I ceased messing around with this a long time ago as I no longer have the iptv box in my possession

Well, not really behind the scenes. But these are my findings of how Telias IPTV works. The original reason behind this is that I would like to stream the channels to my computers.

The base of it all is a series of multicasted UDP streams in the range 239.16.16.0/24, including both the actual channels and box configuration/firmware. The program guide is more or less a normal web side accessed over HTTP.

The hardware involved is a Zyxel Prestige 660H Triple Play and the Motorola/Kreatel 1510 STB. To connect to the IPTV service using a normal network one have to hook up the IPTV-port of the Zyxel modem directly to a computer. Sniffing the traffic to/from the STB can be done by simply bridging two interfaces and using the box as normal. It’s also possible to enable the IPTV service on one of the unused ports by reconfiguring the modem (to get two output ports).

Getting an IP-address

The DHCP request to Telias server must contain the following option, otherwise, their server won’t respond.

Option(60) Vendor-class-identifier XX XX XX XX XX

The XX-string is a 5 byte value that is rumored to be some sort of serial number. I haven’t found any hard evidence of this as my value doesn’t match any of those on the box. The following should be enough configuration (dhclient.conf) of the ISC DHCP client to send the correct option.

send vendor-class-identifier XX:XX:XX:XX:XX;

Once the interface has been bound to an address the connection should work just like a normal Telia ADSL connection, the PTR record of the address is a subdomain to digitaltv.telia.com.

Boot sequence of the Kreatel/Motorola 1500 box

During the boot sequence (after DHCP) the box joins the multicast group 239.16.16.202 which distributes the initial configuration over something called infocast2, UDP port 5555. Among other things the local time and a xml file containing a “portal URL” which is http://iptvlogin.telia.se/iptvgui/initial.html this page displays the initial “hour glass” one sees when booting the box.

Next, depending on the revision of the box it will download its firmware based on the configuration file, they point out further multicast groups to join. The following was valid during writing

kreatel-ip-stb-rev-4, kreatel-ip-stb-rev-6, kreatel-ip-stb-rev-11

bc_kernel_addr 239.16.16.205:5555
bc_kernel_name software_1500
bc_root_addr 239.16.16.205:5555
bc_root_name software_1500
bc_splash_addr 239.16.16.204:5555
bc_splash_name splash-data_mipsel

kreatel-ip-stb-rev-9, kreatel-ip-stb-rev-13, kreatel-ip-stb-rev-15

bc_kernel_addr 239.16.16.209:5555
bc_kernel_name software_1500_secure
bc_splash_addr 239.16.16.210:5555
bc_splash_name splash-data_mipsel_secure

What do you know, seems like the box is based on a MIPS CPU (not that surprising)

software_1500: ELF 32-bit LSB executable, MIPS, version 1 (SYSV), statically linked, not stripped

The firmware “software_1500_secure” just identifies as “data” and has the first 3 bytes set to “SEC”, encrypted ELF file perhaps?

This data (configuration and firmware) can be extracted with the Infocast2Tools. The package contains a server and a client. Simply start the client with the multicast address of interest and start the box.

Streaming TV to VLC

Viewing a channel is as simple as joining the correct multicast group, unfortunately, some channels are encrypted/scrambled. All channels are streamed over UDP/5555 using ISO/IEC 13818 MPEG-2.

Viewing is as simple as

vlc udp://@239.16.16.1:5555

The following channels are currently not scrambled (Swedish)

  • 239.16.16.1 – SVT1
  • 239.16.16.2 – SVT2
  • 239.16.16.21 – TV4
  • 239.16.16.35 – canal+ sport? (I’m not sure which channel this actually is)
  • 239.16.16.44 – Telia/Comhem info
  • 239.16.16.45 – Telia/Comhem info
  • 239.16.16.46 – Telia/Comhem info
  • 239.16.16.47 – Telia/Comhem info
  • 239.16.16.65 – Disney channel
  • 213.16.16.100 – Cartoon Network

Scrambled channels

Not the whole stream is scrambled, but only individual sub-frames. These have the “Transport Scrambling Control” field in the ISO/IEC 13818 header set to 2 (User defined).

