Author Topic: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100  (Read 139262 times)

0 Members and 1 Guest are viewing this topic.

Offline flamand

  • Member
  • *
  • Posts: 20
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #250 on: April 24, 2014, 02:11:47 AM »
skydvrz, I hope you're having fun doing this because it sure seems hard :)

I still haven't got this working on my Win 8.1 box. The ss monitor never shows any data except pings, packet requests and so on. The mini web server doesn't show anything. However WU did get two updates earlier this evening. I've tried both the embedded server and mysql.

I noticed that I could only get ping requests if Windows Firewall was completely disabled. That didn't seem right so I took a look at the connection logs. First thing I noticed is that when the firewall was enabled, the listing for skyspy was garbled with chinese characters. Once I wrote a rule for it with the actual name, it started showing activity. Looking back over the past couple of hours, I see outbound traffic originating on a variety of ports but all headed to 127.0.0.1 port 1000. Inbound traffic is headed to port 8000 from the gateway.

Does that 127.0.0.1:1000 seem right to you?

Also when skyspy is running, the C84612 display doesn't show that it's connected to the internet.

« Last Edit: April 24, 2014, 02:21:23 AM by flamand »

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #251 on: April 24, 2014, 10:33:11 AM »
skydvrz, I hope you're having fun doing this because it sure seems hard :)

Harder than Chinese Calculus, I am here to tell ya.  I have been working on this since before Christmas in almost all of my free time.  Yes, it is fun.  :lol:

Quote
I still haven't got this working on my Win 8.1 box. The ss monitor never shows any data except pings, packet requests and so on. The mini web server doesn't show anything. However WU did get two updates earlier this evening. I've tried both the embedded server and mysql.

Don't forget that WU updates only happen every 4-15 minutes.  That is just how fast the GW goes.  Watch a couple of SDP packets go by before panicking.  Are you seeing WU events in Monitor?  They should occur right after SDP events.

Quote
I noticed that I could only get ping requests if Windows Firewall was completely disabled. That didn't seem right so I took a look at the connection logs. First thing I noticed is that when the firewall was enabled, the listing for skyspy was garbled with chinese characters. Once I wrote a rule for it with the actual name, it started showing activity. Looking back over the past couple of hours, I see outbound traffic originating on a variety of ports but all headed to 127.0.0.1 port 1000. Inbound traffic is headed to port 8000 from the gateway.

Does that 127.0.0.1:1000 seem right to you?

SkySpyService needs to communicate with the LaCrosse Gateway module over port 8000.  It sends and receives on this port.  It uses this same port for the mini-web site.  It also uses port 80 to send me automated bug reports and to send WU weather data.

SkySpy Monitor uses port 80 to send me automated bug reports.  It will use the Gateway Configuration port in the next release.

Both the service and monitor may use port 3306 or 3307 to communicate with MySQL, but only if you are not using Embedded mode.  Port 3307 is only used it you have an account on my MySQL database server.  Normally MySQL works over port 3306.

So...  Make sure you set up your firewall rules accordingly. 

I don't know what is going on with 127.0.0.1:1000.  127.0.0.1 is the generic address for "this computer" or "localhost".  Port 1000 is not used by SkySpy AFAIK.

Quote
Also when skyspy is running, the C84612 display doesn't show that it's connected to the internet.

Yes, I know.  It doesn't hurt anything though. 

Normally the GW asks the LaCrosse server for the current time using a special handshake that I have not figured out yet.  When the LCX server replies with the time, the GW turns on the Internet indicator on the C84612 and resets the clock to the correct time.  I am still researching the problem.

Your C84612 clock display will start to drift over time until I fix this.  SkySpy uses your computer clock to tag WU sensor readings with local time, so WU will not be affected.

Offline markmanxp

  • Member
  • *
  • Posts: 29
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #252 on: April 24, 2014, 11:56:25 AM »
A few observations this morning.

Looking at the SkyMonitor it shows version 1.1.0.71
Looking at the Local Web Server it shows version 1.2.0.43.   Must not have downgraded after I reinstalled an earlier version last night.

It has been raining most of the night and morning.

