# Packet captures

## easyset.pcapng / easyset.etl

`pktmon` capture taken on 2026-09-03 on a machine on the POS895's network
segment, while running the vendor's `EasySet Tool.exe` and clicking its scan.

Taken to reverse engineer the vendor discovery protocol, since the POS895 does
not answer Epson's ENPC broadcast and the EasySet binary yields no readable
strings. The resulting wire format is written up under "SPRT discovery protocol"
in `POS895_POS896_integration_notes.md` and implemented in `Pos895Test`.

`easyset.etl` is the raw pktmon output; `easyset.pcapng` is the converted form
and the one worth opening.

What is in it:

- `10.1.250.71:9100 -> 255.255.255.255:3289` the `SPRT-Infor` discovery query
- `10.1.252.219:3289 -> 10.1.250.71:9100` the printer's MAC + serial reply
- `10.1.252.148:58165 -> 255.255.255.255:3289` an Epson `EPSONQ` broadcast that
  the POS895 does not answer, which is the point
- unrelated noise: Ubiquiti AP beacons on UDP 10001, SSDP, mDNS, NetBIOS

Note pktmon records each frame several times, once per stack layer, so every
packet appears about six times.