The box does not utilize a CA card, instead it has some software solution which I believe is VeriMatrix VCAS system for IPTV. During packet analysis I found that the box does a few TCP connections to hyca.iptv.telia.com (213.64.59.103) on ports 12697, 12698, 12699 and 12700. These connections turned out to be SSL connections involving two certificates issued by CA@Verimatrix.com for VCI.XXXX@TeliaSonera.com and SUBCA.YYYY@TeliaSonera.com (XXXX/YYYY are integer strings, I don’t know if they are unique yet, I guess not).

Certificate (pkcs-9-at-emailAddress=CA@Verimatrix.com,id-at-commonName=Verimatrix ROOT CA,id-at-organizationalUnitName=VCAS,id-at-organizationName=Verimatrix,id-at-localityName=San Diego,id-at-stateOrProvinceName=CA,id-at-countryName=US)

The Verimatrix website describes a “Video Content Authority System” that utilizes public/private keys, my guess is that ones identification code or control code is sent to their system over this channel and a decryption key is returned which can be used to decrypt the scrambled frames.

Figuring out what to send and which decryption method that is used (the VeriMatrix web page talks about AES) is the key to stream scrambled channels to a normal computer or to a HTPC.

Further studies of their product sheets/white papers reveals that each channel stream gets its own encryption key. If this really is the case, the authorization key one receives from Telia when signing up for the service (the key one has to enter into the STB to be able to use it) can only be used to control which encryption keys that are sent from the their key server to the STB.

Update: Seems I was partially right and partially wrong about the TCP connections. The connections to 12697 and 12699 are SSL connections, however the connections to 12698 and 12700 are not.

41 Responses to “Behind the scenes of Telias IPTV”
  1. pintone says:

    This tred was intresting .
    but you are all wrong ….

    udp://@239.16.16.3:5555 » SVT24

    udp://@ forget this right now.

    239.16.16.3:5555 this is only the last part and 5555 is not the port the comunication is on

    how it shud louck hmmm we nead to now more about the port number it can be all from 80 to 65535

    and you also nead to now the ip adress of the server .. no its not 239.16.16.3 as in “udp://@239.16.16.3:5555″

    ok lets say the ip of the server is 213.64.59.103 and the port that is open for the comunication is 81 then it woud louck like this. to work in vlc

    http://213.64.59.103:81/udp/239.16.16.3:5555

    hope you get it

  2. Semi says:

    You probably would like to check this out: https://bitbucket.org/cesbo/getstream_a84/wiki/Docs_en
    Looks like there is software decrypter project for IPTV :)

  3. tv-user says:

    Google for infocastserver.rpm or visit http://www.mikrocontroller.net/topic/244038

  4. Timm says:

    interresting. You managed to flash firmware on a KPN box? Can you post any links to the info you used for this?

  5. tv-user says:

    Could not get the files with the infocast2 client. Found 1900 firmware on the web and that one is working. Made a channels.txt and now I can use it to access my vdr server.

  6. Timm says:

    Hi tv-user,

    can infocast get the firmware from the KPN box? I have a 1960 and want to try.. You have any experience with it?

  7. tv-user says:

    Any KPN iptv user from Holland willing to use the infocast2tools to get the firmware of a 19×0 box?
    Don’t have KPN but have some of the 1960 in need of firmware.

  8. Ataa says:

    @joolz,

    Ran wireshark and found these:

    239.255.140.x
    239.255.142.x
    239.255.143.x
    239.255.148.x

    it may work on your country / network :

    Can you share the scanner?

    Thanks

  9. joolz says:

    Just wrote a scanner for ip multicast here in malmo and got this as a list of all ip address sending data on port 555