SkyMonitor shows 0.00 for both Rainfall 1 hour and RainFall Today.   Weather Underground has been receiving correct data it appears, so that is GOOD!   Looking at the local web version it is showing the Total Rainfall field being populated and incrementing as the rain fell.

Looking at the tables in mySQL instance it is getting data but looking at the sensorvalues table there are no entries with Sid values between 10-13 which from what I can derive by looking at Sensors table are the rain values (9 - rainfall total, 10 - rainfall 1H, 11 - rainfall 24H, 12 - Rainfall Wk , 13 - rainfrall Mo).   Am I seeing this correctly or not understanding your table design.   Also loooking at the database 'weather' in MySQL Workbench is there a way to see the relationships between the different tables (primarykey - foreign key like in a design view?)
« Last Edit: April 24, 2014, 11:58:17 AM by markmanxp »

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #253 on: April 24, 2014, 01:09:22 PM »
A few observations this morning.

Looking at the SkyMonitor it shows version 1.1.0.71
Looking at the Local Web Server it shows version 1.2.0.43.   Must not have downgraded after I reinstalled an earlier version last night.

Those are the current versions of SkySpy Service (1.2.0.43) and SkySpy Monitor (1.1.0.71).  The Service portion runs in the background on your computer.  Monitor is used to watch and or configure the Service.  You can watch the service on WU just as well.  Once the service is configured, you really don't need to use ssMonitor any more.

It is the Service that talks to WU, so you will see the service version if you click on the "About this PWS" on your WU weather station page.

Quote
It has been raining most of the night and morning.

SkyMonitor shows 0.00 for both Rainfall 1 hour and RainFall Today.   Weather Underground has been receiving correct data it appears, so that is GOOD!   Looking at the local web version it is showing the Total Rainfall field being populated and incrementing as the rain fell.

I will have to take a look.  Unfortunately, my rain gauge died and I have not had a chance to do surgery on it.  It will be difficult to debug the software without some sensor inputs.  It has been working OK at other locations.

Quote
Looking at the tables in mySQL instance it is getting data but looking at the sensorvalues table there are no entries with Sid values between 10-13 which from what I can derive by looking at Sensors table are the rain values (9 - rainfall total, 10 - rainfall 1H, 11 - rainfall 24H, 12 - Rainfall Wk , 13 - rainfrall Mo).   Am I seeing this correctly or not understanding your table design.   Also loooking at the database 'weather' in MySQL Workbench is there a way to see the relationships between the different tables (primarykey - foreign key like in a design view?)

Rainfall measurement is a strange duck with the C84612.  It is measured as millimeters since the last reset.  I save the current value in inches in the DB, but calculate the rainfall per hour using a SQL query that calculates the height increase in the desired time period.  I may not be updating Monitor correctly, but I imagine that WU is correct.  I wrote the function listed below specifically for WU. 

Here is the SQL query method I use to access the rainfall records in MySQL.  You can manually enter the same query to calculate rainfall in a given period:

Code: [Select]
FUNCTION TsssDm.RainFall(Hours : Integer) : Single;
VAR
    Q : TQ;
BEGIN
    Q := TQ.Create(Self); // create a query component on the heap
    TRY
        Q.Add('SELECT max(value) - min(Value) as rf'); // build the query
        Q.Add('FROM packets p, sensorvalues sv');
        Q.Add('where p.stationid=:stationid and sv.id=p.id and sv.sid=:RFID and DATE_ADD(p.Timestamp, INTERVAL :hours HOUR) >= now()');
        Q.SVP('stationid', OprLoginId);     // set the SQL query parameters
        Q.SVP('rfid', ORD(SRainInTot));    // use the total rainfall sensorvalues records; rfid=9
        Q.SVP('hours', IntToStr(Hours));  // number of hours to use
        Q.Open; // execute the query
        Result := VDQ(Q, 'rf', 0); // get the calculated rainfall for the requested period. Use Zero inches if no matching records
    FINALLY
        Q.Free; // free up memory
    END;
END;

Note that this algorithm will break if you reset your rain inches total on the C84612 and then try to calculate across the cusp.

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #254 on: April 24, 2014, 01:44:40 PM »
I did a quick review of the code.  The only rainfall value passed to Monitor is the current inches of total rain since the last reset.  The 1Hr value shown in Monitor will always be zero, until I finish this code.

