Open main menu
RECESSIM

Changes

Landis+Gyr GridStream Protocol (view source)

Revision as of 14:08, 3 April 2023

14,303 bytes added ,  14:08, 3 April 2023
→‎00FF 2A 55 Meter Data: Changed data tags based on discovery using IWR
[[File:LandisGyrResidentialMeter1.JPG|thumb]]
==Reverse Engineering and Protocol Analysis==Analysis and decoding of the packets used on the Landis+Gyr GridStream mesh network.<br />
===Packet Structure===
====Sync and Header====
----The sync word that the Landis+Gyr Gridstream smart meters send is use a 52 bit sync shown below, this regardless of Gridstream version. This can be used in GNU Radio or other tools along with the header to receive only uniquely identify packets transmitted by the meters. Note that at the start of the header we begin using start and stop bits. These must be stripped off of the rest of the data packet during processing.
{| class="wikitable"
|+Sync and Header52 bits long! colspan="67" |Sync! colspan="3" |Header
|-
!0xAA
!0xAA
!0xAA
!0xAA
!0xA
!0x00
!0xFF
!0x2A
|-
|10101010
|10101010
|10101010
|10101010
|1010
|}
----Of particular note is the difference between versions 1-4 and version 5. In version 5 there are two bits [11] that do not respect the start/stop bit checks of the prior versions. The older protocol expects a 0 start bit, 8 data bits and a 1 stop bit. By violating two consecutive start bits the older versions of GridStream ignore version 5 even if they have the same CRC Adder! This appears to be a way to add backwards compatibility to newer versions of GridStream.
{| class="wikitable"
|+Header for Gridstream
! colspan="2" |Header v1 - v4
! rowspan="3" |
! colspan="2" |Header v5
|-
!0x00
!0xFF (10 bit)
!0x00
!0xFF (11 bit)
|-
|0 '''00000000''' 1
|0 '''11111111''' 1
|0 '''0010101000000000''' 1|[11] '''11111111''' 1
|}
----Using GNU Radio it was found that shortening the Sync requirements a bit and incorporating part of the header leads to the cleanest data for further downstream processing. The modified sync shown in 8 bit chunks is shown below. These two sync's are both loaded into the '''PDU Align''' block and if either one is matched the full packet is passed downstream.
{| class="wikitable"
|+Sync Word used with GNURadiofor v4
!0xAA
!0xAA
!0x00
!0x5F
!0xF
|-
|10101010
|10101010
|00000000
|01011111
|1111
|}
{| class="wikitable"
|+Sync Word used with GNURadio for v5
!0xAA
!0xAA
!0xA00x00!0x050x7F!0xFF0x1F
|-
|10101010
|10101010
|1010101000000000|1010101001111111|10100000|00000101|1111111111111
|}
The final byte of the sync (0x2A) along with it's start and stop bits are discarded as part of the processing.
----<br />
====Type, Length Packet Types and Sub TypeStructures====----Data is shown in Hexadecimal unless stated otherwise So far only two types of packets have been observed, a 0x55 and a 0xD5 packet. Multiple lengths and SubTypes of these exist, a few are listed below.
{| class="wikitable"
|+
!
!Start of
Frame
!Type
!SubTypeSub Type!LengthSequence!colspan="2" |Packets Purpose
|-
!1|0x5500FF|0x3000|0x002381 or 85|1 Byte| colspan="2" |Report up-time and other unknown dataPower Usage (Device Control Word DCW)
|-
!2|0x5500FF|01|0x3081 or 85|0x00281 Byte|colspan="2" |Report Power Usage (Device Control Word DCW)
|-
! colspan="4" |
!
|00FF
|02
|81 or 85
|1 Byte
| colspan="2" |Report Power Usage (Device Control Word DCW)
|-
!3|0xD500FF|0x2103|0x001681 or 85|1 Byte|-!4|0xD5|0x21|0x0017colspan="2" |Report Power Usage (Device Control Word DCW)
|-
! colspan="4" |
!