    #EXTM3U
    udp://@239.16.16.1:5555
    udp://@239.16.16.2:5555
    udp://@239.16.16.3:5555
    udp://@239.16.16.4:5555
    udp://@239.16.16.5:5555
    udp://@239.16.16.6:5555
    udp://@239.16.16.7:5555
    udp://@239.16.16.8:5555
    udp://@239.16.16.10:5555
    udp://@239.16.16.11:5555
    udp://@239.16.16.12:5555
    udp://@239.16.16.13:5555
    udp://@239.16.16.14:5555
    udp://@239.16.16.15:5555
    udp://@239.16.16.17:5555
    udp://@239.16.16.18:5555
    udp://@239.16.16.19:5555
    udp://@239.16.16.21:5555
    udp://@239.16.16.29:5555
    udp://@239.16.16.53:5555
    udp://@239.16.16.61:5555
    udp://@239.16.16.62:5555
    udp://@239.16.16.64:5555
    udp://@239.16.16.69:5555
    udp://@239.16.16.103:5555
    udp://@239.16.16.104:5555
    udp://@239.16.16.108:5555
    udp://@239.16.16.109:5555
    udp://@239.16.16.117:5555
    udp://@239.16.16.118:5555
    udp://@239.16.16.119:5555
    udp://@239.16.16.120:5555
    udp://@239.16.16.123:5555
    udp://@239.16.16.124:5555
    udp://@239.16.16.125:5555
    udp://@239.16.16.126:5555
    udp://@239.16.16.127:5555
    udp://@239.16.16.128:5555
    udp://@239.16.16.129:5555
    udp://@239.16.16.130:5555
    udp://@239.16.16.131:5555
    udp://@239.16.16.132:5555
    udp://@239.16.16.133:5555
    udp://@239.16.16.135:5555
    udp://@239.16.16.136:5555
    udp://@239.16.16.137:5555
    udp://@239.16.16.138:5555
    udp://@239.16.16.139:5555
    udp://@239.16.16.140:5555
    udp://@239.16.16.141:5555
    udp://@239.16.16.142:5555
    udp://@239.16.16.143:5555
    udp://@239.16.16.144:5555
    udp://@239.16.16.145:5555
    udp://@239.16.16.146:5555
    udp://@239.16.16.147:5555
    udp://@239.16.16.149:5555
    udp://@239.16.16.150:5555
    udp://@239.16.16.163:5555
    udp://@239.16.16.164:5555
    udp://@239.16.16.177:5555
    udp://@239.16.16.178:5555
    udp://@239.16.16.195:5555
    udp://@239.16.16.196:5555
    udp://@239.16.16.197:5555
    udp://@239.16.16.198:5555
    udp://@239.16.16.199:5555
    udp://@239.16.16.202:5555
    udp://@239.16.16.207:5555
    udp://@239.16.16.208:5555
    udp://@239.16.16.209:5555
    udp://@239.16.16.210:5555
    udp://@239.16.16.211:5555
    udp://@239.16.16.214:5555
    udp://@239.16.16.215:5555
    udp://@239.16.16.221:5555
    udp://@239.16.16.222:5555
    udp://@239.16.16.224:5555
    udp://@239.16.16.225:5555
    udp://@239.16.16.226:5555
    udp://@239.16.16.231:5555
    udp://@239.16.16.232:5555
    udp://@239.16.16.233:5555
    udp://@239.16.16.234:5555
    udp://@239.16.16.237:5555
    udp://@239.16.16.238:5555
    udp://@239.16.16.240:5555
    udp://@239.16.16.247:5555
    udp://@239.16.16.251:5555
    udp://@239.16.16.252:5555
    udp://@239.16.16.253:5555
    udp://@239.195.0.1:5555
    udp://@239.195.0.2:5555
    udp://@239.195.0.20:5555
    udp://@239.195.0.22:5555
    udp://@239.195.0.23:5555
    udp://@239.195.0.24:5555
    udp://@239.195.0.26:5555
    udp://@239.195.0.27:5555
    udp://@239.195.0.28:5555
    udp://@239.195.0.29:5555
    udp://@239.195.0.31:5555
