Will explore communication with the controller, as well potentially custom firmware for the labels themselves. Powering the controller via POE

As the controller is new in the box, the default admin password works, can we have access to the configuration UI.

The Hanshow Nebular-266R-N is a 2.66-inch electronic shelf label (ESL) primarily used in retail environments for automated, dynamic pricing and inventory display. It features a multi-color e-paper display, Near Field Communication (NFC), and long-lasting battery life.

Each of the labels has a barcode and 4 pairs of hex characters as default display. The same code is returned when scanned with an NFC reader.

NFC is reporting it as an ISO 7816 Tag Type

Scanning for open ports has revealed the device may communicate over UDP at times.

PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
MAC Address: 98:XX:XX:XX:XX:XX (Zhejiang Hanshow Technology)

I believe it may be using 26 byte frames with encryption to send payloads

UDP Port 37021 as well as TCP 37021 are used to connect AP to the ESL Working

I now have the ability to emulate the initial handshake between the Hanshow AP and a replacement for the ESL Working. AP then sends periodic hear beat updates. I can also initiate a scan for tags, and get heart beat responses from tags that can be seen nearby.