!Start of
Frame
!Type
!Sub Type
!Length
!Unknown
!Packets Purpose
|-
!51|0xD500FF|0x292A|0x001655|0023|30|Report up-time and other unknown data
|-
!62|0xD500FF|0x292A|0x0017D5|0047|51|Includes Epoch and Uptime
|-
! colspan="4" |!|-!7|0xD5|0x51|0x00473|00FF|-!82A|0xD5D5|0xC000FD|0x00FDC0
|
|}
----<br />
====Data====
----Add Data varies per packet type but a common theme is the 0x55 packets appear to be broadcasts from the meters with only their own ID. 0xD5 packets usually contain two ID's and appear to be how data hereis routed across the network. Sometimes one of the meter ID's in a 0xD5 packet is FFFFFFFF which may be a broadcast packet. This was observed when packets were sent that appear to be updating the system time of the meters.
----<br />
====Checksum====
----
C++ source code below used to calculate the CRC, different energy providers use a different initial CRC value. Assume this is to segment traffic, unsure if Routers/Collectors are shared by different providers to return traffic or not.  <presyntaxhighlight lang="c++">uint16_t Landis_crc16 (uint16_t crc, const std::vector<uint8_t> &data, size_t size) {// CoServ CRC = 0x45F8// Oncor CRC = 0x5FD6
// Hard coded Poly 0x1021
    uint16_t  uint16_t i = 0;     while  while (size--) {        crc ^= data[i] << 8; i++; for (unsigned k = 0; k < 8; k++) crc = crc & 0x8000 ? (crc << 1) ^ 0x1021 : crc << 1;         }      return crc; }</presyntaxhighlight>----<br />
===Captured Meter Data===
----
====0x55 00FF 2A 55 Meter Data====
The data below was captured from the same meter (F0EE36DB) and shows some of the values that can change with each transmission. Different meters have different fixed data and some of the data changes less frequently as well.
{| class="wikitable"
|+
0x55 Captured packets from Meter F0EE36DB(Oncor)
! rowspan="3" |Pkt
!0
!1
!2
!3
|
!4
!5
!15
!16
|
!17
!18
|-
! colspan="34" |Not part of CRC calc|! colspan="139" |Data|Packet! colspan="23" |Trailing 6 Bytes!
|-
!HeaderStart of Frame
!Type
!SubType
!Length
|
!SubType
!Unknown
!Unknown
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime (seconds)
!Unknown
!Meter IDLAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Unknown|!CRCChecksum
!Trailing
|-
!1|100FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''0C'''
|'''0001ECBF'''
|F0EE36DB
|0100
|2132213204|'''04384F384F'''
|7E80
! rowspan="10" |
|0896
|04
|-
!2|200FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''16'''
|'''0001ECC6'''
|F0EE36DB
|0100
|2132213204|'''043AC53AC5'''
|7E80
|F47E
|04
|-
!3|300FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''2A'''
|'''0001ED05'''
|F0EE36DB
|0100
|2132213204|'''0412071207'''
|7E80
|A412
|04
|-
!4|400FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''34'''
|'''0001ED29'''
|F0EE36DB
|0100
|2132213204|'''041FF91FF9'''
|7E80
|D9C4
|04
|-
!5|500FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''38'''
|'''0001ED37'''
|F0EE36DB
|0100
|2132213204|'''0425712571'''
|7E80
|963C
|04
|-
!6|600FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''42'''
|'''0001ED5C'''
|F0EE36DB
|0100
|2132213204|'''0433A933A9'''
|7E80
|8384
|04
|-
!7|700FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''4C'''
|'''0001ED60'''
|F0EE36DB
|0100
|2132213204|'''04354D354D'''
|7E80
|2CB6
|04
|-
!8|800FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''4E'''
|'''0001ED79'''
|F0EE36DB
|0100
|2132213204|'''043F253F25'''
|7E80
|871A
|04
|-
!9|900FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''60'''
|'''0001EDA6'''
|F0EE36DB
|0100
|2132213204|'''040F050F05'''
|7E80
|25C9
|04
|-
!10|1000FF|00FF2A2A
|55
|0023
!