    udp://@239.195.0.32:5555
    udp://@239.195.0.33:5555
    udp://@239.195.0.34:5555
    udp://@239.195.0.35:5555
    udp://@239.195.0.43:5555
    udp://@239.195.0.44:5555
    udp://@239.195.0.45:5555
    udp://@239.195.0.46:5555
    udp://@239.195.0.47:5555
    udp://@239.195.0.48:5555
    udp://@239.195.0.49:5555
    udp://@239.195.0.50:5555
    udp://@239.195.0.51:5555
    udp://@239.195.0.52:5555
    udp://@239.195.0.53:5555
    udp://@239.195.0.54:5555
    udp://@239.195.0.55:5555
    udp://@239.195.0.56:5555
    udp://@239.195.0.57:5555
    udp://@239.195.0.58:5555
    udp://@239.195.0.59:5555
    udp://@239.195.0.60:5555
    udp://@239.195.0.61:5555
    udp://@239.195.0.62:5555
    udp://@239.195.0.63:5555
    udp://@239.195.0.64:5555
    udp://@239.195.0.65:5555
    udp://@239.195.0.66:5555
    udp://@239.195.0.67:5555
    udp://@239.195.0.69:5555
    udp://@239.195.0.73:5555
    udp://@239.195.0.74:5555
    udp://@239.195.0.75:5555
    udp://@239.195.0.76:5555
    udp://@239.195.0.77:5555
    udp://@239.195.0.78:5555
    udp://@239.195.0.79:5555
    udp://@239.195.0.80:5555
    udp://@239.195.0.81:5555
    udp://@239.195.0.82:5555
    udp://@239.195.0.83:5555
    udp://@239.195.0.84:5555
    udp://@239.195.0.90:5555
    udp://@239.195.0.93:5555
    udp://@239.195.0.95:5555
    udp://@239.195.0.96:5555
    udp://@239.195.0.98:5555
    udp://@239.195.0.99:5555
    udp://@239.195.0.100:5555
    udp://@239.195.0.101:5555
    udp://@239.195.0.102:5555
    udp://@239.195.0.103:5555
    udp://@239.195.0.104:5555
    udp://@239.195.0.105:5555
    udp://@239.195.0.106:5555
    udp://@239.195.0.107:5555
    udp://@239.195.0.108:5555
    udp://@239.195.0.109:5555
    udp://@239.195.0.110:5555
    udp://@239.195.0.111:5555
    udp://@239.195.0.112:5555
    udp://@239.195.0.113:5555
    udp://@239.195.0.114:5555
    udp://@239.195.0.115:5555
    udp://@239.195.0.116:5555
    udp://@239.195.0.120:5555
    udp://@239.195.0.122:5555
    udp://@239.195.0.151:5555
    udp://@239.195.0.152:5555
    udp://@239.195.0.160:5555
    udp://@239.195.0.162:5555
    udp://@239.195.0.163:5555
    udp://@239.195.0.164:5555
    udp://@239.195.0.168:5555
    udp://@239.195.0.169:5555
    udp://@239.195.0.170:5555
    udp://@239.195.0.171:5555
    udp://@239.195.0.172:5555
    udp://@239.195.0.177:5555
    udp://@239.195.0.178:5555
    udp://@239.195.0.246:5555
    udp://@239.195.0.247:5555
    udp://@239.195.0.251:5555
    udp://@239.195.0.252:5555
    udp://@239.195.1.103:5555
    udp://@239.195.1.104:5555
    udp://@239.195.1.105:5555
    udp://@239.195.1.106:5555
    udp://@239.195.1.107:5555
    udp://@239.195.1.150:5555
    udp://@239.195.1.151:5555
    udp://@239.195.1.152:5555
    udp://@239.195.1.153:5555
    udp://@239.195.1.154:5555
    udp://@239.195.1.155:5555
    udp://@239.195.1.156:5555
    udp://@239.195.1.158:5555
    udp://@239.195.1.159:5555
    udp://@239.195.1.161:5555
    udp://@239.195.1.164:5555
    udp://@239.195.1.172:5555
    udp://@239.195.1.179:5555
    udp://@239.195.1.181:5555

