PTP/IP

This document briefly describes the PTP/IP transfer layer, as reverse engineered from ethereal packet dumps and glanced from the sparely available online documentation.

It operates on top of a normal IP networkstack, the connections are simple TCP/IP socket connection.

Default port is 15740 (same as the ISO standard number for PTP).

There are 2 connections used:

control & data connection (Initiator (computer) driven)
event connection (Responder (camera) driven)

The participants communicate in packets, their layout is:

Length Variable Notes

4 length (little endian) Length of the whole packet including the header

4 type (little endian) Type, listed below

length - 8 data specific on type

Length	Variable	Notes
4	length (little endian)	Length of the whole packet including the header
4	type (little endian)	Type, listed below
length - 8	data	specific on type

Observed types:

Type Direction Name Next reply(s) Payload

1 I->R Init_Command_Request 2 or 5

16 byte GUID
xx byte WCHAR computername with terminating \0

2 R->I Init_Command_Ack 5 or MAINLOOP

4 byte ID (session id, to be used for event connection startup)
16 byte GUID (MAC is used here for my camera, and repeated)
xx byte WCHAR Camera Name with terminating \0

3 I->R Init_Event_Request 4 or 5
4 byte ID (from Init_Command_Ack)

4 R->I Init_Event_Ack EVENTLOOP
No payload.

5 I->R Init_Fail End of communication
4 byte error code (unclear meaning)

6 I->R Cmd_Request 9 -> A/C or 7

4 byte unknown. set to 1 currently.
2 byte PTP command code
4 byte Transaction ID
n x 4 byte PTP command arguments

7 R->I Cmd_Response MAINLOOP

2 bytes PTP response code
4 bytes Transaction ID
nr*4 bytes arguments (depending on length of response)

8 R->I Event EVENTLOOP

2 byte PTP event code
...
Not fully investigated, but similar to PTP event.

9 R<->I Start_Data_Packet 10,12

4 byte Transaction ID
4 byte Total data download size (without headers)

10 R<->I Data_Packet 10,12

4 byte Transaction ID
length-4-8 bytes payload data

11 I->R Cancel_Transaction 7 ? (Untested yet.)

4 bytes Transaction ID

12 R<->I End_Data_Packet 7 ?

4 byte Transaction ID
length-4-8 bytes payload data

13 R<->I Ping 14
No payload.

13 R<->I Pong EVENTLOOP
No payload.

Type	Direction	Name	Next reply(s)	Payload
1	I->R	Init_Command_Request	2 or 5	16 byte GUID xx byte WCHAR computername with terminating \0
2	R->I	Init_Command_Ack	5 or MAINLOOP	4 byte ID (session id, to be used for event connection startup) 16 byte GUID (MAC is used here for my camera, and repeated) xx byte WCHAR Camera Name with terminating \0
3	I->R	Init_Event_Request	4 or 5	4 byte ID (from Init_Command_Ack)
4	R->I	Init_Event_Ack	EVENTLOOP	No payload.
5	I->R	Init_Fail	End of communication	4 byte error code (unclear meaning)
6	I->R	Cmd_Request	9 -> A/C or 7	4 byte unknown. set to 1 currently. 2 byte PTP command code 4 byte Transaction ID n x 4 byte PTP command arguments
7	R->I	Cmd_Response	MAINLOOP	2 bytes PTP response code 4 bytes Transaction ID nr*4 bytes arguments (depending on length of response)
8	R->I	Event	EVENTLOOP	2 byte PTP event code ... Not fully investigated, but similar to PTP event.
9	R<->I	Start_Data_Packet	10,12	4 byte Transaction ID 4 byte Total data download size (without headers)
10	R<->I	Data_Packet	10,12	4 byte Transaction ID length-4-8 bytes payload data
11	I->R	Cancel_Transaction	7 ?	(Untested yet.) 4 bytes Transaction ID
12	R<->I	End_Data_Packet	7 ?	4 byte Transaction ID length-4-8 bytes payload data
13	R<->I	Ping	14	No payload.
13	R<->I	Pong	EVENTLOOP	No payload.

State transitions:

Initial Phase:

Command Connection:

1 -> 2 -> MAINLOOP

\ 5 -> EXIT

Event Connection:

3 -> 4 -> EVENTLOOP

\ 5 -> EXIT

Cameras using PTP/IP:

Nikon CoolPix P1
Nikon CoolPix P2
Nikon CoolPix P3
Nikon CoolPix P4
Nikon CoolPix S6
Kodak EasyShare One
Canon PowerShot SD430