|30
|FFFFFFFFFFFF
|50|CF8DD9E2|C050CF8DD9E2C0
|'''6A'''
|'''0001EDCD'''
|F0EE36DB
|0100
|2132213204|'''041E551E55'''
|7E80
|F33F
|04
|}
1) Header = 0x00FF2A 2) [[File:55 Packet Type = 0x55  3) Packet Length = 0x0023  4) SubType = 0x30  5) Unknown = FFFFFFFFFFFF (Empty Data Slot?)  6) Unknown = 0x50  7) Unknown = CF8DD9E2 (Appears to either be location identifier or duplicate meter ID in some cases)  8) Unknown = C0Timing Analysis.png|thumb|600x600px|Field 15 Timing Analysis -Anonymous]]9) Counter = '''02''' (Increments some amount with each transmission and rolls over at 0xFF)  10) Uptime = 0x'''0001ECA3''' (Value in seconds since meter powered Commentary onthe data fields above, easy way to they have been grouped based on sample analysis but this could be wrong. If you see last time there was an outage!)  11) Unknown Identifier #5 = 0xA483  12) Meter ID = 0xF0EE36DB  13) Unknown = 0x0100 a new pattern not noticed before you may be correct.
14) Unknown = 0x2132 *Field 5 - Never observed a packet with this length and subtype that wasn't all FF's
15) Unknown = 0x'''042D19''' *Field 6 - WAN Address - Oncor uses GPS coordinates, CoServ uses LAN with padding of some kind. The open source [https://github.com/beroset/gpsdecode gpsdecode] library shows one way to translate between WAN Address and GPS coordinates.
16) Unknown = 0x7E80 *Field 7 - Increments some amount with each transmission and rolls over at 0xFF, always an even hex value
17) Checksum = 0xF154 *Field 8 - Value in seconds since meter powered on, '''easy way to see last time the meter experienced a power outage.'''*Field 10 - LAN Address, Meter ID that's listed on the sticker on the front
18) Trailing byte = 0x04----'''** NEW **'''
====0xD5 Meter Data====There appear '''Field 13''' - Timing in hundredths of a second, counts from 0 to be multiple packet lengths and styles 167.99 (0x419F) seconds then rolls over to 0 again. Credit for this discovery goes to an anonymous reader who examined the 0xD5 packet. There are some samples below showingdataset at the bottom of the page!!
{| class="wikitable"
|+0xD5 0x55 Captured packetpackets from Meter 5021D005 (Coserv)
! rowspan="3" |Pkt
!0
!1
!2
!3
|
!4
!5
!9
!10
|
!11
!12
!13
!14
!15
!16
|-
! colspan="34" |Not part of CRC calc|! colspan="79" |DataPacket! colspan="3" |!Trailing 6 Bytes
!
|-
!HeaderStart of Frame
!Type
!SubType
!Length
|
!SubType
!Meter ID #1
!Meter ID #2
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum!Trailing|-!1|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|7C|'''0003FB20'''|A403|5021D005|'''0100'''|'''072001'''|1E56|7E00|9032|04|-!2|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|AE|'''0003FB9E'''|A403|5021D005|'''0100'''|'''072001'''|0DA8|7E00|83E8|04|-!3|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|B8|'''0003FBC1'''|A403|5021D005|'''0100'''|'''072001'''|1B54|7E00|2924|04|-!4|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|C0|'''0003FC30'''|A403|5021D005|'''0100'''|'''072001'''|052E|7E00|09FC|04|-!5|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|EA|'''0003FC9F'''|A403|5021D005|'''0100'''|'''072001'''|3062|7E00|C69A|04|-! colspan="18" |Power restored after an outage|-!6|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|06|'''0000000F'''|A403|5021D005|'''01EA'''|'''6000FE'''|26DA|7E30|90CE|04|-!7|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|0E|'''0000000F'''|A403|5021D005|'''01EA'''|'''6000FE'''|26EF|7E10|2740|04|-!8|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|20|'''00000011'''|A403|5021D005|'''01EA'''|'''6000FE'''|2801|7E90|8B23|04|-!9|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|2C|'''00000013'''|A403|5021D005|'''01EA'''|'''6000FE'''|2883|7E60|1A1A|04|-!10|00FF|2A|55|0023|30|FFFFFFFFFFFF|FE5021D00500|54|'''00000017'''|A403|5021D005|'''01EA'''|'''6000FE'''|2A72|7E80|E3CD|04|}---- ====00FF 2A D5 Meter Data====There appear to be multiple packet lengths and styles for the 0xD5 packet. Some samples shown below, [https://wiki.recessim.com/w/images/9/9e/D5-Packets-Table-F03B9FFB.txt download as a txt file].