    Anybody know any other subnets there is maybe IPTV data on it let me know and i will scan these as well.

    joolz

  10. tinti says:

    Do you guys think it would be possible to decrypt the stream using a software like SASC-NG? from: http://dolot.kipdola.com/wiki/Install_SASC-NG

  11. Patrik says:

    Are the FTA channels also encrypted – such as SVT1, SVT2, SVT HD?
    I did try to tune in via VLC a couple a weeks ago but did not see any picture or sound – even though I could see in Wireshark I got the stream running…

  12. masseur2002 says:

    Looking for someone from the Netherlands who is able to contact a Motorola vip1960 iptv box of KPN without connecting to the KPN netwerk.
    Want to use the iptv box standalone connected via USB to my laptop as movie storage
    Cheers

  13. Fluff says:

    I would love a modified firmware, should be awesome to watch canal + for free

  14. Daniel says:

    Seems like Telia uses VCAS encyption on almost all channels for the moment. I think a modefied firmware for the iptv-box is the solution for this.

    List updated:
    http://dl.dropbox.com/u/6747879/Telia%20IPTV.xspf

  15. Johan says:

    Att: Daniel

    I really appreciated your list. However quite a few of channels are now blocked. Any chance that you, or anyone else who knows how to do it, would post a new / updated playlist?

    Thanks in advance!

  16. NN says:

    For the Norwegians out there, you might want to join the group “Ja til åpen IPTV-standard fra Altibox!” at Facebook. Together we might be able to push the IPTV providers in the right direction. Currently, all the channels are being encrypted in Norway, including NRK.

  17. Daniel says:

    Still working, Telia have updated some of the channels so new ipadresses are used. Some HD-channels work. Havent found all Viasat channels tho.

    New list: 2010-08-01
    http://dl.dropbox.com/u/6747879/Telia%20IPTV.xspf

  18. Faso says:

    In The Netherlands we’ve also got the same Kreatel STB solution (now Motorola).
    I’ve connected 8 STB’s each recieving two HD streams (recording 1, other viewing), with little to no loss of bandwith.
    It seems the bandwith is throttled up to keep the paid for bandwith available.

    8 STB’s? Let’s say I’m not on a private connection and that the STB’s are part of the company I work for.

    So if all is the same, wy can’t I open the UDP Stream on my PC?

  19. Peter James says:

    I live in the US but want to stream these channels from Telia using VLC. I am following all of the settings and using the urls provided, but I am getting nothing….am I out of luck?

  20. Is there someone outthere how is able to send telias firmware, simulary way that Intocast2 and Extender or jExtender does?

    I have two kreatel 1510 boxes that I should like to stream video from a PC. Please send a respose on helge_larsson@hotmail.com.

  21. Ahmed says:

    Here is a play list http://www.htpc.se/Iptv.m3u where you can find all the channels. Or just copy and paste the flowing and save it to a file named Iptv.m3u
    —————————————————————————
    #EXTM3U
    #EXTINF:0,1.TV1
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.1:5555
    #EXTINF:0,2.TV2
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.2:5555
    #EXTINF:0,4.TV4
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.21:5555
    #EXTINF:0,5.Kanal5
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.110:5555
    #EXTINF:0,6.TV4+
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.22:5555
    #EXTINF:0,7.Discovery
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.101:5555
    #EXTINF:0,8.MTV
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.111:5555
    #EXTINF:0,9.Eurosport
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.106:5555
    #EXTINF:0,10.TV24
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.3:5555
    #EXTINF:0,11.Barnkanalen
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.4:5555
    #EXTINF:0,20.Animal Planet
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.93:5555
    #EXTINF:0,21.Discovery Civilisation
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.102:5555
    #EXTINF:0,22.Discovery Science
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.103:5555
    #EXTINF:0,23.Travel & Living
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.104:5555
    #EXTINF:0,60.TV4 film
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.24:5555
    #EXTINF:0,61.Showtime
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.115:5555
    #EXTINF:0,70.Eurosport 2
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.107:5555
    #EXTINF:0,71.Sport Expressen
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.122:5555
    #EXTINF:0,80.Nickelodeon
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.113:5555
    #EXTINF:0,90.DITV
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.121:5555
    #EXTINF:0,100.TV 400
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.23:5555
    #EXTINF:0,101.STAR
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.116:5555
    #EXTINF:0,102.VH 1
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.120:5555
    #EXTINF:0,103.THE VOICE
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.117:5555
    #EXTINF:0,108.AFTONBLADET 7
    #EXTVLCOPT:access-filter=timeshift
    udp://@239.16.16.119:5555

  22. Jones says:

    What VPI/VCI does Telia use for Iptv ?

