Sky+, DNLA, UPnP, the iPad app and the IP control protocol

Sky launched an update to the iPad Sky+ app this week, which enables the ability to remotely control your Sky box over IP, if you’re updated to the new picasso interface. Obviously, I needed to figure out how it all works, and how I could write my own code to control it. Here are my inital findings.

The service is a DNLA/UPnP type thing, that runs on http://[sky-box-ip]:49153/

Authentication is provided simply by User-Agent. SKY_skyplus works.

More information is after the break.

It returns the following information:

<?xml version="1.0"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">

The new Sky control protocol used in the iPad Sky+ app uses this webservice. I believe the description0 file is to do with the remote control service (hence references to RC2). The description0 file exposes the first 3 services provided by the Sky box’s server.

The example flow works like this with the iPad App:

iPad broadcasts to subnet request for Sky boxes. Sky box replies with its IP and a link to description0.xml via the SSDP service discovery protocol of UPnP. The iPad grabs this description0.xml file and then gets description2.xml. This file contains a very similar set of information, but for the SkyBrowse service – I suspect this is the planner editing bits, rather than a listings search.. I suspect the listings stuff still actually comes from sky’s webservices, rather than the local skybox. But I suppose it could contain information about the series link, and the “Watch on TV” command.

Then the iPad app sends a subscribe and a callback URL. This runs on port 51000 on your iPad and uses a SOAP urn of nds-com:serviceID:SkyPlay2. Not sure if this will ever be useful for us geeks, I doubt we’d ever want to send our own replies to the app?

The Sky Box then sends a SOAP wrapped HTTP packet with contains a SID which is a uuid – I think this is probably the session ID used for authentication on further requests, but i’m struggling to see where that is sent back in future requests at the moment.

A bunch of nonsense looking (from a ascii point of view) packets are sent throughout this, I don’t know that much about SOAP, so hopefully they might be standard things we don’t need to worry about. These seem to be basic syn/acks. I assume it’s proactive about keeping connections alive.

The fun stuff starts when you want to pause or so something like that. These are just simple SOAPACTIONs with urns like: “urn:schemas-nds-com:service:SkyPlay:2#Pause”. Once one of those has been ACK’d by the Sky Box, the iPad app sends another packet, but this time containing XML data with just seems to repeat the command, but in XML form.

The good news is, there doesn’t look like there is any encryption here. The next step is to try and make the Sky Box pause and play on demand using my own code, which I think means needing to reverse engineer the wsdl. I’ll write another post with more information once I get round to it.

Update 1:Just to clarify, there is 5 services exposed by this code: SkyPlay2, SkyCM2, SkyRC2, SkyBook2, SkyBrowse2.
Also, there is no description1.xml file (No idea why not…) 

Just a quick note to Sky or NDS, if they read this: I’m hoping this kind of playing isn’t a problem for you guys. If it is, just drop me an email ( and i’ll remove the blog posts and stop trying to figure out more. I’m not trying to do anything evil. If i discover anything that could be used for piracy (such as serving content over DNLA from the device) i’ll obviously not post about it. Just been a geek here.

  • BruH5200

    There is a decription7.xml and description8.xml too !
    Also the Ssdp is broadcast repeatedly by the box, I don’t think the iPad requests it as such.

  • mikeeaton

    I have also been looking into how the app works and via c# I was able to pause and play live TV.. maybe we could team up and have a little look? I want to create a Windows 8 / Windows Phone 8 app to control Sky+..
    I don’t want to post my email address but my twitter handle is mikeeaton. 

  • ringspun

    @BruH5200 The box does repeatedly broadcast via SSDP, at in interval of around 30 seconds. The iPad does send a request also though, to prompt a SSDP broadcast sooner – ie advertising the fact that it is actively looking for a box. This is why the iPad app finds a box almost immediately, but all the code i’ve found online prompts you to wait for around 30 seconds to find something.

  • ringspun

    “Then the iPad app sends a subscribe and a callback URL” – Do you have any more info on this please? I’m trying to figure out the request that is made, but having trouble pinning it down in wireshark.

