Sun Ray protocol observations

Markus Kuhn, Paul Evans

Here are some observations of what happens when a Sun Ray 1 powers up:

Devices involved:

Sunray: 8:0:20:c1:d:fb  = 192.168.128.20
Server: 8:0:20:c5:fe:46 = piper-ge0.cl.cam.ac.uk (192.168.128.1)

  - Sun Ray sends out DHCP request (RFC 2131, RFC 1533) broadcast to
    255.255.255.255

     0.0.0.0.bootpc > 255.255.255.255.bootp: 
              xid:0x5dc3dfb0
              DHCP:DISCOVER
              Class-identifier:"SUNW.NewT.SUNW"
              Client-identifier:01:08:00:20:c1:0d:fb

  - Server replies BOOTP and provides "your IP address" value 192.168.128.20

     piper-ge0.cl.cam.ac.uk.bootp > 192.168.128.20.bootpc:
              xid:0x5dc3dfb0
              Your-IP:192.168.128.20
              DHCP:OFFER
              Server-identifier:192.168.128.1 (piper-ge0.cl.cam.ac.uk)
              Broadcast address:192.168.128.255
              Subnet-mask:255.255.255.0
              MTU:1500
              router:piper-ge0.cl.cam.ac.uk
              IP address lease time:86400
              Vendor-specific-information:
                   1f 04 c0a88001 = 192.168.128.1 (piper-ge0.cl.cam.ac.uk)
                   21 03 676530 = "ge0"
                   17 1d 312e325f31362e612c5245563d323030
                         302e31302e33312e31362e3139
                         = "1.2_16.a,REV=2000.10.31.16.19"
                   15 04 c0a88001 = 192.168.128.1 (piper-ge0.cl.cam.ac.uk)
                   16 02 1b61 = 7009 (utauth port number)
                   18 04 c0a88001 = 192.168.128.1 (piper-ge0.cl.cam.ac.uk)
                   19 01 06
                   1a 01 06
                   1b 01 06
                   1c 01 06
                   1d 01 06

  - Meaning of Vendor-specific-information clear from
    piper:/var/dhcp/dhcptab:

      AuthSrvr s       Vendor=SUNW.NewT.SUNW,21,IP,1,1           0x15
      AuthPort s       Vendor=SUNW.NewT.SUNW,22,NUMBER,2,1       0x16
      NewTVer  s       Vendor=SUNW.NewT.SUNW,23,ASCII,1,0        0x17
      LogHost  s       Vendor=SUNW.NewT.SUNW,24,IP,1,1           0x18
      LogKern  s       Vendor=SUNW.NewT.SUNW,25,NUMBER,1,1       0x19
      LogNet   s       Vendor=SUNW.NewT.SUNW,26,NUMBER,1,1       0x1a
      LogUSB   s       Vendor=SUNW.NewT.SUNW,27,NUMBER,1,1       0x1b
      LogVid   s       Vendor=SUNW.NewT.SUNW,28,NUMBER,1,1       0x1c
      LogAppl  s       Vendor=SUNW.NewT.SUNW,29,NUMBER,1,1       0x1d
      FWSrvr   s       Vendor=SUNW.NewT.SUNW,31,IP,1,1           0x1f
      Intf     s       Vendor=SUNW.NewT.SUNW,33,ASCII,1,0        0x21
      DispRes  s       Vendor=SUNW.NewT.SUNW,32,NUMBER,4,1       0x20

    IAG: Here is a list of the indices used to refer to display settings:

         X  Width Height  Hz
        ----------------------
         2   640 x  480 @ 85
         3   800 x  600 @ 85
         4  1024 x  768 @ 60
         5  1024 x  768 @ 75
         6  1152 x  900 @ 66
         7  1152 x  900 @ 76
         8  1280 x 1024 @ 60
         9  1280 x 1024 @ 66
        10  1280 x 1024 @ 75
        11  1280 x 1024 @ 76
        12  1280 x 1024 @ 85
        13  1024 x  768 @ 85
        14   640 x  480 @ 60
        15   800 x  600 @ 60

  - Sun Ray asks via ARP for the server's hardware address

      arp who-has piper-ge0.cl.cam.ac.uk (Broadcast) tell 192.168.128.20

  - Server replies ARP request:

      arp reply piper-ge0.cl.cam.ac.uk is-at 8:0:20:c5:fe:46

    [Odd: Server sends already UDP packets (src port 34487 dest port 63087),
     possibly retry attempts from the previous session?]

