User:Zamujasa/Station Network

This page is probably REALLY out of date -- see this for what's been updated in my absence.

Somehow this page became The Definitive Guide to the Station Network and I don't even. Welp! I never finished it and lost interest but a few people have been updating it in my absence.

Here's some information on abusing the station network. Use responsibly. Or don't. Probably don't.

DWAINE

The mainframe on the station network runs on DWAINE. It's pretty important if you want to futz around with the network.

There's a book in-game about it called DWAINE for Dummies. It's pretty basic, though. I'm working on a more... power-focused guide. See DWAINE for Smartasses.

Authentication

There are a handful of authentication codes you may or may not need.

The first three are stored on the Authentication Disk, so if you ask nicely maybe the Captain will give it to you.

netpass_heads: Used for Guardbuddy management, shuttle (re)calling, etc.
netpass_security: Used only for networked turrets, which don't really exist anywhere.
netpass_medical: Not used at all, as far as I can tell.
netpass_syndicate: Exclusively for the Detomatix cart.

Wired Network

Stuff on the station network connected by red power cables.

Important note for packet sniffers: The packet sniffer spaces out the various fields in a packet. If you want to copy them for your own use in, say, some Mechanics deathtrap, remove the spaces after the semicolons.

Types of networked devices

Get a list of these by running term_ping on any TermOS computer that isn't currently connected to something. Not all devices can be connected to via TermOS, though, and some won't reply to pings either. Sneaky!

PNET_MAINFRAME

The good ol' mainframe, usually hanging around the Computer Core. Connect to this to access DWAINE. Pretty much every terminal on the station starts out connected to this.

There are a few of these scattered around the universe, though a lot of them are broken and don't actually work.

MAINFRAME_AI

The AI. Connecting to this will make the AI see "Direct connection from (02001234)". You can chat with the AI by simply sending messages, and it will be able to reply as long as you're connected — your messages show up like PDA messages and the AI can respond in the same way.

PNET_COM_ARRAY

The communications array! Connecting to this will usually give you a short message with two commands, View and Download ##. Using View will give you a list of available messages (usually only one, the "threat report") that you can get; using Download (id) will send the message directly to your terminal, which you can print out with file_print. Keep in mind that the information on the threat report is usually wildly incorrect.

Packet dump:

(sent) address_1=020036fd; command=call; shuttle_id=emergency; acc_code=(Authentication code); sender=0200c069; 
(recv) command=device_reply; status=SHUTL_E_SEN; address_1=0200c069; sender=020036fd;

The authentication code above is randomly generated each round -- it looks something like "1234 Alpha-567". You can get it from reading GuardBuddy command packets, which include it. Actually sending this signal can probably be done by using ThinkDOS and the SigCraft builder, but doing that is left as an exercise to the reader.

PNET_ADAPTER

Other terminals and data terminals on the network, generally. You can direct-connect two TermOS computers together if you want, but there's not much you can really do with that beyond chat back and forth, maybe.

PNET_S_TELEPAD

The Telescience Telepad. There can be more than one of these; you specify which one you want with the -p [0-9] argument to teleman.

You can't change the coordinates with just packets. Coordinates are updated by the computer contacting the mainframe, which sends out the command to the telepad with an attached file.

Raw packet dump:

[18:47:4]:command=term_message; data=command=teleman&args=-p 1 send; address_1=02002182; sender=02001ed4; 
[18:47:5]:command=term_message; data=command=send&session=746; render; address_1=02001cbd; sender=02002182; 
[18:47:5]:command=term_message; data=command=ack&session=746; address_1=02002182; sender=02001cbd; 
[18:48:1]:command=term_message; data=command=OK; render; address_1=02001ed4; sender=02002182; 
[19:10:1]:command=term_message; data=command=teleman&args=-p 1 receive; address_1=02002182; sender=02001ed4; 
[19:10:1]:command=term_message; data=command=receive&session=17; render; address_1=02001cbd; sender=02002182; 
[19:10:1]:command=term_message; data=command=nack&cause=recharge&session=17; address_1=02002182; sender=02001cbd; 
[19:10:7]:command=term_message; data=command=Telepad is recharging.; render; address_1=02001ed4; sender=02002182; 
[19:13:3]:command=term_message; data=command=teleman&args=-p 1 receive; address_1=02002182; sender=02001ed4; 
[19:13:4]:command=term_message; data=command=receive&session=333; render; address_1=02001cbd; sender=02002182; 
[19:13:4]:command=term_message; data=command=ack&session=333; address_1=02002182; sender=02001cbd; 
[19:14:0]:command=term_message; data=command=OK; render; address_1=02001ed4; sender=02002182;