  • Hi, 
    @ mikeeaton and @Liam – can you share some code? That C# code you talked about? I don’t seem to be able to connect to my SKY box and I really need this. I am happy to contribute with everything else I add to the project.
    My email

  • Kevin A

    Pretty sweet findings. I wonder whether one could make an XBMC plugin, that controls the SKY box such that the input would pass-through into the XBMC device and the device’s XBMC would overlay the SKY stream. That could mean that I’d need only one controller/remote in the end?

  • Wesley Elder


    first of all, great work!! And thank you.

    Has anyone been able to expose more than ( play/pause/stop/fwd/rewind – set and get channel, next and previous?

    i would like to replicate the remote as much as possible.

    I’d like send up/down/left/right/guide etc… , select and backup seem be in the iPhone App, however i can’t see this traffic in wireshark.. Has anyone had any luck with this?

    I’ve looked through alll the xml files i could find from the box, looked at the action commands however nothing is jumping out at me, i suspect it doesn’t exist.




    • dal

      Hey – check out Allows you to send all commands that you can from the remote – it’s not using the DLNA endpoints, so you don’t get any feedback – but it does let you send buttons like power, up / down / left right etc.

      • Chris Robertson

        This is really good. How did you find this protocol?

  • Mitchell Mann

    I know I’m late to the party here, but after using the Sky+ app recently to show off some photos on my iPhone to guests we had round I wondered if there was a Mac (or PC) app that allowed photos to be shared from a computer to the TV via the Sky+ box as I’ve many more on my Mac than I have on my iPhone. I used Wireshark to intercept the traffic to see how it worked and it *seemed* rather simple:-

    1. The app on the iPhone (or iPad/iPodTouch) opens a local port that acts as a web server, 51178 in my case although I’m sure this is randomly assigned.
    2. After initiating a TCP connection to the Sky+ box the app sends this: GET /photo-viewing/start?uri= HTTP/1.1 to port 49159 of the Sky+ box ( being the IP of my iPhone and photo1763828098 being the jpg photo file on my iPhone.
    3. The photo is streamed from the iPhone to the Sky+ box and displayed.

    Quite simple. I thought I could initiate a TCP connection with netcat to port 49159 of the Sky+ box and substitute the IP of my iPhone for the IP of a local web server and specify port 80 and replace photo1763828098 with whatever photo file was stored in the home/root directory of the web server, but nothing happened. So I did some searching and came across this old blog and upon reviewing Liam’s excellent I realise there are probably a few more steps required to make this work but my Python skills aren’t even noob level and as it already seems a pretty capable script I thought maybe adding this extra functionality would be quicker/easier than for me to code something from the ground up in a language I’m more familiar with.

    I hope this sparks some renewed interest and apologies for the spam as I notice there are a couple of related threads on this blog which I shall be copying and pasting this post to verbatim.

  • Thomas Luxton

    sorry, i’m late to the party also, i am trying to mimic the broadcast replies in hopes that i can access sky Q recordings over vpn any ideas how i might be able to accomplish this? I think the only problem is broadcasts are not sent over Vpn, so it will never receive a reply. thanks

    • You should be able to configure your VPN to work just like a computer on the network. You just need to make sure you’re giving out IP addresses on the same subnet, and don’t block broadcasts. I’ve seen screenshots of people using VPNs to their home networks just fine with Sky Q, so it’s definitely possible!

      • Thomas Luxton

        Hi, Thanks for the response, wasn’t anticipating one, however, the VPN i use on my Synology nas doesn’t allow putting IPs on the same subnet. If it did, I wouldn’t have thought this would be much help as I am doubtful that broadcasts would work over VPN due to the layers.

        I did contemplate trying to set up a new VPN in windows to put on the same subnet, but I dismissed the idea because generally broadcasts are not sent over VPN. I personally haven’t seen people using VPN’s with Sky Q, but I am hoping to overcome that.