  23. Vytautas says:

    I have op stb motorola vip1920dtb. It is bought from lithuanian IPTV provider Teo (subsidiary of Telia-Sonera). According to motorola bulettin http://www.motorola.com/staticfiles/Business/Products/TV%20Video%20Distribution/Set-tops/IP%20Set-tops/VIP1920/_Documents/Static%20Files/VIP1900-9T_specsheet_090508.pdf?localeId=33
    it has lot of possibilities. But now it is with special Teo (or may be Telia) firmware, which is primary orientated to local IPTV and realises very few capabilities in using unit as DVB-T receiver- it is possible to find only 9 of 14 local free DVB-T programs and meniu is very poor, there is even no program list. All indicates that firmware is customized to primary IPTV reception. As i am not IPTV subsciber, my goal is to use this unit as DVB-T receiver and to stream media from PC using VLC to TV set (using vip1920 as media addapter). i was told that it is possible. But it looks like i must replace Teo customised firmware with suitable for my needs one.
    Browsing internet forums i found link to Your page.
    May be someone could help me to find vip1920 user guide or service manual, or could consult how to reinstall firmware (one, i hope could be suitable, for instance is here: http://www.minefilmer.com/iptv/software-1900).
    Thank You for help.

  24. Berserker says:

    Ok, it’s official I’m just stupid. I tried configuring the router every way I could figure out, disabling DHCP, using dynamic IP, various static IP, when it comes down to it there doesn’t seem to be any easy way to get it set up with the specific IP’s the STB would need to negotiate a connection through it.

    I have decided that when I saw it “working” via wireless on the router it was because the STB had already authenticated and was therefore capable of tapping into the multicast, and as soon as you shut it off you are screwed, it won’t reauthenticate. Perhaps I’ll eventually figure out a solution that lets me do what I want but in the meantime, meh whatever.

  25. Berserker says:

    Eh, here’s what I mean:

    Upstairs, I have the first phone jack – this is where I must plug in the modem/gateway (I have both a Zyxel modem and Thomson wireless gateway, but so as not to confuse you further, I’m working with only the Thomson for now).. My eventual goal here, is to get IPTV available on every PC throughout the house wirelessly, as well as get the STB connected wirelessly downstairs because the TV needs to be in the living room – not where the first phone jack is..

    So step one of my experiment: the Thomson is cabled to LAN port 1 on my PC running Vista. Just plugging the PC only into the Thomson gateway did not give me anything in VLC. I then plug the Motorola set top box’s LAN cable, into LAN port 2 of the PC. I bridge the LAN ports together in Vista. Once I did this the first time, VLC worked. I then turned on the STB, and that worked too, so far so good right?

    I thought, ok. I have another wireless N router. Why can’t I hook that up to the STB downstairs and do the same thing – bridge my wireless card in Vista which is sending data to the router? First I decided that since the PC is sending the IPTV data, I’ll test it by jacking LAN 2 (which was previously to the STB) into the INTERNET port on the N router. Then from a LAN port on the N Router, to the STB. It worked, so next, I unbridged LAN 2 and instead bridged the wireless card as mentioned above. Now effectively if this worked I could move the TV, STB and N Router anywhere in the house and the STB would log in through the router, which would be getting its data from my PC upstairs, which was getting its data from LAN 1 hooked up to the Thomson.

    And it did work. For about 2 minutes, then it stopped. Then VLC stopped working a short while after. So I have no idea why it stopped working, and if it working at all was some fluke, surely there is something I missed that would make it work reliably. For instance I thought that the router, since I had it wired up to the PC first, was getting its DHCP info from that and this remained there for a short time after unplugging it and doing the wireless thing, but then it did its periodic little check and reset to 0.0.0.0 – At which point the tv stopped working. So my next test will be to write down the DHCP info my PC sends to the router, and manually configure the router to keep a permanent IP.

    I may be completely off the mark but since I am no networking whiz this is my only lead as to why it worked but then stopped. I have also never heard of anyone doing what I have done – getting a STB working wirelessly at all. So sometimes perhaps it is unconventional thinking (and perhaps ignorance) that leads to interesting solutions. ;)

  26. fli says:

    I don’t really follow what you’ve done, but bridging your “internet-port” with your “iptv-port” could probably lead to all kinds of weird things.
    If Telia haven’t changed things you’ll get on IPv4-address (via DHCP) on your “internet-port” and your STB will get another one through the “iptv-port”, if they’re bridged the STB could end up without an IP-address.

    Bridging two private LANs behind NAT-routers should be fine though. The problem is that to get an IP-address through the “iptv-port” you need to send a magic value when requesting an IPv4 address, otherwise Telias DHCP server won’t respond.

