So after a quick bash with tcpdump a few things started to surface.
Seems Tivo uses XMPP (aka Jabber/gtalk) to communicate back to base.
20:58:33.659299 IP (tos 0x0, ttl 64, id 25909, offset 0, flags [DF], proto TCP (6), length 52)
tivo.home.33802 > 125.255.82.156.5223: Flags [.], cksum 0x777e (correct), ack 75, win 8074, options [nop,nop,TS val 80672982 ecr 1297453195], length 0
20:58:33.699052 IP (tos 0x0, ttl 245, id 36422, offset 0, flags [none], proto TCP (6), length 52)
125.255.82.156.5223 > tivo.home.33802: Flags [.], cksum 0x6442 (correct), ack 1, win 6970, options [nop,nop,TS val 1297463234 ecr 80668970], length 0
And that IP belongs to Pacific Internet, at least in part
firewall ~ # whois 125.255.82.156
inetnum: 125.255.0.0 - 125.255.255.255
netname: PI-AU
descr: Pacific Internet (Australia) Pty Ltd
This is also further confirmed now I know some google keywords to search for
https://stpeter.im/index.php/2008/01/10/xmpp-in-tivo/
The last comment though doesn't bode well considering it's age
It also seems to talk straight http to amazon for podcasts, and to an internode cache node for blockbuster
21:09:22.168470 IP (tos 0x0, ttl 64, id 32069, offset 0, flags [DF], proto TCP (6), length 52)
tivo.home.34830 > tivo.cdn.on.net.http: Flags [.], cksum 0xc31e (correct), ack 19557, win 45056, options [nop,nop,TS val 80737832 ecr 1306147258], length 0
This is no doubt because I'm on internode, wonder where it goes for non Internode users.
Also if the podcasts are from amazon this mean that they're probably no included in "free content" for Internode users.
It also looked like it phoned out to the 125 IP above on tcp port 7287 to get teh list of blockbuster servers or movies or something this port (and many others) are listed in the what to open on your firewall
http://support.mytivo.com.au/index.p...151&artlang=en
That's not a standard port for anything according to IANA so I'm suspecting custom protocol, unless it's a random port.
I also saw some multicast packets that were related to the tivo desktop software. Pretty neat using multicast.
Looks like someone over at Tivo (Hybrid?) has at least a decent grasp on the networking side.
Going to get a few more extensive packet captures and run them through wireshark.
Will let you all know what I find.
Bookmarks