        I have set the default gateway of the SkyQ box to the NAS – so the two endpoints will have no difficulties talking to each other. I have used wireshark to capture traffic between devices and SkyQ and that lead me to find this thread.

        I am hoping to replicate a broadcast manually on the local LAN with the source IP of the VPN client. Any knowledge how I can replicate the same traffic captured by the original broadcast?

        I suspect that when SkyQ receives the broadcast, it will communicate directly with the source IP.

        My other idea was to replicate the return traffic manually as the client would be expecting a response after it sent its broadcast.


  • Rob Burrowes

    Just went through the same discovery process with a sky box in New Zealand, replicating your Python code in Ruby,
    before finding you had already done it 😉 (

    Found the Sky box in a network scan, so had to play. It has ports 110 (pop), 143 (imap), 5901 (VNC?) and 49153 open. It is also broadcasting uPnP on 9000. Haven’t seen it call home to Sky yet, but it must, or the phone app wouldn’t be able to set up recordings (not that I can get that app to actually work).

    What might be useful to other kiwis, is the NZ sky channel codes in mysky_nz_channels.rb. Simple to generate, but time consuming, so I haven’t completed a full sweep of the channels.

    My sky box in NZ uses description3 and description4, though sometimes, these showed up on 0 and 2 instead. We have no equivalent of the Q version here, just the port 49153 Soap service. The controlURLs all have the UUID between the / and command.

    I did find that I needed to explicitly add a CR LF to the end of the soap body for it to work across my Mac, FreeBSD and Linux systems. I had to resort to tcpdump to see why one worked, and the others wouldn’t, using exactly the same code. I was getting an HTML 500 error on Linux and FreeBSD, before I added the line termination explicitly.

    I can play (FF/Rewind), pause, stop and change channel. I can’t play a recording, but can fetch the file:// url of a one that is playing, and can use ‘Stop’.

    I can’t get the skyBrowse or skyBook services to work. I just get an HTML 500 error for these.

  • John Williamson

    Loving your work Liam. I’m a Java guy and must admit the node.js and python code examples are a little confusing to me. In the process of converting some of what you have into Java but getting a bit stuck.

    I’ve got as far as discovering the sky box with a SSDP client which gives me all the info I think I will need but no idea what the next step would be to query the status of the box (i.e. is it playing or paused and what’s the current selected channel). Any tips from the below?

    HTTP/1.1 200 OK
    CACHE-CONTROL: max-age=115
    DATE: Wed, 05 Jan 2000 10:01:38 GMT
    OPT: “”; ns=01
    01-NLS: 7c6454de-1dd2-11b2-a146-96fef7129043
    SERVER: Linux/ UPnP/1.0 SKY DLNADOC/1.50
    X-User-Agent: redsonic
    ST: urn:schemas-nds-com:service:SkyPlay
    USN: uuid:444D5276-3247-536B-7943-0019fbd780f1::urn:schemas-nds-com:service:SkyPlay

    • John Williamson

      Here’s where I have got to so far. This gives me a Response Code : 200 for SkyPlay (The subscription was successful) yet the content is empty. Maybe I am heading down the wrong path. There was no HttpSubscribe.class from apache so overriding the HttpGet and changing the method name to SUBSCRIBE

      HttpClient client = HttpClientBuilder.create().build();
      HttpSubscribe request = new HttpSubscribe(url.toString());
      request.addHeader(“User-Agent”, “SKY_skyplus”);
      request.addHeader(“nt”, “upnp:event”);
      request.addHeader(“callback”, callback.toString());

      HttpResponse response = client.execute(request);

      System.out.println(“Response Code : ” + response.getStatusLine().getStatusCode());

      BufferedReader rd = new BufferedReader(new InputStreamReader(response.getEntity().getContent()));

  • Thomas Luxton

    I just wondered if anyone was close to being able to play recordings over a VPN?

  • Adam W

    Thanks for sharing your work on this! I know it’s late from the original post but does anyone know what SOAP actions are needed to power the box on and off and what data is needed to detect its standby state? The Sky+ app does it on iOS but can’t see any obvious network traffic when I use the remote section of the app.