PNET_PRINTDEVC

Printers. Not sure if you can print directly to them (maybe with file_send); generally you just write to the /mnt/lp-whatever folders on the mainframe.

PNET_DATA_BANK

The data banks that contain all of the information on the mainframe.

PNET_PR6_CHARG

GuardBuddy chargers. These also communicate wirelessly to the buddies; see the section there for more.

Raw packets below. You can see the netpass_heads authentication code in here as well (3635 Bravo-51).

[37:25:5]:command=term_message; data=_command=add&_freq=1219; render; address_1=020020f4; sender=02002182; 
[37:25:5]:command=term_message; data=_freq=1219&acc_code=3635 Bravo-501;command=dock_return; render; address_1=020020f4; sender=02002182; 
[37:25:5]:command=term_message; data=command=status&status=success; address_1=02002182; sender=020020f4; 
[40:30:1]:address_1=02002182; data=prman upload 0200143B heckle name=titusgettemy; command=term_message; sender=0200b5ce; 
[49:37:5]:command=term_message; data=command=status&status=ejected&botid=020032dd; address_1=02002182; sender=0200143b;

Some of the commands you can use, as command=#######:

status: Gets the status of a buddy docked to this station as a reply:
- status=nobot: If you get "nobot", there's no buddy here. You'll get only this for every command.
- status=########: The buddy's network identifier.
- charge=###: Either nocell (no power cell) or a number from 0 to 100 representing the percent of power remaining in the buddy's cell.
- tool=#####: The current tool (weapon), or "NONE" if there's no tool installed.
- deftask=#####: The default task this buddy runs when it has nothing better to do, or "NONE" if it doesn't have one.
- curtask=#####: The current task this buddy is running, or "NONE" if it doesn't have one.

eject: Boots the buddy out of the docking station.
- No reply here. If you didn't get a nobot reply, it worked.

upload: Uploads a new task to the buddy. Optionally with overwrite=? and newmodel=?, which overwrite the current task or default task respectively. Requires a file to be sent along with the data, so good luck spoofing this.
- You'll get a reply with status=upload_success if the task has been uploaded.
- You'll get a reply with status=badtask if the task is bad (or missing).

download: Downloads a task from the buddy. Use model=? to download the default task, otherwise it'll download the current one.
- Replies with command=taskfile if it worked. In theory you'll get a file sent to your terminal with the task. What can you do with it?
- Replies with command=status&status=notask if there's no task to download.

taskinq: Gets the buddy's currently installed tasks.
- Replies with command=trep, with deftask=##### for the default task and curtask=##### for the current task, or "NONE" if there isn't one.

wipe: Erases the buddy's installed tasks and replaces them with nothing.
- Replies with command=status&status=wipe_success.

The chargers also occasionally report back to their host (i.e. the mainframe) when things happen. The format of these may not be 100% correct.

command=status&status=ejected&botid=########: Ejected a buddy.
command=status&status=connect&botid=########: A buddy docked itself or was docked by someone.

PNET_PR6_RADIO

The radio near the Mainframe. It's mostly used for talking to the GuardBuddy bots when they're away from chargers, but you can do some other stuff with it.

Capturing packets with the power of the mainframe:

Make a folder for the frequency you want to monitor, e.g. /mnt/radio/1149
Periodically ls /mnt/radio/1149 to see if any packets have appeared
cat /mnt/radio/1149/Q2158018 to view packets

The mainframe will capture any packet sent to a frequency that has a directory created.

Note: The actual mechanics behind this are a bit different (there's some communications going on between the mainframe and radio) but for the most part this will get you what you want.

