate between WAN Address and GPS coordinates.


16) Unknown = 0x7E80
*Field 7 - Increments some amount with each transmission and rolls over at 0xFF, always an even hex value


17) Checksum = 0xF154
*Field 8 - Value in seconds since meter powered on, '''easy way to see last time the meter experienced a power outage.'''
*Field 10 - LAN Address, Meter ID that's listed on the sticker on the front


18) Trailing byte = 0x04
'''** NEW **'''
----


====0xD5 Meter Data====
'''Field 13''' - Timing in hundredths of a second, counts from 0 to 167.99 (0x419F) seconds then rolls over to 0 again. Credit for this discovery goes to an anonymous reader who examined the dataset at the bottom of the page!!
There appear to be multiple packet lengths and styles for the 0xD5 packet. There are some samples below showing
{| class="wikitable"
{| class="wikitable"
|+0xD5 Captured packet
|+0x55 Captured packets from Meter 5021D005 (Coserv)
! rowspan="3" |Pkt
! rowspan="3" |Pkt
!0
!1
!1
!2
!2
!3
!3
|
!4
!4
!5
!5
Line 473: Line 453:
!9
!9
!10
!10
|
!11
!11
!12
!12
!13
!14
!15
!16
|-
|-
! colspan="3" |Not part of CRC calc
! colspan="4" |Not part of CRC calc
|
! colspan="9" |Data Packet
! colspan="7" |Data
! colspan="3" |Trailing 6 Bytes
|
!
!
!
|-
|-
!Header
!Start of
Frame
!Type
!Type
!SubType
!Length
!Length
|
!SubType
!Meter ID #1
!Meter ID #2
!Unknown
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Unknown
|
!Checksum
!Trailing
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
!4
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|C0
|'''0003FC30'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|052E
|7E00
|09FC
|04
|-
!5
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|EA
|'''0003FC9F'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|3062
|7E00
|C69A
|04
|-
! colspan="18" |Power restored after an outage
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|06
|'''0000000F'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|26DA
|7E30
|90CE
|04
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|0E
|'''0000000F'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|26EF
|7E10
|2740
|04
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|20
|'''00000011'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2801
|7E90
|8B23
|04
|-
!9
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|2C
|'''00000013'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2883
|7E60
|1A1A
|04
|-
!10
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|54
|'''00000017'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2A72
|7E80
|E3CD
|04
|}
----
 