As I said before, SkySpy Service sends WU the correct rainfall / Hr information.

Also, all of the sensor dates (min/max reading times) are currently shut off.  They aren't very useful, so I don't want to spend a lot of time messing with them.  WU calculates all this stuff  for you from your raw data, so there is not much sense in reinventing the wheel.

Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #255 on: April 24, 2014, 03:15:29 PM »
Since there's discussion on measuring rainfall, I figured it's probably about time to send my layout of fields in the SDP. I've converted the code to using nybbles, but the spreadsheet shows both nybbles and bytes. See the notes at the bottom of the spreadsheet for comments about rainfall measurements. There is still more data in the SDP that I haven't identified, but I'm working on that.

Also, I've been working on checksums, since the console may ignore date/time updates unless it sees the right checksum. The fact there are checksums at all on the TCP data probably means the gateway itself isn't manipulating the data, and the checksums are there for the wireless link between console and gateway. I've figured out the checksum for the SDP (a 16-bit crc). but I haven't cracked it for the other messages. Stay tuned.

The spreadsheet for the field layout is here:
http://www.keckec.com/files/sdp_layout.xls

Offline flamand

  • Member
  • *
  • Posts: 20
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #256 on: April 24, 2014, 04:47:03 PM »
I gave this another try and got the same result. After a while, WU would get one update and then stop. I left the firewall open overnight and there was only the one update.

I took a closer look at the connections log for Windows firewall. I found skyspyservice only connected outbound to these two ips:

129.0.0.1 port 1000
24.18.61.97 port 80 (skydvrz)

I looked for any traffic from skyspysrvice to WU (38.102.136.104) on any port and didn't see any. What would be more definitive is if I were to see a connection when there was a WU update, but my logs don't go back that far.

As far as inbound activity, for skyspyservice, most of it was from 192.168.1.119 (the gateway). There were two connections from 127.0.0.1 ports 52256 and 52260.

The only inbound traffic to port 8000 was from the gateway. The only outbound traffic to 127.0.0.1:8000 was from Chrome.

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #257 on: April 24, 2014, 08:23:24 PM »
If you are a SkySpy user that has been successfully storing weather data to a MySQL database under your control, or are using Embedded mode then please disregard this message.

For users that are trying to connect to their own MySQL database server and have problems logging in or actually storing readings: Please back up your MySQL server, shut ssMonitor down and then run this script:

https://www.dropbox.com/s/tj2ydir756a1sa8/utility.sql

The script will create the missing Utility schema/tables on your MySQL server. If you already have this schema, the script will delete it and then recreate an empty one.  It should retain any readings stored with the previous Utility schema, but a backup is never a bad thing when making big changes to a database.





Offline MtHighVs

  • Member
  • *
  • Posts: 12
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #258 on: April 25, 2014, 12:03:12 AM »
Cool I am running ssMonitor v1.1.0.72 I just ran the utility.sql and now ssMonitor logs in fine and ping data shows up and so does current data  history tab and graghs now work Thanks Skydvrz =D> =D> =D> =D>

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #259 on: April 25, 2014, 12:33:26 PM »
MtHighVs,

Good news!  I am rewriting both the service and monitor to autocreate missing schemas.  That should make things simpler for new users.

Offline flamand

  • Member
  • *
  • Posts: 20
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #260 on: April 25, 2014, 12:43:20 PM »
The new script worked like magic. Thanks!

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #261 on: April 26, 2014, 10:56:29 PM »
The new script worked like magic. Thanks!

I have noticed a distinct lack of bug reports on my Mantis server, so I guess the new script fixed most of the problems.  Phew!   :grin:


Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #262 on: April 26, 2014, 11:28:10 PM »
Success!!! Finally got the time to sync and the Internet annunciator lit on the console display.  \:D/

All it took (I think) is the correct checksum in the last 2 bytes of the 38-byte 14:01 packet. I initially had the 8-byte station id wrong. Once that was right, the console beeped once and its clock was synced.

The console/gateway has now gone into another mode, sending 210-byte packets about every 2 seconds, along with the 197-byte SDP once every 4 or so minutes as before. I saw this in my captures when it was talking to the LCX servers. Haven't tried to decode this 210-byte packet yet. I see what look like dates and times that are advancing each packet. It like might be sending historical data, to bring the server up to date?