  - Sun Ray establishes TCP connections to the server on
    ports utauthd (7009) and utdevmgrd (7011)

  - Sun Ray sends on utdevmgrd/tcp the string "connect\n".

  - Server replies on utdevmgrd/tcp with the string "beat.t=c4e9d8\n"

    Try yourself:

      $ telnet piper-ge0.cl.cam.ac.uk utdevmgrd
      connect
      beat t=c4cd24

  - Sun Ray sends on utdevmgrd/tcp the ASCII text lines

      device term=IEEE802.080020c10dfb bus=usb curconf=1 owner termip=192.168.128.20:7777 nunits=1 class=9.0.0 prod=0.0.0 usb.usb=1 addr=1.1 t=c4e9d8
      unit term=IEEE802.080020c10dfb bus=usb addr=1.1 unitid=1.0.0 class=9.1.0 owner t=c4e9d8

  - Sun Ray sends on utauthd/tcp the ASCII text line

        infoReq _=1 cause=insert event=insert fw=1.2_16.a,REV\0752000.10.31.16.19,Boot:1.3;\0401999.05.18-15:14:06-PDT hw=CoronaP1 id=080020c10dfb initState=1 pn=51510 sn=080020c10dfb startRes=1280x1024 state=disconnected tokenSeq=1 type=pseudo

  - Server sends on utauthd/tcp the ASCII text line

        discInf access=denied module=ZeroAdmin.m1

  - Sun Ray sends on utauthd/tcp the ASCII text line

        keepAliveReq _=1 fw=1.2_16.a,REV\0752000.10.31.16.19,Boot:1.3;\0401999.05.18-15:14:06-PDT hw=CoronaP1 pn=51510 sn=080020c10dfb state=disconnected

  - Server sends on utauthd/tcp the ASCII text line

        connInf tokenSeq=1 module=ZeroAdmin.m1 access=allowed

  - Server sends on utauthd/tcp the ASCII text line

        keepAliveCnf

  - Sun Ray sends on utauthd/tcp the ASCII text line

        connRsp _=1 access=allowed fw=1.2_16.a,REV\0752000.10.31.16.19,Boot:1.3;\0401999.05.18-15:14:06-PDT hw=CoronaP1 pn=51510 sn=080020c10dfb state=connected

  - Server and Sun Ray now exchange UDP packets, server port: 34624, Sun Ray port 51510, looks like SunRPC but with 16-bit words instead of 32-bit.

  - Sun Ray sends on utdevmgrd/tcp the ASCII text lines

        device term=IEEE802.080020c10dfb bus=usb.usb curconf=1 owner termip=192.168.128.20:7777 nunits=1 class=9.0.0 prod=1105.5190.110 usb.usb=110 addr=1.1.2 t=c4e9d9
        unit term=IEEE802.080020c10dfb bus=usb addr=1.1.2 unitid=1.0.0 class=9.0.0 owner usb.conf=+CQIiAAEBAOAyCQQAAAEJAAAACSkECQAyZAAeBwWBAwEA/w- t=c4e9d9

  - Server now starts brief UDP exchange from its port 34625 with Sun Ray port 51510

  - Eventually however, server replies with

        icmp: piper-ge0.cl.cam.ac.uk udp port 34625 unreachable

A few hypothesis on the protocol so far:

Related literature

Special thanks to Ian Grant, Ian Pratt and Martyn Johnson.

created 2002-10-31 – last modified 2002-11-24 – http://www.cl.cam.ac.uk/~mgk25/sunray/protocol.html