====00FF 2A D5 Meter Data====
There appear to be multiple packet lengths and styles for the 0xD5 packet. Some samples shown below, [https://wiki.recessim.com/w/images/9/9e/D5-Packets-Table-F03B9FFB.txt download as a txt file].
{| class="wikitable"
|+0xD5 Captured packets
! rowspan="3" |Pkt
!1
!
!2
!3
!4
!5
!6
!7
! colspan="3" |8
!10
!
!11
! colspan="2" |
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |CRC'd Data
!CRC
!CRC
!Trailing
! colspan="2" |
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!DST Meter
!SRC Meter
!Packet
Counter
! colspan="3" |'''Payload'''
!Timing
(0.01 increments)
!Unknown
!Checksum
! colspan="2" |Timestamp
|-
|-
|1
|1
|00FF2A
|<code>00FF</code>
|D5
|<code>2A</code>
|0016
|<code>D5</code>
|<code>0011</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>AE</code>
!
|'''<code>98</code>'''
!
|<code>4014</code>
|<code>1630</code>
|<code>9B47</code>
!
|Mon Mar  1 08:43:20 2021
|-
|2
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0011</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>BA</code>
!
|'''<code>98</code>'''
!
|<code>04B5</code>
|<code>1650</code>
|<code>C505</code>
!
|Mon Mar  1 08:43:36 2021
|-
|3
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0011</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>CA</code>
!
|'''<code>98</code>'''
!
|<code>0844</code>
|<code>1600</code>
|<code>413C</code>
!
|Mon Mar  1 08:43:45 2021
|-
|4
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0016</code>
|<code>21</code>
|<code>F0653657</code>
|<code>F03B9FFB</code>
|<code>72</code>
!
|'''<code>8801001F3204</code>'''
!
|<code>2E24</code>
|<code>1140</code>
|<code>B6B1</code>
!
|Mon Mar  1 11:50:10 2021
|-
|5
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0016</code>
|<code>21</code>
|<code>F0EF3BCE</code>
|<code>F03B9FFB</code>
|<code>62</code>
!
|'''<code>8801001E3204</code>'''
!
|<code>2393</code>
|<code>1730</code>
|<code>6DA6</code>
!
|Mon Mar  1 12:45:43 2021
|-
|6
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0016</code>
|<code>21</code>
|<code>F1419ADD</code>
|<code>F03B9FFB</code>
|<code>7C</code>
!
|'''<code>9801001E3204</code>'''
!
|<code>332C</code>
|<code>1780</code>
|<code>BB3E</code>
!
|Mon Mar  1 12:46:23 2021
|-
|7
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0016</code>
|<code>21</code>
|<code>F07C5F0C</code>
|<code>F03B9FFB</code>
|<code>9A</code>
!
|'''<code>8801001E3204</code>'''
!
|<code>018C</code>
|<code>1A80</code>
|<code>4FCF</code>
!
|Mon Mar  1 12:47:04 2021
|-
|8
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0017</code>
|<code>29</code>
|<code>8073AB83</code>
|<code>F03B9FFB</code>
|<code>C2</code>
!
|'''<code>8801001E320404</code>'''
!
|<code>06BF</code>
|<code>1390</code>
|<code>0244</code>
!
|Mon Mar  1 18:17:41 2021
|-
|9
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0017</code>
|<code>29</code>
|<code>8073AB83</code>
|<code>F03B9FFB</code>
|<code>D2</code>
!
|'''<code>8801001E320404</code>'''
!
|<code>0BF4</code>
|<code>1340</code>
|<code>2AB3</code>
!
|Mon Mar  1 18:17:54 2021
|-
|10
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0017</code>
|<code>29</code>
|<code>8073AB83</code>
|<code>F03B9FFB</code>
|<code>E4</code>
!
|'''<code>8801001E320404</code>'''
!
|<code>11FF</code>
|<code>1330</code>
|<code>8517</code>
!
|Mon Mar  1 18:18:10 2021
|-
|11
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>0017</code>
|<code>29</code>
|<code>8073AB83</code>
|<code>F03B9FFB</code>
|<code>EA</code>
!
|'''<code>8801001E320404</code>'''
!
|<code>1271</code>
|<code>1340</code>
|<code>5091</code>
!
|Mon Mar  1 18:18:11 2021
|-
|12
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>A1</code>
!
|'''<code>9001001E320406009950D1CA</code>'''
!
|<code>097E</code>
|<code>1620</code>
|<code>46B7</code>
!
|Mon Mar  1 09:39:48 2021
|-
|13
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F05C3966</code>
|<code>F03B9FFB</code>
|<code>1D</code>
!
|'''<code>9001001E320406009D50D515</code>'''
!
|<code>158D</code>
|<code>2220</code>
|<code>18A3</code>
!
|Mon Mar  1 12:59:07 2021
|-
|14
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>69</code>
!
|'''<code>9001001F6C0406009F50B910</code>'''
!
|<code>2957</code>
|<code>1670</code>
|<code>207F</code>
!
|Mon Mar  1 15:14:22 2021
|-
|15
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>17</code>
!
|'''<code>900100246C0406007A50A501</code>'''
!
|<code>3FF3</code>
|<code>1680</code>
|<code>5591</code>
!
|Mon Mar  1 16:08:32 2021
|-
|16