More decoding to do...

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #263 on: April 27, 2014, 12:41:05 PM »
All it took (I think) is the correct checksum in the last 2 bytes of the 38-byte 14:01 packet. I initially had the 8-byte station id wrong. Once that was right, the console beeped once and its clock was synced.

Station ID?  What fields/offsets are you talking about?

I have updated SkySpy Service to use a 16 bit additive checksum.  I assume you meant additive and not CRC16.

Quote
The console/gateway has now gone into another mode, sending 210-byte packets about every 2 seconds, along with the 197-byte SDP once every 4 or so minutes as before. I saw this in my captures when it was talking to the LCX servers. Haven't tried to decode this 210-byte packet yet. I see what look like dates and times that are advancing each packet. It like might be sending historical data, to bring the server up to date?

This may be alarm packets sent by the console.  You can configure the console to trigger on various min/max sensor values.  I shut all of mine off, since the packets were not very useful (at the time).

Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #264 on: April 27, 2014, 02:28:41 PM »
Station ID?  What fields/offsets are you talking about?

This is the 8-byte field that starts at byte 1 (counting from 0) in the 38-byte 14:01 packet type that sets the clock. The ID starts with 0x7f 0xff as the first two bytes. From Mycal's instructions it has to match the ID of the gateway/console. I copied my ID from a capture of data coming from the weatherdirect servers. According to Mycal, it's an ID field that gets stored in the console/gateway after being sent from the server during the registration process. Once set, I'm not sure if there is a way to reset or change it.

Quote
I have updated SkySpy Service to use a 16 bit additive checksum.  I assume you meant additive and not CRC16.

Yes. It is a 16-bit sum (not crc) of the first 36 bytes in the packet, and is placed big-endian at the end of the packet to make 38 bytes.

Quote
This may be alarm packets sent by the console.  You can configure the console to trigger on various min/max sensor values.  I shut all of mine off, since the packets were not very useful (at the time).
My alarms are all off as well, so I don't think it's that. In the capture while connected to weatherdirect, it sent these packets for about 15 minutes right after initial registration, then never again.

I'm a little concerned all this RF traffic might decrease battery life of the console, since it's sending data every 2 seconds instead of 4 minutes. I'll look to see if there is something else in the original capture that might convince the console to give it a rest.

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #265 on: April 27, 2014, 04:40:23 PM »
This is the 8-byte field that starts at byte 1 (counting from 0) in the 38-byte 14:01 packet type that sets the clock. The ID starts with 0x7f 0xff as the first two bytes. From Mycal's instructions it has to match the ID of the gateway/console. I copied my ID from a capture of data coming from the weatherdirect servers. According to Mycal, it's an ID field that gets stored in the console/gateway after being sent from the server during the registration process. Once set, I'm not sure if there is a way to reset or change it.

Ok, I implemented that.  I just parrot back the account ID from the HTML header after replacing the 2 leading bytes with 7FFF. 

Quote
Yes. It is a 16-bit sum (not crc) of the first 36 bytes in the packet, and is placed big-endian at the end of the packet to make 38 bytes.

Did that....  Its not working though.

Here is my current RTC response packet structure:

Code: [Select]
    TDateArray       = ARRAY[0..2] OF Byte;  // YMD
    TServerTimeOfDay = ARRAY[0..2] OF Byte;  // includes seconds
    TTimeOfDay       = ARRAY[0..1] OF Byte;  // HM

    // server sends local date/time to GW in this format
    TRTCRec = PACKED RECORD
        ServerTime: TServerTimeOfDay;
        ServerDate: TDateArray;
    END;

    TResp0100Packet = PACKED RECORD          // 38 byte reply from server
        UnknownByte:    Byte;                // $0      either $1 $2
        AcctID:         UInt64;              // $1-$8   some sort of registration ID?
        Unknown4:       ARRAY[1..7] OF Byte; // $9-$F   invariant in all the dumps I have seen
        Unknown5:       ARRAY[1..6] OF Byte; // $10-$15 invariant
        Epoch:          word;                // $16-$17
        ServerDateTime: TRTCRec;             // $18-$1D backwards from normal date/time arrangement
        Unknown6:       Word;                // $1E-$1F $5407 on mine, different on other gateways
        Unknown7:       LongWord;            // $20-$23
        Checksum:       word;                // $24-$25
    END;

Are you doing anything with the epoch bytes?  Epoch increments slowly over several weeks/months until it wraps at 7FFF

Quote
This may be alarm packets sent by the console.  You can configure the console to trigger on various min/max sensor values.  I shut all of mine off, since the packets were not very useful (at the time).