Regardless, packet dumps (raw, not bothering to explain): [19:41:7]:command=term_message; data=_command=add&_freq=1149; render; address_1=02002303; sender=02002275; [20:03:3]:command=term_message; data=_freq=1149&command=text_message&message=butt&sender_name=fart; render; address_1=02002303; sender=02002275; [45:35:6]:address_1=02002275; data=echo test=butt ^ x; command=term_message; sender=02018e2a; [45:35:6]:command=term_message; data=command=status&status=success; address_1=02002275; sender=02002303; [45:35:6]:command=term_message; data=_freq=1149&test=butt; render; address_1=02002303; sender=02002275;

PNET_IR_DETECT

IR detectors, usually placed around important things like the Armory and sometimes the AI core.

(Todo: update)

PNET_TEST_APPT

The various testing apparatuses in the Artifact Lab. Also includes the "Gas Sensors" you see in places like Toxins.

[34:18:5]:command=term_message; data=command=deactivate; render; address_1=02000d04; sender=02000673;

[34:18:5]:command=term_message; data=OK; render; address_1=0200cbf2; sender=02000673;

[34:18:5]:address_1=02000673; data=gptio deactivate elec_box; command=term_message; sender=0200cbf2;

SRV_TERMINAL

The teleport computer for the Telescience telepad. It doesn't communicate directly with the teleport pad, but instead sends commands to the mainframe. If you want to learn to control the science teleporter remotely, these would be the packets you want to sniff out.

P: [020639b9]-TYPE: SRV_TERMINAL
P: [02002d0e]-TYPE: PNET_MAINFRAME

[58:26:4]:command=term_message; data=command=teleman&args=-p 2 coords x=50 y=50 z=4; address_1=02002d0e; sender=020639b9; 
[58:26:5]:command=term_message; data=command=ack&session=641; address_1=02002d0e; sender=020639b6; 
[58:26:5]:data=command=set_coords&session=641; address_1=020639b6; command=term_file; sender=02002d0e; 
[58:27:0]:command=term_message; data=command=teleman&args=-p 2 send; address_1=02002d0e; sender=020639b9; 
[58:27:1]:command=term_message; data=command=OK; render; address_1=020639b9; sender=02002d0e; 
[58:27:1]:command=term_message; data=command=send&session=708; render; address_1=020639b6; sender=02002d0e; 
[58:27:1]:command=term_message; data=command=ack&session=708; address_1=02002d0e; sender=020639b6; 
[58:27:7]:command=term_message; data=command=OK; render; address_1=020639b9; sender=02002d0e;

PNET_NUCCHARGE

The nuclear charge. Authentication is easily spoofed by using the mainframe's built in nuke manager, nukeman. Just use the same packet you used to spoof superuser access when asked to login with an authorized ID, then repeat with two more login packets under two different names (the registered= field).

Hemera VII's main tape doesn't include this, so you'll have to bring a tape of your own with it or "borrow" one of the replacement Master Tapes on the station.

_{You can also scan the nuclear charge with a Syndicate device analyzer and deploy one elsewhere, if that's more your thing.}

Creating packets

Packets can be created by using the following command:

echo field=value|nfield2=value2|nfield3=value3

To store the packet as a file on the mainframe:

echo ... ^ /home/pjones/filename

To send a file (like a packet!) to your terminal, so you can send it with file_send or print it with file_print, save the file to the /mnt/term directory:

cp /home/pjones/filename /mnt/term/x

If you just need to get the file right away, you can simply save the file in /mnt/term right away:

echo ... ^ /mnt/term/foo

Spoofing the login packet

Faking a login involves a few specific steps. You'll generally always need a valid ID of any kind to do the initial login, though.

Log into the mainframe (insert your card and term_login)
Craft a login packet
Send the crafted packet back to your terminal
Either enter su for admin rights, or disconnect and reconnect to log in as a completely different user
Instead of using term_login, use file_send to send the packet you saved earlier
You are now logged in with your forged user

The login packet looks like this:

registered=Pubbie Jones
assignment=Staff Assistant
access=, followed by a (semicolon? comma?)-separated list of rights — every access in the ID computer has a different one. The important one for su access is 34.

Applying all of the above to create the packet and register it for file_send:

echo registered=Pubbie Jones|nassignment=Staff Assistant|naccess=34 ^ /mnt/term/loginpacket

Keep in mind that you shouldn't use this to set the Guardbuddies to purge or other destructive things unless you're a traitor.

