The NCR NDC+ messaging format (which is typically over the TCP/IP protocol but can also be over async or bisync) used with ATMs is actually pretty straight forward with a limited number of message types and one can generally eyeball it to and tell what is going on once you have been looking at it long enough.
The full specification, though proprietary, can be readily found on the internet that includes most NDC message types and statuses for current devices. It can be licensed / purchased from NCR on their website relatively easily as well which is what I would recommend for official support and legal reasons; especially if you ever plan on connecting the software to their terminals.
Because it is proprietary I am not going to link directly to it but using the following search terms I can usually find a current copy of it in the first page of Google results with hits on Scribd, DocFiles, Wordpress, and many other sites.
- "NDC Reference Manual"
- "NCR Aptra Advanced Message"
The SNMP traps and how to connect to it is a bit more complicated and not as easily found on the web and as far as I know requires you to be authorized to connect to their terminal agent.
The vendors referenced in this StackOverflow answer have already developed parsers for NDC and Diebold 912 as part of their product but do not license them out.