Some of them are not so obvious - you have to go through the full settings on the LCD monitor to disable them all.

Quote
My alarms are all off as well, so I don't think it's that. In the capture while connected to weatherdirect, it sent these packets for about 15 minutes right after initial registration, then never again.

I don't know.  The extra packets are probably not useful to the project, so I don't think it is worth taking up a lot of time analyzing them.

Quote
I'm a little concerned all this RF traffic might decrease battery life of the console, since it's sending data every 2 seconds instead of 4 minutes. I'll look to see if there is something else in the original capture that might convince the console to give it a rest.

If the packet storm only happens on initial Internet connection or after a registration, then it is probably no big deal.  That said, I had to replace my outside temp/humidity sensor batteries today, after only 4 months of use.

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #266 on: April 27, 2014, 05:06:37 PM »
BTW, Epoch increments by 18 (base 10, 0x12 hex) every 2 hours.  I have no idea what it does, but maybe if you don't increment it properly, the Internet indicator shuts off?

Does your RTC update work past a 2 hour timeframe?
« Last Edit: April 28, 2014, 10:18:24 AM by skydvrz »

Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #267 on: April 28, 2014, 03:18:34 PM »
Ok, I implemented that.  I just parrot back the account ID from the HTML header after replacing the 2 leading bytes with 7FFF. 
I tried that but it didn't work for me. The value that did work was contained in the 38-byte 14:01 clock-set packets from weatherdirect. It was also contained in a single 14:00 packet that came from weatherdirect before any of the 14:01 packets. Mycal thinks this is what actually sets that ID in the console/gateway. That makes some sense because after the 14:00 packet, the GW immediately responded with a 01:14 packet (confirmation?) containing that same ID. Then the server answered with a 1C:00 packet. Mycal thinks the 1C:00 packet is to "seal the deal" on registration.

Other than the above packets, I don't see the ID that worked anywhere else in my captures. This may be a problem if you (or your users) don't have any captures from which to grab that ID. What may work is to somehow reset the ID in the console, then either go through the registration process again with weatherdirect while capturing packets. You could make Skyspy into a full proxy, then go through the registration process again and grab the ID as it goes by. Or you could reset your console and see if you can force an ID code into the console from Skyspy. Maybe the "factory reset" described in the manual would reset the console's ID.

Quote
Did that....  Its not working though.
Here is my current RTC response packet structure:

Here's mine:
Code: [Select]
     |00|01|02|03|04|05|06|07|08|09|0a|0b|0c|0d|0e|0f|10|11|12|13|14|15|16|17|18|19|1a|1b|1c|1d|1e|1f
00 - |01|7f|ff|14|76|3c|3b|5b|61|00|32|00|0b|00|00|00|0f|00|00|00|03|00|3e|de|09|47|11|28|04|14|53|07
20 - |04|00|00|00|05|ad

Quote
Are you doing anything with the epoch bytes?  Epoch increments slowly over several weeks/months until it wraps at 7FFF

I haven't yet but I just had a look at what they were in the captures when connected to weatherdirect. I do see them incrementing by 0x12 (hex, not decimal), sometimes every 2 hours, but not at other times. And in the first 15 minutes after registration, these two bytes jumped a lot. Always increasing, but by large values, and always a multiple of 0x12. Once it increased by 0x2520 in 3 minutes time. The capture spans the change to DST, so that may add oddities. I think time zone and DST info are probably embedded in there somewhere.

Right after registration the GW sent out 01:00 (time request) packets every couple minutes (8 over 15 minutes), and the server responded with 14:01 packets. I think this makes sense. Unless they implement something like NTP that can deal with latency, and packet loss and retransmission, they'd have to get a number of clock-set packets to be sure they have the time right. After the first 15 minutes, it settled down to 3/hour or so.