Sending packets using the mainframe's radio

You can use DWAINE to send out packets over the air. The mainframe's radio has a limited range, though, so it won't reach everything.

Create a directory for the frequency you want to transmit on. Directories are the four numbers without the decimal point, e.g. /mnt/radio/1149 for 114.9, by using the command mkdir /mnt/radio/1149
- If the directory already exists for whatever reason, you can skip this step.
Craft your packet.
- Optional: Save it if you need to use it more than once. Otherwise, just use echo and pipe it directly.
Copy or move your crafted packet to the folder you created, e.g. copy packet /mnt/radio/1149 or echo ... ^ /mnt/radio/1149/packet

If it worked, the packet you crafted should automatically be sent out by the radio. You can use the Packet Sniffer program on your PDA to confirm.

Wireless Network

Basically everything you can spoof (aside from PDA messages) will require a address_1 field, indicating the target of the message.

sender is added automatically to almost every packet-sending device, though apparently you can get away without one by manually crafting a signal and using a wireless computer's free mode (with greatly reduced range).

PDA Ping ranges. Sending may be similar (or unlimited size?). Measured by dropping a PDA and seeing how far away it would still respond.

min: 16 tiles
med: 32 tiles
max: 64 tiles

Note that pings go through Z-levels! If you manage to pin down a signal but there doesn't seem to be anything there, it's probably in the debris field or in one of the adventure zones. Welp! ^{(todo: is this still true?)}

Broadcast ranges are only for broadcasting — anything can receive a packet if it's in the broadcast range of the source, even if its own broadcast range is far smaller. If your device has a broadcast range of 64 tiles, and your target device has a range of 16 tiles, the target device will receive your signal as long as you're anywhere within 64 tiles, but you won't receive the device's beyond those 16.

PDAs (114.9)

They're PDAs. You know, the ones almost everyone spawns with.

Device name: NET_PDA_51XX
Broadcast range: ≥ 64 tiles (127 × 127)

Packets:

Really easy to scan, the Network Tools cartridge defaults to this frequency.
Snoop on people trying to use PDAs to covertly message people! ~~Just be sure to get your ID switched to "NSA Operative" first~~ Clear the log regularly so it doesn't clog up with PDA pings.

Packet spoofing:

address_1: Omit to broadcast to every PDA in range. Otherwise, set to a PDA's address to send only to that PDA.
command: Generally text_message, though there are others, including but not limited to:
- file_send_req Used send file send requests, though you can't actually send anything without using the PDA clipboard.
  - file_size The size of the file
  - file_ext The file extension (PPROG, TXT, etc.)
  - file_name The name of the file
- file_send_acc Used to accept file send requests, doesn't work unless someone's sending you a file. Can be spoofed with a ThinkDOS computer on free mode, causing the file to download to the target PDA. Note that this still requires a valid file send request.
- file_send Used to send files after send requests are accepted, doesn't work without an accepted file request.
- report_pda The scan function in the PDA messenger.
- report_reply Replies to report_pda, can be used to change your PDA's name to other people on the messenger
message: The text you want to send. Surprise!
sender_name: What the name should show up as. Leaving it blank will make PDAs show it as !UNKNOWN!

Experiment! Maybe you'll find more.

Ruckingenur kits (114.9)

Ruckingenur kits, like the one in the Electronics lab.

Device name: NET_RKANALYZER
Broadcast range: ≥ 64 tiles (127 × 127)

Packet sent when adding something to the database via PDA scan:

command: add -- Adds something to the database. Doesn't actually specify what it is. D'oh.
address_1: 02xxxxxx -- Address of the kit, as usual
A file, which you can't sniff, I guess.

After that, the kit will send out a PDA text message to the scanning PDA that it was either added or already in the database.

Spoofing the packet does nothing, as it requires the file that you can't send. Scanning a device using a Device Analyzer sends no packets at scan or on addition to the kit.

Wireless network adapters (114.9, variable)

Computers that have a wireless network card. Some of these are included even in devices that aren't really computers, and they don't really do anything, like the "filing cabinet" Security computers.