{| class="wikitable"|+0xD5 Captured packets! rowspan="3" |Pkt!1!!2!3!4!5!6!7! colspan="3" |8!10!!11! colspan="2" ||-! colspan="4" |Not part of CRC calc! colspan="9" |CRC'd Data
!CRC
!Trailingcolspan="2" ||-!Start of Frame!Type!SubType!Length!Unknown!DST Meter!SRC Meter!PacketCounter! colspan="3" |'''Payload'''!Timing(0.01 increments)!Unknown!Checksum! colspan="2" |Timestamp
|-
|1
|00FF2A<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0011</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>AE</code>!|'''<code>98</code>'''!|<code>4014</code>|<code>1630</code>|<code>9B47</code>!|Mon Mar  1 08:43:20 2021|-|2|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0011</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>BA</code>!|'''<code>98</code>'''!|<code>04B5</code>|<code>1650</code>|<code>C505</code>!|Mon Mar  1 08:43:36 2021|-|3|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0011</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>CA</code>!|'''<code>98</code>'''!|<code>0844</code>|<code>1600</code>|<code>413C</code>!|Mon Mar  1 08:43:45 2021|-|4|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0016</code>|<code>21</code>|<code>F0653657</code>|<code>F03B9FFB</code>|<code>72</code>!|'''<code>8801001F3204</code>'''!|<code>2E24</code>|<code>1140</code>|<code>B6B1</code>!|Mon Mar  1 11:50:10 2021|-|5|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0016</code>|<code>21</code>|<code>F0EF3BCE</code>|<code>F03B9FFB</code>|<code>62</code>!|'''<code>8801001E3204</code>'''!|<code>2393</code>|<code>1730</code>|<code>6DA6</code>!|Mon Mar  1 12:45:43 2021|-|6|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0016</code>|<code>21</code>|<code>F1419ADD</code>|<code>F03B9FFB</code>|<code>7C</code>!|'''<code>9801001E3204</code>'''!|<code>332C</code>|<code>1780</code>|<code>BB3E</code>!|Mon Mar  1 12:46:23 2021|-|7|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0016</code>|<code>21</code>|<code>F07C5F0C</code>|<code>F03B9FFB</code>|<code>9A</code>!|'''<code>8801001E3204</code>'''!|<code>018C</code>|<code>1A80</code>|<code>4FCF</code>!|Mon Mar  1 12:47:04 2021|-|8|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0017</code>|<code>29</code>|<code>8073AB83</code>|<code>F03B9FFB</code>|<code>C2</code>!|'''<code>8801001E320404</code>'''!|<code>06BF</code>|<code>1390</code>|<code>0244</code>!|Mon Mar  1 18:17:41 2021|-|9|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0017</code>|<code>29</code>|<code>8073AB83</code>|<code>F03B9FFB</code>|<code>D2</code>!|'''<code>8801001E320404</code>'''!|<code>0BF4</code>|<code>1340</code>|<code>2AB3</code>!|Mon Mar  1 18:17:54 2021|-|10|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0017</code>|<code>29</code>|<code>8073AB83</code>|<code>F03B9FFB</code>|<code>E4</code>!|'''<code>8801001E320404</code>'''!|<code>11FF</code>|<code>1330</code>|<code>8517</code>!|Mon Mar  1 18:18:10 2021|-|11|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>0017</code>|<code>29</code>|<code>8073AB83</code>|<code>F03B9FFB</code>|<code>EA</code>!|'''<code>8801001E320404</code>'''!|<code>1271</code>|<code>1340</code>|<code>5091</code>!