# PTP/IP

This document briefly describes the PTP/IP transfer layer, as reverse engineered from ethereal packet dumps and glanced from the sparely available online documentation.

It operates on top of a normal IP networkstack, the connections are simple TCP/IP socket connection.

Default port is 15740 (same as the ISO standard number for PTP).

There are 2 connections used:

- control & data connection (Initiator (computer) driven)
- event connection (Responder (camera) driven)

The participants communicate in packets, their layout is:

Length | Variable | Notes
--- | --- | ---
4 | length (little endian) | Length of the whole packet including the header
4 | type (little endian) | Type, listed below
length - 8 | data | specific on type

Observed types:

Type | Direction | Name | Next reply(s) | Payload
--- | --- | --- | --- | ---

1

I->R

Init_Command_Request

2 or 5

- 16 byte GUID
- xx byte WCHAR computername with terminating \0

2

R->I

Init_Command_Ack

5 or MAINLOOP

- 4 byte ID (session id, to be used for event connection startup)
- 16 byte GUID (MAC is used here for my camera, and repeated)
- xx byte WCHAR Camera Name with terminating \0

3

I->R

Init_Event_Request

4 or 5

- 4 byte ID (from Init_Command_Ack)

4

R->I

Init_Event_Ack

EVENTLOOP

- No payload.

5

I->R

Init_Fail

End of communication

- 4 byte error code (unclear meaning)

6

I->R

Cmd_Request

9 -> A/C or 7

- 4 byte unknown. set to 1 currently.
- 2 byte PTP command code
- 4 byte Transaction ID
- n x 4 byte PTP command arguments

7

R->I

Cmd_Response

MAINLOOP

- 2 bytes PTP response code
- 4 bytes Transaction ID
- nr*4 bytes arguments (depending on length of response)

8

R->I

Event

EVENTLOOP

- 2 byte PTP event code
- ...

Not fully investigated, but similar to PTP event.

9

R<->I

Start_Data_Packet

10,12

- 4 byte Transaction ID
- 4 byte Total data download size (without headers)

10

R<->I

Data_Packet

10,12

- 4 byte Transaction ID
- length-4-8 bytes payload data

11

I->R

Cancel_Transaction

7 ?

(Untested yet.)

- 4 bytes Transaction ID

12

R<->I

End_Data_Packet

7 ?

- 4 byte Transaction ID
- length-4-8 bytes payload data

13

R<->I

Ping

14

- No payload.

13

R<->I

Pong

EVENTLOOP

- No payload.

State transitions:

Initial Phase:

Command Connection:

1 | -> 2 | -> MAINLOOP
| \ 5 | -> EXIT

Event Connection:

3 | -> 4 | -> EVENTLOOP
| \ 5 | -> EXIT

Cameras using PTP/IP:

- Nikon CoolPix P1
- Nikon CoolPix P2
- Nikon CoolPix P3
- Nikon CoolPix P4
- Nikon CoolPix S6
- Kodak EasyShare One
- Canon PowerShot SD430