Device name: WNET_ADAPTER
Broadcast range: varies

Cogmap1's Morgue filing cabinet, for example:

Broadcast range: 18 tiles (35 × 35)

Others may be different. The ranges are dependent on the type of card and its mode.

GuardBuddy devices (121.9)

GuardBuddies and their docking stations.

Device name: PNET_PR6_GUARD (buddies), PNET_PR6_CHARG (docking stations)
Broadcast range: ≈ 75 tiles (150 × 150)

The following is sent exclusively by the docking stations. They also communicate over the wired network; see their section above for more.

command=recharge_src; data=x=##&y=##;: Sent by the docking station as a reply to the recharge broadcast, with its current X and Y (GPS) position, so the buddies know where to go to charge.

There's a lot of network traffic, but here's some examples. If you aren't targeting a specific bot's address, you need to include acc_code=(netpass_heads).

address_1=recharge: Sent by the buddies as a broadcast. Causes the docking stations to report their locations; see above.
command=dock_return: Adds a task to the buddy to go to a docking station and dock. Makes the buddy say "Software update requested" and show the "update" emotion.
command=captain_greet: Makes the buddy say one of several goofy lines, if it's wearing the captain's hat. Sent by the tour guide buddy if it runs into another buddy wearing it.
command=wizard_greet: Makes the buddy say of several other goofy lines, if it's wearing a wizard's hat. Sent by the tour guide buddy if it runs into another buddy wearing it.

Doors (141.1)

Pretty much every airlock on, and off, the station.

Device name: DOR_AIRLOCK
Broadcast range: 6 tiles (11 × 11)

Doors only broadcast signals relatively close by, so you'll have to be nearby if you want to see anything. You can get the address of a door by screwdrivering it open and checking, using the packet sniffer and touching the door, or just taking a guess from doors that respond to your pings. Some doors can't be screwdrivered so you'll have to use a different option, but those doors also tend to resist packet hacking.

Doors broadcast certain details whenever they're interacted with, as well as a few moments later when they auto-close.

user_id: Person whose ID was used (e.g. Pubbie Jones). If a mob like Beepsky opens a door, this is ??? (yes, three question marks) instead.
If the door opens:
- data: denied, if someone who didn't have access tried to open a door
Otherwise:
- door_status: State the door is in (e.g. open, closed)
- lock_status: State of the door bolts (e.g. locked, unlocked)
- tag: This appears to always be blank.

Sending packets manually to open/close doors:

address_1: Network address of door (required)
command: One of the following:
- open: Opens a door
- close: Closes a door
- lock: Drops the door bolts
- unlock: Raises the door bolts
- secure_open: Bolts a door open*
- secure_close: Bolts a door closed*

*Used by the cryptographic sequencer.

Network Radio (141.1, 141.9, also varies)

The "Network Radio", which looks like... well, an old timey radio. Usually located near the mainframe in the computer core, sometimes it's elsewhere. This is what interfaces with the mainframe's /mnt/radio.

Device name: PNET_PR6_RADIO
Broadcast range: ?

You can log into the mainframe by connecting to this using a computer with a wireless network peripheral and FROG or TermOS. You can create a login packet using ThinkDOS's WizWrite and put it on the main drive in ThinkDOS under whatever name you want, then restart with a TermOS disk and run "file_load [name]" in TermOS, which will allow you to run file_send with the login packet.

Alternatively, maybe you can receive other files and save them to the disk with file_save [name], too...?

Secure Lockers (143.1)

Secure lockers that require an ID to open, including personal lockers in the Crew Quarters.

Device name: WNET_SECLOCKER
Broadcast range: 3 tiles (5 × 5)

The range on these is extremely short.

You can send these a few commands over the radio, though you'll need netpass_heads to lock or unlock them.

command=status: Replies with command=lock=[locked]&open=[open]
command=lock; pass=(netpass_heads): Locks the locker.
command=unlock; pass=(netpass_heads): Unlocks the locker. Surprise.

If you use one of the lock or unlock packets, you'll get a response with command=ack or command=nack; data=badpass depending on if it worked or not.

Personal lockers don't send messages when opened/claimed with an ID.