|Mon Mar  1 18:18:11 2021|-|12|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>A1</code>!|'''<code>9001001E320406009950D1CA</code>'''!|<code>097E</code>|<code>1620</code>|<code>46B7</code>!|Mon Mar  1 09:39:48 2021|-|13|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F05C3966</code>|<code>F03B9FFB</code>|<code>1D</code>!|'''<code>9001001E320406009D50D515</code>'''!|<code>158D</code>|<code>2220</code>|<code>18A3</code>!|Mon Mar  1 12:59:07 2021|-|14|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>69</code>!|'''<code>9001001F6C0406009F50B910</code>'''!|<code>2957</code>|<code>1670</code>|<code>207F</code>!|Mon Mar  1 15:14:22 2021|-|15|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>17</code>!|'''<code>900100246C0406007A50A501</code>'''!|<code>3FF3</code>|<code>1680</code>|<code>5591</code>!|Mon Mar  1 16:08:32 2021|-|16|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>C7</code>!|'''<code>9001001F6C04060091500F11</code>'''!|<code>0072</code>|<code>1690</code>|<code>1F05</code>!|Mon Mar  1 16:14:13 2021|-|17|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>73</code>!|'''<code>900100236C0406007D5014A3</code>'''!|<code>0797</code>|<code>1620</code>|<code>D48F</code>!|Mon Mar  1 16:28:31 2021|-|18|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0FBBC6F</code>|<code>F03B9FFB</code>|<code>4D</code>!|'''<code>9101001F6C04060091504CAD</code>'''!|<code>133C</code>|<code>1D40</code>|<code>2347</code>!|Mon Mar  1 22:13:25 2021|-|19|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>B9</code>!|'''<code>90010022320406009E500632</code>'''!|<code>03F5</code>|<code>1730</code>|<code>FE1B</code>!|Mon Mar  1 23:14:22 2021|-|20|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001C</code>|<code>29</code>|<code>F0BCD31D</code>|<code>F03B9FFB</code>|<code>E7</code>!|'''<code>900100256C0506009B50D2A7</code>'''!|<code>1E0E</code>|<code>3F60</code>|<code>13BE</code>
!
|Tue Mar  2 00:56:17 2021
|-
|21
|F05FCB84<code>00FF</code>|F0FC4DB1<code>2A</code>|E288<code>D5</code>|0100<code>001C</code>|273205<code>29</code>|00781930<code>F0BCD31D</code>|<code>F03B9FFB</code>|<code>E5</code>!|'''<code>900100256C0506009850C186</code>'''!|<code>181F</code>|<code>3F90</code>|<code>305B</code>!|Tue Mar  2 01:21:14 2021|-|22|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001D</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>B7</code>!|'''<code>9008009150FA0E012ABA0E81B8</code>'''!|<code>0F15</code>|<code>1630</code>|<code>8383</code>!|Mon Mar  1 13:21:15 2021|-|23|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001D</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>27</code>!|'''<code>900800A350815D012A17698128</code>'''!|<code>16DE</code>|<code>1680</code>|<code>0D58</code>!|Mon Mar  1 19:14:23 2021|-|24|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001D</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>2B</code>!|'''<code>900800A350815D0129DCBE812C</code>'''!|<code>172A</code>|<code>1610</code>|<code>E799</code>!|Mon Mar  1 19:14:23 2021|-|25|<code>00FF</code>|<code>2A</code>|<code>D5</code>|<code>001D</code>|<code>29</code>|<code>F0611C3E</code>|<code>F03B9FFB</code>|<code>51</code>!|'''<code>91080091504CAD0129BD448152</code>'''!|<code>1350</code>|<code>1740</code>|<code>8FAD</code>!|Mon Mar  1 22:13:25 2021|}<br />{| class="wikitable"|+0xD5 Packets where actual time along with uptime is observed! rowspan="3" |Pkt!1!!2!3!4!5!6!7!8!9!10!11!12!13!14!15!!!16!17|-! colspan="4" |Not part of CRC calc! colspan="12" |Data Packet (Oncor Meter)! colspan="3" |Trailing 6 Bytes
!