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>C7</code>
!
|'''<code>9001001F6C04060091500F11</code>'''
!
|<code>0072</code>
|<code>1690</code>
|<code>1F05</code>
!
|Mon Mar  1 16:14:13 2021
|-
|17
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>73</code>
!
|'''<code>900100236C0406007D5014A3</code>'''
!
|<code>0797</code>
|<code>1620</code>
|<code>D48F</code>
!
|Mon Mar  1 16:28:31 2021
|-
|18
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0FBBC6F</code>
|<code>F03B9FFB</code>
|<code>4D</code>
!
|'''<code>9101001F6C04060091504CAD</code>'''
!
|<code>133C</code>
|<code>1D40</code>
|<code>2347</code>
!
|Mon Mar  1 22:13:25 2021
|-
|19
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>B9</code>
!
|'''<code>90010022320406009E500632</code>'''
!
|<code>03F5</code>
|<code>1730</code>
|<code>FE1B</code>
!
|Mon Mar  1 23:14:22 2021
|-
|20
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001C</code>
|<code>29</code>
|<code>F0BCD31D</code>
|<code>F03B9FFB</code>
|<code>E7</code>
!
|'''<code>900100256C0506009B50D2A7</code>'''
!
|<code>1E0E</code>
|<code>3F60</code>
|<code>13BE</code>
!
!
|Tue  Mar  2 00:56:17 2021
|-
|21
|21
|F05FCB84
|<code>00FF</code>
|F0FC4DB1
|<code>2A</code>
|E288
|<code>D5</code>
|0100
|<code>001C</code>
|273205
|<code>29</code>
|00781930
|<code>F0BCD31D</code>
|<code>F03B9FFB</code>
|<code>E5</code>
!
|'''<code>900100256C0506009850C186</code>'''
!
|<code>181F</code>
|<code>3F90</code>
|<code>305B</code>
!
|Tue  Mar  2 01:21:14 2021
|-
|22
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001D</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>B7</code>
!
|'''<code>9008009150FA0E012ABA0E81B8</code>'''
!
|<code>0F15</code>
|<code>1630</code>
|<code>8383</code>
!
|Mon Mar  1 13:21:15 2021
|-
|23
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001D</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>27</code>
!
|'''<code>900800A350815D012A17698128</code>'''
!
|<code>16DE</code>
|<code>1680</code>
|<code>0D58</code>
!
|Mon Mar  1 19:14:23 2021
|-
|24
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001D</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>2B</code>
!
|'''<code>900800A350815D0129DCBE812C</code>'''
!
|<code>172A</code>
|<code>1610</code>
|<code>E799</code>
!
|Mon Mar  1 19:14:23 2021
|-
|25
|<code>00FF</code>
|<code>2A</code>
|<code>D5</code>
|<code>001D</code>
|<code>29</code>
|<code>F0611C3E</code>
|<code>F03B9FFB</code>
|<code>51</code>
!
|'''<code>91080091504CAD0129BD448152</code>'''
!
|<code>1350</code>
|<code>1740</code>
|<code>8FAD</code>
!
|Mon Mar  1 22:13:25 2021
|}
<br />
{| class="wikitable"
|+0xD5 Packets where actual time along with uptime is observed
! rowspan="3" |Pkt
!1
!
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!
!
!16
!17
|-
! colspan="4" |Not part of CRC calc
! colspan="12" |Data Packet (Oncor Meter)
! colspan="3" |Trailing 6 Bytes
!
!
|CB72
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Meter ID1
!Meter ID2
!Counter
!Epoch Time
!Unknown
Reading?
!Uptime
!Unknown
!Unknown
!WAN Address
Meter ID2
!Meter ID2
!Unknown Data
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
!1
|00FF
|2A
|D5
|0047
|51
|F0C00020
|F03B9FFB
|18
|'''60378AB1'''
|00033D56
|0006C31A
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602030705070704000000 04C2 C000 204C 0401 FA 2030208180
|2163
|1900
|75F3
|00
|-
!2
|00FF
|2A
|D5
|0047
|51
|F10679DE
|F03B9FFB
|1E
|'''60378C72'''
|00023F96
|0006C4DB
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602030705070704000000 0718 6800 204C 0401 FA 2030208180
|0BF7
|1D30
|CDB4
|00
|-
!3
|00FF
|2A
|D5
|0047
|51
|F159CD44
|F03B9FFB
|B4
|'''603A627C'''
|00028F50
|00099AE5
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602020705070805000000 02A3 C800 1E6C 0401 D9 2030208180
|226A
|1A10
|7330
|00
|-
! colspan="5" |
! colspan="14" |Payload (CoServ Meter)
! colspan="2" |
|-
!4
|00FF
|2A
|D5
|0047
|51
|F143250D
|5021D005
|1A
|'''603AD051'''
|000130D8
|000D10ED
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 02C3 0800 0E20 0200 E3 20301F8180
|22F0
|1C40
|4FEB
|00
|-
!5
|00FF
|2A
|D5
|0047
|51
|F143248A
|5021D005
|64
|'''603AD09C'''
|000133C6
|000D1138
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 0BA0 9000 0E20 0200 E3 20301F8180
|4076
|1150
|73A7
|00
|-
!6
|00FF
|2A
|D5
|0047
|51
|500F0DD6
|5021D005
|80
|'''603AD0D3'''
|000135EC
|000D116F
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 01D8 A800 0E20 0200 E3 20301F8180
|1412
|2E40
|ADC1
|00
|00
|}
|}
<code>1) Header = 0x00FF2A</code>


