The following are my insights into the meaning of the "magic" Network HotSync init sequence. 

The general pattern seems to be:
byte  0    : command code in request blocks, or command code | 0x80 in response blocks
byte  1    : Number of arguments
byte 2-7   : padding/error code???

If there are arguments:
byte 8-9   : argument ID    (Word)
byte 10-13 : Length (excluding this header)  (DWord)
[Compare bytes 8-13 with the DlpLongArgWrapperType from System/DLCommon.h]
byte 14-... : argument (variable length)


============================================================================================================
Read 22 bytes:
90 01 00 00 00 00 00 00 00 20      \x90^A^@^@^@^@^@^@^@
00 00 00 08 01 00 00 00 00 00      ^@^@^@\b^A^@^@^@^@^@
00 00                              ^@^@
This looks like a response block:
byte  0    : 0x90 = 0x10 | 0x80 = response to command 0x10
byte  1    : 01 = 1 argument???
byte  8-9  : 0x20 = FirstArgID???
byte 10-13 : 0x08 = Length is 8 bytes

Sending 50 bytes:
12 01 00 00 00 00 00 00 00 20      ^R^A^@^@^@^@^@^@^@
00 00 00 24 ff ff ff ff 3c 00      ^@^@^@$\xff\xff\xff\xff<^@
3c 00 00 00 00 00 00 00 00 00      <^@^@^@^@^@^@^@^@^@
c0 a8 a5 1f 04 27 00 00 00 00      \xc0\xa8\xa5^_^D'^@^@^@^@
00 00 00 00 00 00 00 00 00 00      ^@^@^@^@^@^@^@^@^@^@
This looks like a request block:
byte  0    : 0x12 = command 0x12
byte  1    : 01 = 1 argument???
byte  8-9  : 0x20 = FirstArgID???
byte 10-13 : 0x24 = Length is 36 bytes
byte 31-33 : c0 a8 a5 1f (192.168.165.31) : IP address of the host   (this is currently hardcoded into pilot-link)

Reading up to 50 bytes.
rlen = 50
Read 50 bytes:
92 01 00 00 00 00 00 00 00 20      \x92^A^@^@^@^@^@^@^@
00 00 00 24 ff ff ff ff 00 3c      ^@^@^@$\xff\xff\xff\xff^@<
00 3c 40 00 00 00 01 00 00 00      ^@<@^@^@^@^A^@^@^@
0a 00 00 02 04 00 00 00 00 00      \n^@^@^B^D^@^@^@^@^@
00 00 00 00 00 00 00 00 00 00      ^@^@^@^@^@^@^@^@^@^@
This looks like a response block:
byte  0    : 0x92 = 0x12 | 0x80 = response to command 0x12
byte  1    : 01 = 1 argument???
byte  8-9  : 0x20 = FirstArgID???
byte 10-13 : 0x24 = Length is 36 bytes
byte 31-33 : 0a 00 00 02 (10.0.0.2) : IP address assigned to the Palm device (this is the response from my Palm device,
                                      and I assigned this address to my device).
									  Pilot-link has c0 a8 a6 1e (192.168.165.30) here.
byte 34 : Identical to byte 34 in request block. Coincidence?
byte 35 : Kenneth Albanowski's Palm device has a 0x01 here, while mine says 0x00. Meaning unknown.

Sending 46 bytes:
13 01 00 00 00 00 00 00 00 20      ^S^A^@^@^@^@^@^@^@
00 00 00 20 ff ff ff ff 00 3c      ^@^@^@ \xff\xff\xff\xff^@<
00 3c 00 00 00 00 00 00 00 01      ^@<^@^@^@^@^@^@^@^A
00 00 00 00 00 00 00 00 00 00      ^@^@^@^@^@^@^@^@^@^@
00 00 00 00 00 00                  ^@^@^@^@^@^@
This looks like a request block:
byte  0    : 0x13 = command 0x13
byte  1    : 01 = 1 argument???
byte  8-9  : 0x20 = FirstArgID???
byte 10-13 : 0x20 = Length is 32 byte
byte 14-20 : Identical to same bytes in last response block. Is this some sort of negotiation, where we confirm
             that we want to use the settings that the Palm device suggested in its last response block?
             0x3c = 60. Could these be timeout-values (60 secs. = 1 minute).

Reading up to 8 bytes.
rlen = 8
Read 8 bytes:
93 00 00 00 00 00 00 00            \x93^@^@^@^@^@^@^@
This looks like a response block:
byte  0    : 0x93 = 0x13 | 0x80 = response to command 0x13
byte  1    : 00 = 0 arguments???
