← Back to Blog
GT06 frame anatomy: start bytes, length, type, content, serial, CRC and end bytes, with the server login reply

GT06 Protocol Explained: How Concox-Style Trackers Talk to Your Server

How the GT06 protocol used by Concox and Jimi IoT trackers works - frames, login ACK, heartbeats, alarms - and how to test a decoder without a device.

GT06 is the most widely cloned protocol in budget GPS tracking. Traccar's device catalog lists it under 19 brands, led by Concox and Jimi IoT. It's binary, it runs over TCP, and it has one rule that breaks more integrations than any other: the server must answer.

Frame Anatomy

Every GT06 message uses the same envelope:

78 78 | length | type | content | serial | CRC | 0D 0A

  • Start bytes - 78 78, or 79 79 for long frames with a 2-byte length
  • Length - counts from the type byte through the CRC
  • Serial - a counter the server echoes back in its reply
  • CRC - CRC-16/X.25 over everything from length to serial

This is the server's reply to a login with serial 1:

78 78 05 01 00 01 D9 DC 0D 0A

The Session

  1. Login (0x01) - the device sends its IMEI as 8 BCD bytes.
  2. Login ACK - the server must reply. If it never does, a real device keeps retrying the login and never gets to its positions.
  3. Positions - GPS, speed, course and cell tower data: type 0x12 on classic GT06 devices, 0x22 on Jimi 2G and 0xA0 on Jimi 4G.
  4. Heartbeats - a status packet about every 3 minutes with battery, GSM signal and ignition. The server answers each one.
  5. Alarms - SOS, power cut, overspeed, geofence and more, each in its own alarm packet.
Emulator Debugging Tool showing a GT06 login, positions, information frames and a heartbeat
A GT06 session in the Emulator Debugging Tool

Decoder Bugs That Show Up Late

  • No login ACK - the device looks connected but never reports a position.
  • Hemisphere bits - north and west live in the course/status word (bit 10 = north, bit 11 = west), not in the coordinates. Miss them and devices in the southern or western hemisphere land in the wrong place.
  • Coordinate scale - latitude and longitude are degrees × 1,800,000.
  • Time zone - timestamps should be UTC, but a time zone sent at login shifts every later date.
  • CRC - Traccar doesn't verify it, so a passing Traccar test says nothing about CRC handling in your own decoder.

Testing Without a Device

Telemify emulates a GT06 tracker end to end: login, heartbeats every 180 seconds, positions along a route and alarms on a timeline. In Protocol Settings you choose the Device profile (Jimi 4G, Jimi 2G or GT06 classic) and whether to wait for the server login reply. With that on, a missing ACK stops the run with an error instead of failing silently.

Battery, GSM signal and odometer are configurable, plus external voltage, temperature and humidity on the Jimi profiles. Some things GT06 simply can't carry: engine hours, RPM, oil level or coolant temperature. Battery goes out as a voltage or one of 7 levels, never an exact percentage.

Alarms & Events tab with SOS and power cut alarms on a timeline
GT06 alarms on a timeline

Working with a real Concox or Jimi IoT model? See which GT06 profile to pick. Need a server to test against? Set up Traccar in Docker. Comparing protocols? Read Teltonika vs GT06 vs H02 vs GPS103.

Try Telemify for free →