OsmocomDECT

h1. Siemens / Gigaset

All Siemens phones seem to make use of an TLV-encoded protocol encapsulated in <<ESCAPE-TO-PROPRIETARY>> information elements.

h2. Basic message structure

All messages contain one or more proprietary information elements of the form:

| Octet | Contents               |

| 0     | IE type                |

| 1     | Length of contents (n) |

| 2     | First octet of content |

| ...   | ...                    |

| n + 2 | Last octet of content  |

This matches the S-format variable length information element structure. If multiple elements are present, they are concatenated.

h2. Information Elements

h3. <<CISS-REQUEST-SEQ>> / <<CISS-ACKNOWLEDGEMENT-SEQ>>

When transporting messages over CISS, each request contains a <<CISS-REQUEST-SEQ>>

IE. The receipient needs to return that sequence number in a <<CISS-ACKNOWLEDGEMENT-SEQ>>

IE, otherwise the request will be resent using a new sequence number.

h4. <CISS-REQUEST-SEQ>: 0x5b

| Octet | Contents               |

| 0     | <<CISS-REQUEST-SEQ>>   |

| 1     | Length of contents (1) |

| 2     | Sequence number        |

h4. <CISS-ACKNOWLEDGEMENT-SEQ>: 0x59

| Octet | Contents                     |

| 0     | <<CISS-ACKNOWLEDGEMENT-SEQ>> |

| 1     | Length of contents (1)       |

| 2     | Sequence number              |

References:

 * [wiki:trace_access_rights_sinus501_fritzbox7240#CISSinformationexchange FRITZ!Box 7240 CISS information exchanges]

 * [wiki:trace_locate_request_sinus501_sinus501v#CISSinformationexchange3 Sinus 501V CISS information exchanges]

h3. <<TIME-DATE>>

The <<TIME-DATE>> IE indicates the current time and date. It is transported in {FACILITY} messages.

<<TIME-DATE>>: 0x3b

| Octet | Contents               |

| 0     | <<TIME-DATE>>          |

| 1     | Length of contents (9) |

| 2     | ? Date Header ? (0x03) |

| 3     | Day (BCD encoded)      |

| 4     | Month (BCD encoded)    |

| 5     | Year (BCD encoded)     |

| 6     | Unknown (0x00)         |

| 7     | ? Time Header ? (0x04) |

| 8     | Hours (BCD encoded)    |

| 9     | Minutes (BCD encoded)  |

| 10    | Seconds (BCD encoded) / ? Mode 12/24 h ? |

References:

 * [wiki:trace_access_rights_sinus501_fritzbox7240#CISSinformationexchange1 FRITZ!Box 7240 <<TIME-DATE>>]

 * [wiki:trace_access_rights_gigaseta140#TIME-DATE Gigaset A140 <<TIME-DATE>>]

h3. <<DISPLAY>>

The <<DISPLAY>> IE supplies some text to the PP to permanently display.

It is transported in {FACILITY} messages. The size appears to be limited

to less that a full line.

<<DISPLAY>>: 0x54

| Octet | Contents               |

| 0     | <<DISPLAY>>            |

| 1     | Length of contents (n) |

| 2     | Handset number         |

| 3     | First character        |

| ...   | ...                    |

| n + 2 | Last character         |

References:

 * [wiki:trace_access_rights_sinus501_fritzbox7240#CISSinformationexchange2 FRITZ!Box 7240 <<DISPLAY>>]

 * [wiki:trace_locate_request_sinus501_sinus501v#CISSinformationexchange3 Sinus 501V <<DISPLAY>>]

 * [wiki:trace_access_rights_gigaseta140#DISPLAY Gigaset A140 <<DISPLAY>>]

h3. <<UNNAMED>>

The <<UNNAMED>> IE appears to be used for various purposes. It contains an inner

structure that again follows the TLV-encoding of variable length S-format

messages (see [#Basicmessagestructure Basic message structure]). It is transported

in {FACILITY} messages.

<<UNNAMED>>: 0x58

| Octet | Contents                        |

| 0     | <<UNNAMED>>                     |

| 1     | Length of contents (n)          |

One or more of these inner structures are present:

| 2     | Subtype                         |

| 3     | Length of subtype (m)           |

| 4     | First octet of subtype contents |

| ...   | ...                             |

| 4+m   | Last octet of subtype contents  |

h4. Event notification subtype

Subtype: 0x02

Some kind of event notification. In case of Sinus 501: first octets control the

"T-Com message waiting" notification button: { 0x1, num } number of SMS waiting,

{0x4, num } number of missed calls. Remaining octets unknown, general format seems to

be { type, num }.

h4. Display subtype

Subtype: 0x03

Contains contents to be displayed, apparently preceeded by some control characters

h4. Prefix/Number subtypes

All these subtypes contain the IA5 encoded number as content:

| Octet  | Content     |

| 0      | Subtype     |

| 1      | Length (n)  |

| 2      | First digit |

| ...    | ...         |

| n + 2  | Last digit  |

h5. Call prefix for national area codes subtype

Subtype: 0x09

h5. Call prefix for country codes subtype

Subtype: 0x0a

h5. Local area code subtype

Subtype: 0x0b

h5. Country code subtype

Subtype: 0x0c

h3. <<CALLER-ID>>

<<CALLER-ID>> : 0x28

| Octet | Contents        |

| 0     | <<CALLER-ID>>   |

| 1     | 0x80 (unknown)  |

| 2     | length (n)      |

| 3     | first digit     |

| ...   | ...             |

| n + 3 | Last digit      |

References:

 * [wiki:trace_missed_call_siemens_gigaset_a140##CALLER-ID Gigaset A140 <<CALLER-ID>>]

h2. Traces

  * [wiki:trace_access_rights_sinus501_fritzbox7240 Trace of access rights request between Sinus 501 and FRITZ!Box 7240]

  * [wiki:trace_locate_request_sinus501_sinus501v Trace of locate request between Sinus 501 and Sinus 501V]

  * [wiki:trace_prefix_conf_sinus501_sinus501v Trace of prefix configuration between Sinus 501 and SInus 501V]

  * [wiki:trace_access_rights_gigaseta140 Trace of locate request between Gigaset A140 and its base]

  * [wiki:trace_missed_call_siemens_gigaset_a140 Trace of missed call between Gigaset A140 and its base]

h2. Testing

The @example/fp-siemens-proprietary@ program from [[libdect]] can be used for testing.