Hydroponics trays (143.3)

Device name: One of WNET_PACKETSPY, WNET_GENERIC, WNET_DETECTOR, WNET_SYN%%^#FF, randomly
Broadcast range: ≥64 tiles (129 × 129)

Packets:

netid: 02001234 -- The address of that particular tray. (Isn't this what sender is for?)
data: One of the following:
- event_new: A seed was planted in the tray.
- event_death: The plant died.
- event_cleared: The plant (dead or otherwise) was removed from the tray.

Yep, that's it. There's nothing useful here _{(as of the 2016 release)}. Not even the type of seed, or if it's ready to harvest, or anything. Sorry.

Fire Alarms (143.7)

This is from the 2016 release and may not be entirely relevant now, but...

Device name: PNET_FIREALARM (even though it's WNET...)
Broadcast range: ∞ (possibly)

Broadcasts a packet when things happen:

zone: Location name (like Head of Research's Office)
type: Alarm type (always Fire)
netid: Network address (as well as sender for some reason)
alert: What happened:
- fire: Fire alarm triggered
- reset: Fire alarm cleared

You can also trigger these remotely if you want to be annoying.

command=#####: One of the following:
- status: Triggers the above packet broadcast.
- trigger: Triggers the alarm.
- reset: Resets the alarm.

Robot patrol beacons (many frequencies)

Various patrol beacons around the station. These are used by Guardbuddies, Securitrons, and the tour guide, though often not on the same frequencies.

Frequencies: 143.1, 144.1, 144.3, 144.5, and so on.

They don't respond to pings, but they do respond to beacon requests. Beacons have a specific format and options available to control how bots act and what they do.

Securitron and tour guide beacons broadcast on this frequency. They're located under floor tiles, and you can access them by popping them open with a screwdriver and swiping an appropriate card.

Todo: This section needs some updating, for triggering and receiving beacon broadcasts, as well as editing them and how they work.

Tour Guide beacon, this one from the Escape Arm:

Location: tour16
- tour: 1 -- Marks it as a tour beacon
- next_tour: tour17 -- Which beacon comes after this in the route
- desc: In the event of catastrophic station damage... (What the tour guide will say when stopping here)

Patrol beacon, a fictional example (TODO: get a real one):

Location: sec
- patrol: 1 -- Marks it as a patrol beacon
- next_patrol: bar -- Which beacon comes after this in the route (TODO: verify the name)

You can't move the beacons around or create new ones, but you can at least make Murray shout obscenities when describing places. Or make him get stuck into a loop forever. Keep in mind that the text length you're allowed to enter is much shorter than the length of the default tour messages.

Sample log:

[37:15:3]:findbeacon=tour; address_1=!BEACON!; sender=0200564a; 
[37:15:3]:beacon=tour13; netid=02000e46; tour=1; next_tour=tour14; desc=...; 
[37:15:3]:beacon=tour16; netid=02000fa6; tour=1; next_tour=tour14; desc=...;

Securitrons (144.7)

Securitrons.

Status updates, sent from the bots:

type: secbot
name: Officer Beepsky -- this is whatever the bot is named. No way to distinguish between identically-named bots
loca: Cafeteria -- where the bot is currently located.
mode: 0 -- One of various modes (as described by the Securitron control PDA app):
- 0: Idle (Ready)
- 1: Spotted someone marked as arrest (Apprehending target)
- 2: At target, preparing to arrest
- 3: Arresting target
- 4: Starting patrol
- 5: On patrol
- 6: (Responding to summons) — will go to mode 4 and start patrolling when it reaches its destination

Controlling via the R.O.B.U.S.T. cart's Securitron app:

command: One of the following:
- bot_status: Get the status of the bot
- go: Start patrolling
- stop: Stop patrolling
- summon: Summons the bot
active: Officer Beepsky (see note below)
target: the floor; only if command=summon. (see note below)

Notes: These are BYOND internal atom references, and not actually text, so they're impossible to replicate in packets. These only work from the PDA application for that reason.

(Original note: This is because a byond atom reference is being passed in the packet, printing this reference will yield its name ("(the) floor"). It is impossible to replicate this packet. I'd recommend bringing this to IBM's attention. --Marquesas)

MULE bots (144.7)

MULE bots.