That 15-minutes coincided with the storm of 210-byte 01:01 packets every 2 seconds.

Quote
If the packet storm only happens on initial Internet connection or after a registration, then it is probably no big deal.  That said, I had to replace my outside temp/humidity sensor batteries today, after only 4 months of use.
Trouble is, the 01:01 packets every 2 seconds hasn't stopped in 4 days. I think something must not be happy with what I'm sending it in the 38-byte clock-set packets, or that it's not getting a proper confirmation somewhere.

Here is a link to my two capture files, which starts when I first plugged the GW into the LAN, and goes through the registration process. There is a gap between the files when I accidentally stopped the capture and restarted it again. The time change to DST occurs during the second capture file, and there's some funny business in the times around there that I haven't figured out yet.
http://www.keckec.com/weather/files/capture_2014-03-08.zip

Here is the PHP file as I have it now. Much of it is from mycal. This is a work in progress, and a lot of clean-up is needed. This is my first time doing any PHP code, so go easy.  :-)
http://www.keckec.com/weather/request.breq

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #268 on: April 29, 2014, 12:38:44 AM »
Ok, I implemented that.  I just parrot back the account ID from the HTML header after replacing the 2 leading bytes with 7FFF. 
I tried that but it didn't work for me. The value that did work was contained in the 38-byte 14:01 clock-set packets from weatherdirect. It was also contained in a single 14:00 packet that came from weatherdirect before any of the 14:01 packets. Mycal thinks this is what actually sets that ID in the console/gateway.

Hmmm.  Something funny is going on.  I implemented your 38 byte packet, letter perfect (using my LCX-assigned StationID) and it does not reset the RTC or light up the Internet indicator on my console.  I even checked back in to the La Crosse server to capture some authentic packets and compared SkySpy packets to LCX.  They are identical....  There is something else that we are missing.

Those 210-byte packets on initial connection to the LCX server are really scary.

Anyway, as a sanity check, I have been capturing SkySpy traffic to the GW traffic to the LCX server, just to make sure there is no corruption.  AFAICT, there is none.

My guess is the 5 byte packet, the ping response or something else modifies a state machine in the GW.

I have not reviewed your PHP code - I was busy with the 38 byte packet tonight - Maybe there are some clues there.  I will try to devote some time to it tomorrow.

Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #269 on: April 29, 2014, 02:20:18 AM »
Hmmm.  Something funny is going on.  I implemented your 38 byte packet, letter perfect (using my LCX-assigned StationID) and it does not reset the RTC or light up the Internet indicator on my console.  I even checked back in to the La Crosse server to capture some authentic packets and compared SkySpy packets to LCX.  They are identical....  There is something else that we are missing.
That is odd. I implemented the epoch code, but it didn't seem to make a difference. I verified that the console's time is being set from the 38-byte packets -- if I change the console time with the SET button, it changes back after a few seconds. Then I changed what time is being sent in the 38-byte packet, and the console time followed it.

Quote
My guess is the 5 byte packet, the ping response or something else modifies a state machine in the GW.
I've looked at that, but I don't see anything significant. Originally, mycal's php code inserted the http 'content-type' header on all outgoing packets. I disabled that when there is no content, to match what I saw from LCX, but it didn't seem to matter.

Quote
I have not reviewed your PHP code - I was busy with the 38 byte packet tonight - Maybe there are some clues there.  I will try to devote some time to it tomorrow.
Thanks for looking at that. I'm going to see if I can find anything significant in the 210-byte packets. Maybe there's clue there.

Offline skydvrz

  • Senior Contributor
  • ****
  • Posts: 224
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #270 on: April 29, 2014, 12:28:29 PM »
Keckec,

I read your PHP code, but have not tried executing it yet.

Aha!

When describing your process you left out the part about offsetting the 38 byte packet checksum by 7.  I will try that tonight when I get home. 

I guess they seed the checksum generator with 7, either by bug or design.


Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #271 on: April 29, 2014, 03:32:11 PM »
Aha!

When describing your process you left out the part about offsetting the 38 byte packet checksum by 7.  I will try that tonight when I get home. 

