* qnap-finder
=============

This is a simple program to find out the presence (and the IP) of a QNAP NAS box on
a network. I have tested with a TS-410.



* Disclaimer
============
This program is a work in progress and isn't guaranteed to work with all QNAP devices.
Although this is meant to be a replacement for the Windows/Mac versions of QNAP finder,
it is not guaranteed to work that way.


* Data from the windows version of QFinder
==========================================
The QNAP Finder when run(on MS Windows), sends a UDP broadcast packet on the network
to the multicast address(255.255.255.255) upon which, any QNAP NAS box active on the
network responds with it's version information, hostname and other details.

I noticed (when sniffing with Wireshark), that the QNAP Finder app, sends the broadcast
message several times (15 to be precise) from the time it is launched until it stops
querying further, with the following data:

00000000  00 00 00 00 00 00 43 6c  00 00 01 00 00 00 25 04 ......Cl ......%.
00000010  00 00 00 00 00 00 43 6c  00 00 01 00 00 00 25 04 ......Cl ......%.
00000020  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
00000030  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
00000040  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
00000050  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
00000060  00 00 00 00 00 00 43 6c  00 00 01 00 00 00 25 04 ......Cl ......%.
00000070  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
00000080  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
00000090  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
000000A0  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
000000B0  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
000000C0  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
000000D0  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.
000000E0  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.

There are two kinds of messages that are sent:

* MSG 1:

00000000  00 00 00 00 00 00 43 6c  00 00 01 00 00 00 25 04 ......Cl ......%.

This is a query of sorts. When sent, the NAS box responds with a brief message:

���jSe��%����
10.0.0.10�cher	�NAS(TS-410)TS-419ITS-410�	1���	2����	3����	)������@�2-	20130726�	'�� ��
                                                                                                              �admin5��������H���	��P�	������	�����  ���
                                                                                                                                                                  �	����	�����	�����	�����	������+��smtp.gmail.com:465F��
                                      ���j����k��	



* MSG 2:

00000020  00 08 9b c3 ec 6a 43 6c  02 00 05 00 00 00 25 04 .....jCl ......%.

This requests for more detailed information from the NAS box:
���jSe�%��cher(TS-410)TS-419ITS-410	�NAS�	'�� ��@�2-	20130726�	1���	2����	3���L�--!@(GMT+10:00) Canberra, Melbourne, Sydney�
���
������
      ���j�	����+�,��	���
��	���F��G�
                �	�����	�����5��0bond���j
                                                 ���
����
���������������k#�437%�1&�Seagate ST31000528AS    CC38'
931.51 GB.�Seagate ST31000528AS    CC38/
931.51 GB:�Seagate ST31000528AS    CC38;
931.51 GB<�Seagate ST31000528AS    CC38=
931.51 GB��	


Both the messages are 16 bytes long.

I used tcpdump to capture data from my linux box:

# tcpdump -vvv -i wlan0 -w cap_from_linux.pcap -n "broadcast or multicast"

Please find the file `cap_from_linux.pcap` in the repository.


* Header and Footer of the response
===================================

* Response Header: The header is a 128 bit message.
  The 'query' response header is:
      00 08 9b c3 ec 6a 53 65  01 00 01 00 00 00 25 04
  The 'detail' response header is:
      00 08 9b c3 ec 6a 53 65  01 00 05 00 00 00 25 04

* Response Footer: The footer(96 bits) is the same for both kinds of messages:
      ff 04 00 00 00 00


* Comments, bugs and patches
============================
Please feel free to submit any bugs or patches in the Issue Tracker for this
repository available here(https://github.com/ajaysusarla/qnap-finder/issues).