<code>2) Packet Type = 0xD5</code>
*Epoch time calculator and explanation can be found [https://www.epochconverter.com/ here], first convert time from hex to decimal then input into converter.


<code>3) Packet Length = 0x0016</code>


<code>4) Unknown = 0x21</code>
<code>00FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04</code>


<code>5) Meter ID #1 = F05FCB84</code>
<code>00FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04</code>


<code>6) Meter ID #2 = F0FC4DB1</code>
<code>00FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00</code>


<code>7) Unknown = 0xE288</code>
<code>00FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04</code>


<code>8) Unknown = 0x0100</code>
<code>00FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04</code>


<code>9) Unknown= 0x273205</code>
<code>00FF2A D5 0047 51 F05A4BCC F03D4CD7 5A 6032F37F 0001DA2E 00022BE9 A483 0101 50D075D9E2E0 F03D4CD7</code> <code>000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00</code>
<references />


<code>10) Unknown = 0x00781930</code>
===Data captures===
'''''*Note: This file does not contain the trailing bytes shown in the captures above, it stops at the 16 bit Checksum.'''''


<code>11) Checksum = 0xCB72</code>
====Dallas====
[https://wiki.recessim.com/w/images/9/9b/Oncor_Capture_01-07-2023_30hrs.zip Oncor Capture 01-07-2023 30hrs (CONTAINS NEW PACKETS)]


<code>12) Trailing byte = 0x00</code>
====Austin====
[[:File:Austin energy.txt|Austin energy (Two Meters)]]


90C3717A is PV


<code>00FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04</code>
90C1FD1A is Net meter


<code>00FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04</code>
===GPS Tagged Wardrive Files===
Format will likely change for the files as more is learned, currently the format is:
Meter_ID, Uptime(seconds), Uptime(days), GPS_Data($GPGGA)
[https://wiki.recessim.com/w/images/a/a6/Wardrive-NTX_to_Highland-Park-03-09-2021.csv Wardrive-NTX_to_Highland-Park-03-09-2021.csv]


<code>00FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00</code>
[https://wiki.recessim.com/w/images/2/2b/Dallas-Wardrive-GPS_uptime.zip KML File] used in YouTube [https://youtu.be/Y_sh605Q7oA GPS Decoding video]


<code>00FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04</code>
===Capture files from various regions===
[https://wiki.recessim.com/w/images/7/76/RAW_Capture_NJ.txt.txt Raw capture from New Jersey]<br />[https://wiki.recessim.com/w/images/8/85/Seattle-WA-SCL.txt Raw capture for Seattle City Light (SCL) from Seattle, Washington, USA]


<code>00FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04</code>
<br />
 
<code>00FF2A D5 0047 51 F05A4BCC F03D4CD7 5A6032F37F0001DA2E00022BE9 A483 010150D075D9E2E0 F03D4CD7</code> <code>000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00</code>
<references />
Retrieved from "https://wiki.recessim.com/view/Landis%2BGyr_GridStream_Protocol"