|CB72-!Start ofFrame!Type!SubType!Length!Unknown!Meter ID1!Meter ID2!Counter!Epoch Time!UnknownReading?!Uptime!Unknown!Unknown!WAN AddressMeter ID2!Meter ID2!Unknown Data!Timing(0.01 increments)!Unknown!Checksum!Trailing|-!1|00FF|2A|D5|0047|51|F0C00020|F03B9FFB|18|'''60378AB1'''|00033D56|0006C31A|A483|0101|50CFB5D9E400|F03B9FFB|000103240602030705070704000000 04C2 C000 204C 0401 FA 2030208180|2163|1900|75F3|00|-!2|00FF|2A|D5|0047|51|F10679DE|F03B9FFB|1E|'''60378C72'''|00023F96|0006C4DB|A483|0101|50CFB5D9E400|F03B9FFB|000103240602030705070704000000 0718 6800 204C 0401 FA 2030208180|0BF7|1D30|CDB4|00|-!3|00FF|2A|D5|0047|51|F159CD44|F03B9FFB|B4|'''603A627C'''|00028F50|00099AE5|A483|0101|50CFB5D9E400|F03B9FFB|000103240602020705070805000000 02A3 C800 1E6C 0401 D9 2030208180|226A|1A10|7330|00|-! colspan="5" |! colspan="14" |Payload (CoServ Meter)! colspan="2" ||-!4|00FF|2A|D5|0047|51|F143250D|5021D005|1A|'''603AD051'''|000130D8|000D10ED|A403|0101|FE5021D00500|5021D005|000103200000000000000000000000 02C3 0800 0E20 0200 E3 20301F8180|22F0|1C40|4FEB|00|-!5|00FF|2A|D5|0047|51|F143248A|5021D005|64|'''603AD09C'''|000133C6|000D1138|A403|0101|FE5021D00500|5021D005|000103200000000000000000000000 0BA0 9000 0E20 0200 E3 20301F8180|4076|1150|73A7|00|-!6|00FF|2A|D5|0047|51|500F0DD6|5021D005|80|'''603AD0D3'''|000135EC|000D116F|A403|0101|FE5021D00500|5021D005|000103200000000000000000000000 01D8 A800 0E20 0200 E3 20301F8180|1412|2E40|ADC1
|00
|}
<code>1) Header = 0x00FF2A</code>
<code>2) Packet Type = 0xD5<*Epoch time calculator and explanation can be found [https:/code>/www.epochconverter.com/ here], first convert time from hex to decimal then input into converter.
<code>3) Packet Length = 0x0016</code>
<code>4) Unknown = 0x2100FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04</code>
<code>5) Meter ID #1 = F05FCB8400FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04</code>
<code>6) Meter ID #2 = F0FC4DB100FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00</code>
<code>7) Unknown = 0xE28800FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04</code>
<code>8) Unknown = 0x010000FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04</code>
<code>9) Unknown= 0x27320500FF2A D5 0047 51 F05A4BCC F03D4CD7 5A 6032F37F 0001DA2E 00022BE9 A483 0101 50D075D9E2E0 F03D4CD7</code> <code>000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00</code><references />
<code>10) Unknown = 0x00781930</code>==Data captures==='''''*Note: This file does not contain the trailing bytes shown in the captures above, it stops at the 16 bit Checksum.'''''
<code>11) Checksum = 0xCB72<===Dallas====[https:/code>/wiki.recessim.com/w/images/9/9b/Oncor_Capture_01-07-2023_30hrs.zip Oncor Capture 01-07-2023 30hrs (CONTAINS NEW PACKETS)]
<code>12====Austin====[[:File:Austin energy.txt|Austin energy (Two Meters) Trailing byte = 0x00</code>]]
90C3717A is PV
<code>00FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04</code>90C1FD1A is Net meter
<code>00FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04<===GPS Tagged Wardrive Files===Format will likely change for the files as more is learned, currently the format is: Meter_ID, Uptime(seconds), Uptime(days), GPS_Data($GPGGA)[https:/code>/wiki.recessim.com/w/images/a/a6/Wardrive-NTX_to_Highland-Park-03-09-2021.csv Wardrive-NTX_to_Highland-Park-03-09-2021.csv]
<code>00FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00<[https:/code>/wiki.recessim.com/w/images/2/2b/Dallas-Wardrive-GPS_uptime.zip KML File] used in YouTube [https://youtu.be/Y_sh605Q7oA GPS Decoding video]
===Capture files from various regions===[https://wiki.recessim.com/w/images/7/76/RAW_Capture_NJ.txt.txt Raw capture from New Jersey]<codebr />00FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04<[https://wiki.recessim.com/w/images/8/85/code>Seattle-WA-SCL.txt Raw capture for Seattle City Light (SCL) from Seattle, Washington, USA]
<code>00FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04</code> <code>00FF2A D5 0047 51 F05A4BCC F03D4CD7 5A6032F37F0001DA2E00022BE9 A483 010150D075D9E2E0 F03D4CD7</code> <code>000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00</code><references br />
Retrieved from "https://wiki.recessim.com/view/Special:MobileDiff/1339...1802"