Brother MFC Network details

The analysis done on the MFC is focussed on building a scanserver that is controlled by the buttons on the MFC.
The MFC turns out to have the folowing abilities:

Fetching a scan using a TCP based protocol similar to the USB protocol
Registering scan targets into the MFC's LCD display using SNMP sets
Sending triggers over UDP for each of the registered scan targets.

The TCP protocol

The scanner listens for incomming connections on port 54921

                                                                              00000000  2b 4f 4b 20 32 30 30 0d  0a                      +OK 200. .
00000000  1b 53 0a 41 55 54 4f 0a  80                      .S.AUTO. .
                                                                              00000009  80                                               .
00000009  1b 49 0a 52 3d 31 30 30  2c 31 30 30 0a 4d 3d 43 .I.R=100 ,100.M=C
00000019  47 52 41 59 0a 80                                GRAY..
                                                                              0000000A  1a 00 31 30 30 2c 31 30  30 2c 32 2c 32 30 39 2c ..100,10 0,2,209,
                                                                              0000001A  38 31 36 2c 33 34 36 2c  31 33 36 32             816,346, 1362
0000001F  1b 58 0a 52 3d 31 30 30  2c 31 30 30 0a 4d 3d 43 .X.R=100 ,100.M=C
0000002F  47 52 41 59 0a 43 3d 4a  50 45 47 0a 4a 3d 4d 49 GRAY.C=J PEG.J=MI
0000003F  44 0a 42 3d 35 30 0a 4e  3d 35 30 0a 55 3d 4f 46 D.B=50.N =50.U=OF
0000004F  46 0a 41 3d 32 31 36 2c  30 2c 36 31 36 2c 35 37 F.A=216, 0,616,57
0000005F  30 0a 80                                         0..
                                                                              00000026  44 90 01 e9 da e1 eb d6  ef e8 d6 f0 ca dd de e8 D....... ........
                                                                              00000036  d0 d7 e0 d6 cf d6 d7 eb  ec d8 d6 ee ed e4 e3 d6 ........ ........
                                                                              00000046  ee e0 eb e1 eb e4 ec e5  de f2 e1 e0 f2 e4 f4 f9 ........ ........
                                                                              00000056  f1 eb e2 ea ce db e5 e4  d8 ea ee df e5 e3 e9 ce ........ ........

The scan command is interpreted as folows:

X                 Scan
R=100,100         Resolution in DPI
M=CGRAY           ScanMode??
C=CJPEG           Suggests JPEG compression, actual scanner output is not compressed
J=MID             ??
B=50              Brightness
N=50              Contrast
U=OFF             ??
A=216,0,616,570   Scan Area

Noteworthy details:

All commands start with 0x1B [ESC]
All commands end with 0x80 [??]
Responses are a mess:
- First line is always +OK 200 with CR/LF (all command are only CR). When the scanner is used by someone else it will give a other prompt.
- 0x80 just a empty ok it seems
- 0x1A 0x00 is the lenght of the textual response, but no aperant header.
- 0x44 a header describing type of colour and compression (see USB driver), folowed by 0x90 0x01 which is the number of samples (400)

The snmp set

Below you will find the command that when executed on a linux machine adds a scan target to the MFC
snmpset -v 1 -c internal MFChostname 1.3.6.1.4.1.2435.2.3.9.2.11.1.1.0 s "TYPE=BR;BUTTON=SCAN;USER=\"MyHOSTNAME\";FUNC=IMAGE;HOST=MyMachineIPNumber:54925;APPNUM=1;DURATION=360;"
SNMPv2-SMI::enterprises.2435.2.3.9.2.11.1.1.0 = STRING: "TYPE=BR;BUTTON=SCAN;USER=\"MyHOSTNAME\";FUNC=IMAGE;HOST=10.31.1.141:54925;APPNUM=1;DURATION=360;"

The exact interpretation I do not know yet:

TYPE=BR           ??
BUTTON=SCAN       ?? These two define the locaton within the menu I think
USER="BlaBla"     Name displayed in LCD
FUNC=IMAGE        ??
HOST=[IPNr]:Port  The UDP port which gets the trigger UDP packet
APPNUM=1          ??
DURATION=360      The time this registration is kept in the MFC (haven't checked if the MFC honours it)

The windows tool actually sends multiple of these elements in a single SET. This resuls in the folowing combination of FUNC and APPNUM:

FUNC	FUNC
IMAGE	1
OCR	3
EMAIL	2
FILE	5

the UDP packet

Based on previous registration a softkey appears in the MFC submenus's. Selecting this softkey triggers a UDP packet.

0000  02 00 73 30 54 59 50 45 3d 42 52 3b 42 55 54 54   ..s0TYPE=BR;BUTT
0010  4f 4e 3d 53 43 41 4e 3b 55 53 45 52 3d 22 XX XX   ON=SCAN;USER="XX
0020  XX XX XX XX XX XX XX 22 3b 46 55 4e 43 3d 49 4d   XXXXXXX";FUNC=IM
0030  41 47 45 3b 48 4f 53 54 3d 31 30 2e 33 31 2e 31   AGE;HOST=10.31.1
0040  2e 35 3a 35 34 39 32 35 3b 41 50 50 4e 55 4d 3d   .5:54925;APPNUM=
0050  31 3b 50 31 3d 30 3b 50 32 3d 30 3b 50 33 3d 30   1;P1=0;P2=0;P3=0
0060  3b 50 34 3d 30 3b 52 45 47 49 44 3d 31 31 36 34   ;P4=0;REGID=1164
0070  3b 53 45 51 3d 35 3b                              ;SEQ=5;

Syntax is a bit weird: First a 1 byte header (02) (perhaps 2 byte?) , 2 byte length (00 73)
Counting 0x73 bytes directly starting "0TYPE" makes the whole string one byte too short leaving an unexplained ";" at the end. this suggests the "0" is a seperate parameter.
NOTE: the length indications in other places of the protocal ar litle endian (LSbyte first). This doesn't match my intepretation of 0073 being the length, it suggests 73 being the length
The SEQ=5; at the end defines the sequence number of the command. Pressing the button on the MFC once results in multiple of these packets having the same SEQ. Repressing the button increases the SEQ by 1.