Oops. Sorry for giving you bad data. Didn't mean to waste your time on that.
k

Offline Scott_A

  • Member
  • *
  • Posts: 7
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #272 on: April 29, 2014, 09:16:50 PM »
Finally getting around to connect the gateway for the first time and of course I have misplaced my activation code. LaCrosse support will not give me a new one, instead I should purchase a subscription.
I plan on registering the gateway and weather station using Mycal and keckec's php file from yesterdays post. Any advice or gotchas I should look out for?
Thoughts about setting a serial number? I am not worried about never using the LaCrosse services.

Offline keckec

  • Senior Member
  • **
  • Posts: 62
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #273 on: April 29, 2014, 10:47:33 PM »
Finally getting around to connect the gateway for the first time and of course I have misplaced my activation code. LaCrosse support will not give me a new one, instead I should purchase a subscription.
I plan on registering the gateway and weather station using Mycal and keckec's php file from yesterdays post. Any advice or gotchas I should look out for?
Thoughts about setting a serial number? I am not worried about never using the LaCrosse services.
The PHP code has a place for the serial number, near the top. The gateway sends a 7F:10 packet (http header), and the php code (if enabled) sends a 14:00 packet, which contains the serial number, date & time, and some other stuff. The gateway sends a 00:14 packet, and the php code returns a 1C:00 packet. There looks like a place in the PHP code to enable this, but it's untested by me. All this is derived from captures of the registration process with LCX, and I don't think any of us have done it ourselves. You can have a look at this in my capture file here:
http://www.keckec.com/weather/files/capture_2014-03-08.zip
This file is viewable in Wireshark, available for a number of platforms. The serial number exchange starts around packet number 32.
It's possible you can make up your own serial number. It seems it has to start with 7FFF. I don't think any of us have tried making it up, and I'm not sure that just any 8-byte code will work.

You'll also have to add the following checksum code to the php code where it generates the 14:00 packet. Remove the code for the fixed checksum that's there now. Note that the offset of this checksum is different than in the 14:01 packet, which is similar.
Code: [Select]
$csum=checksum16($reply)+0x17;
$reply.=chr($csum>>8).chr($csum&0xff);

We're all very interested in your results with this.
« Last Edit: April 29, 2014, 11:15:51 PM by keckec »

Offline Scott_A

  • Member
  • *
  • Posts: 7
Re: LaCrosse Wireless Internet Gateway Model GW1000U ERF-100
« Reply #274 on: April 29, 2014, 11:45:56 PM »
Perhaps I am doing something wrong, I have changed the following:

Code: [Select]
$station_serial=pack("H*" , "7fff201404292594");   
$register_this_serial=1;

Line 841 removed the comment:
Code: [Select]
if($register_this_serial)
    {
         // Do you really want to do this?
         $do_reply=1;
    }

Line 894, added comments and 2 lines:
Code: [Select]
// Checksum
//$reply=$reply.chr(checksum8($reply));
$csum=checksum16($reply)+0x17;
$reply.=chr($csum>>8).chr($csum&0xff);

Initially on the Gateway the red LED was flashing. I pushed the button after using the Gateway Advanced Setup and after a while the red LED went solid.

dump.log wrote out 3 entries:
2014-04-29 21:18:47   Packet Type 00:10 Length: 0 bytes
     No Data
2014-04-29 21:19:22   Packet Type 00:20 Length: 0 bytes
     No Data
2014-04-29 21:19:28   Packet Type 00:30 Length: 0 bytes
     No Data

I then held the Rain button on the weather station until it beeped.
REG flashed for a few seconds the there were 2 beeps and INTERNET flashed.

dump.log now has:
2014-04-29 21:19:38   Packet Type 00:70 Length: 0 bytes
     No Data

No matter what I do I only get packet types 00:70.

Stupid me, forgot to press the button on the gateway while REG is flashing on the weather station.
dump.log now also has:
2014-04-29 22:29:47   Packet Type 7F:10 Length: 13 bytes
     |00|01|02|03|04|05|06|07|08|09|0a|0b|0c
00 - |01|02|03|04|05|06|07|08|02|00|22|73|4d

Still doesn't seem to set the serial number and still stuck and looking for ideas?

« Last Edit: April 30, 2014, 12:32:25 AM by Scott_A »