Siemens / Gigaset¶

All Siemens phones seem to make use of an TLV-encoded protocol encapsulated in <<ESCAPE-TO-PROPRIETARY>> information elements.

Basic message structure¶

All messages contain one or more proprietary information elements of the form:

Octet	Contents
0	IE type
1	Length of contents (n)
2	First octet of content
...	...
n + 2	Last octet of content

This matches the S-format variable length information element structure. If multiple elements are present, they are concatenated.

Information Elements¶

<<CISS-REQUEST-SEQ>> / <<CISS-ACKNOWLEDGEMENT-SEQ>>¶

When transporting messages over CISS, each request contains a <<CISS-REQUEST-SEQ>>
IE. The receipient needs to return that sequence number in a <<CISS-ACKNOWLEDGEMENT-SEQ>>
IE, otherwise the request will be resent using a new sequence number.

<CISS-REQUEST-SEQ>: 0x5b¶

Octet	Contents
0	<<CISS-REQUEST-SEQ>>
1	Length of contents (1)
2	Sequence number

<CISS-ACKNOWLEDGEMENT-SEQ>: 0x59¶

Octet	Contents
0	<<CISS-ACKNOWLEDGEMENT-SEQ>>
1	Length of contents (1)
2	Sequence number

References:

• FRITZ!Box 7240 CISS information exchanges
• Sinus 501V CISS information exchanges

<<TIME-DATE>>¶

The <<TIME-DATE>> IE indicates the current time and date. It is transported in {FACILITY} messages.

<<TIME-DATE>>: 0x3b

Octet	Contents
0	<<TIME-DATE>>
1	Length of contents (9)
2	? Date Header ? (0x03)
3	Day (BCD encoded)
4	Month (BCD encoded)
5	Year (BCD encoded)
6	Unknown (0x00)
7	? Time Header ? (0x04)
8	Hours (BCD encoded)
9	Minutes (BCD encoded)
10	Seconds (BCD encoded) / ? Mode 12/24 h ?

References:

• FRITZ!Box 7240 <<TIME-DATE>>
• Gigaset A140 <<TIME-DATE>>

<<DISPLAY>>¶

The <<DISPLAY>> IE supplies some text to the PP to permanently display.
It is transported in {FACILITY} messages. The size appears to be limited
to less that a full line.

<<DISPLAY>>: 0x54

Octet	Contents
0	<<DISPLAY>>
1	Length of contents (n)
2	Handset number
3	First character
...	...
n + 2	Last character

References:

• FRITZ!Box 7240 <<DISPLAY>>
• Sinus 501V <<DISPLAY>>
• Gigaset A140 <<DISPLAY>>

<<UNNAMED>>¶

The <<UNNAMED>> IE appears to be used for various purposes. It contains an inner
structure that again follows the TLV-encoding of variable length S-format
messages (see [#Basicmessagestructure Basic message structure]). It is transported
in {FACILITY} messages.

<<UNNAMED>>: 0x58

Octet	Contents
0	<<UNNAMED>>
1	Length of contents (n)

One or more of these inner structures are present:

2	Subtype
3	Length of subtype (m)
4	First octet of subtype contents
...	...
4+m	Last octet of subtype contents

Event notification subtype¶

Subtype: 0x02

Some kind of event notification. In case of Sinus 501: first octets control the
"T-Com message waiting" notification button: { 0x1, num } number of SMS waiting, {0x4, num } number of missed calls. Remaining octets unknown, general format seems to
be { type, num }.

Display subtype¶

Subtype: 0x03

Contains contents to be displayed, apparently preceeded by some control characters

Prefix/Number subtypes¶

All these subtypes contain the IA5 encoded number as content:

Octet	Content
0	Subtype
1	Length (n)
2	First digit
...	...
n + 2	Last digit

Call prefix for national area codes subtype¶

Subtype: 0x09

Call prefix for country codes subtype¶

Subtype: 0x0a

Local area code subtype¶

Subtype: 0x0b

Country code subtype¶

Subtype: 0x0c

<<CALLER-ID>>¶

<<CALLER-ID>> : 0x28

Octet	Contents
0	<<CALLER-ID>>
1	0x80 (unknown)
2	length (n)
3	first digit
...	...
n + 3	Last digit

References:

• Gigaset A140 <<CALLER-ID>>

Traces¶

• Trace of access rights request between Sinus 501 and FRITZ!Box 7240
• Trace of locate request between Sinus 501 and Sinus 501V
• Trace of prefix configuration between Sinus 501 and SInus 501V
• Trace of locate request between Gigaset A140 and its base
• Trace of missed call between Gigaset A140 and its base

Testing¶

The example/fp-siemens-proprietary program from libdect can be used for testing.