Netgear Switch Discovery Protocol

NTDS (Netgear Switch Discovery Protocol)
Communication protocol
Purpose	Netgear level 2 switch management
Port(s)	63321, 63322, 63323, 63324

Netgear Switch Discovery Protocol (NSDP) is a management protocol for several network device families, designed by Netgear.

Message structure

Common message header

Offset	Length	Meaning
0x0000	1	Proto version – always 0x01
0x0001	1	Operation code: may be 0x01 – read request, 0x02 – read response, 0x03 – write request, 0x04 – write response
0x0002	2	Operation result
0x0004	4	Unknown
0x0008	6	host MAC-address
0x000e	6	network device MAC-address (value 00:00:00:00:00:00 is used as multicast address, request will be proceeded by all devices, which would receive it)
0x0014	2	Unknown
0x0016	2	Sequence number (value increments with every next request)
0x0018	4	Protocol signature NSDP
0x001С	4	Unknown
0x0020	N	Message body – the sequence of TLV records
0x0020 + N	4	End of message marker 0xFFFF0000

Message body record structure

Message body records are type–length–value (TLV) structures. Type field may be one of following values in the table(list in incomplete):

Type	Meaning
0x0001	Device model
0x0003	Device given name
0x0004	Device MAC-address
0x0005	Device system location
0x0006	Device current IP-address (may be unsupported by certain devices)
0x0007	Device IP-network mask (may be unsupported by certain devices)
0x0008	Router IP-address (may be unsupported by certain devices)
0x000a	administration password
0x000b	DHCP Mode (Refresh DHCP = 2, DHCP = 1, Static = 0)
0x000d	Device Firmware version slot 1 (may be unsupported by certain devices)
0x000e	Device Firmware version slot 2 (may be unsupported by certain devices)
0x000f	Next active firmware slot after reboot (01 = 1, 02 = 2, may be unsupported by certain devices)
0x0c00	Speed/link status of ports
0x1000	Port Traffic Statistic
0x2800	Get VLAN info
0x2c00	Delete VLAN (write only)

Protocol flow examples

Network devices discovery (MAC-address an device model discovery):

   Host with MAC=XX:XX:XX:XX:XX:XX from UDP-port 63321 or 63323 sending packet to broadcast IP-address 255.255.255.255 and UDP-port 63322 or 63324
   Header    @0x00000000 0x01 0x01 0x000000000000 0xXXXXXXXXXXXX 0x000000000000 0x0000 0x0001 0x4E534450 0x00000000
   Body      @0x00000020 0x0001 0x0000 0x0004 0x0000
   Marker    @0x00000028 0xFFFF0000

   EACH Device responds with message like
   Header    @0x00000000 0x01 0x02 0x000000000000 0xXXXXXXXXXXXX 0xYYYYYYYYYYYY 0x0000 0x0001 0x4E534450 0x00000000
   Body      @0x00000020 0x0001 0x0028 0x47 0x53 0x31 0x30 0x35 0x45 0x20*0x22 0x0004 0x0006 0xYYYYYYYYYYYY
   Marker    @0x00000058 0xFFFF0000

Device support for protocol

GS105E ProSAFE Plus
GS108E ProSAFE Plus
GS724T
GS748T
FS116E (IP-network description and Firmware version TLVs are not supported)
FS726TP (uses 63323 and 63324 UDP-ports for interconnection)

Devices firmware update

Device firmware update is made with TFTP protocol, but you need to send NSDP request to turn on TFTP-server first.

References

External links

NETGEAR official site
openSource Perl-written cross-platform toolkit for NSDP managed devices project site (in russian) Archived 2016-12-20 at the Wayback Machine
LinNetx openSource C-written utility for ProsafePlus switches management via NSDP, not operational
ngadmin C-written admin utility; GPLv2 license
ProSafeLinux Remark: sparse information; FreeBSD license
NSDP Protocol Wireshark dissector Remark: GPL license
Nsdtool – a toolset of scripts to detect NETGEAR switches in local networks
NETGEAR firmware update