    When I played with this I simply hooked up a computer directly to the “iptv-port” (no STB at all). I could have bridge a second network interface on that computer with the rest of my LAN (don’t think I ever tried), the problem with this is that clients on the LAN will have two egress/ingress points to the Internet. An already configured multicast stream should work anyway, however there *might* be problems creating a new stream as the IGMP join packet (need to “turn on” the stream) would be sent to your default router which is connected to your “internet-port” and not your “iptv-port”.

    About the encryption, I haven’t investigated it further. I’m still quite sure that the decryption key is obtained the way I described in the post, however figuring out how to get it and which kind of encryption that is used etc is a whole different story.

  27. Berserker says:

    Heh thanks. This is confusing though, and I have to admit I don’t know a WHOLE lot from a networking standpoint especially about how multicasting works.. but I thought I had it all working, I hooked up my D-Link router and plugged the bridged Lan cable into the INTERNET input that usually comes from the modem, and I got data moving to the set top box – it worked, the STB could log in as normal. So then I decided to try bridging the wireless PCI card on my PC, which logged into the D-Link. I disconnected the LAN cable, so there was no chance I was misreading where the data was coming from. The TV had stopped streaming tv and froze on the last frame, and after I bridged the wireless to it, bingo, I was getting tv again. So I thought it had worked.

    THEN everything went to hell and I haven’t been able to get it back since. The tv stopped and the STB refused to log in. Then VLC stopped recieving any streams whatsoever either. When I tried the STB wired again with the previous method it did log in, but I am still getting zip on PC end.

  28. SPKNO says:

    Still no news on the encryption :(

    BTW: Keep it up Berserker :)

  29. Berserker says:

    Further update:

    Not yet tried via the N Router, but I have turned on the STB on the TV connected via connection bridged thru the PC on LAN port 2. At the same time I tried to play on VLC player. As I’m sure you guessed, it does not appear to provide enough bandwidth to handle playing 2 different channels at the same time.

    But here’s the exception! If you want to have the same channel on all recievers in the house, for instance they are all tuned to CANAL+ ACTION, it works fine (they are also completely synced – ok well, like up to 5 frames off sometimes).

  30. Berserker says:

    BTW I figure that it must also be possible to wirelessly bridge with my N router connection, having that downstairs with the STB and TV.. and also hopefully any other PC’s on the N router for instance a laptop with Wi-Fi should be able to get the iptv also.. I will test that soon and if it works I’ll let ya know..

  31. Berserker says:

    I had zero luck getting anything to show up in VLC at all until I bridged my 2 LAN ports, 1 going to internet and the other to the STB. Without even turning the STB on, as soon as I tried 239.16.16.1:5555 in VLC again it immediately showed up. So I tried the other chans in Jesper’s list by copying them into a textfile and creating an m3u. I get just about the same results as he did, but with some differences. For instance I get all the CANAL channels and other channels are in slightly different places or not the same as what he said. I figure it is because Telia are always rearranging things.. So what I plan to do is make a playlist containing all IP’s in the range, which I can periodically check, and comment and uncomment channels in a copy of the file whenever things change so I always have the maximum amount of unscrambled channels in order, and I can also filter out crap I would never watch or want to see like the info channels..

    Would be nice if someone knew of a way to unscramble the others, kehehe.

  32. Desperado says:

    Hi

    I tried to connect to Telia IPTV with VLC this last night, after having connected my IPTV output from the modem, via a hub, to my htpc.
    The result was that I got a scrambled image (even on the non-scrambled pages). Have things changed recently?

    I have been using IPTV from Telia via the STB box for some time, but connected the SVideo out to my HTPC in absence of better solutions. However the image quality is now really getting to me, so I am desperate to find a better solution. (preferably something that would work with Vista’s Media Center).

    Any tips welcomed.
    Thanks.

  33. fli says:

    @Baltasar

    Yeah, 239.0.0.0/8 is a local address space (similar to 192.168.0.0/16) so you’ll need to be connected to Telias network to be able to view them and that requires a subscription with Telias IPTV service. It might be possible to view the unscrambled channels only with a DSL-connection from Telia and a triple-play modem, but that’s purely speculative.

  34. Baltasar says:

    I’m not able to connect to any of these streams with vlc, i even tried check the enable multicaststream in my router options but without any luck. Are these servers down now? changed ipadress or something?

    I also wonder, do I have to have Telia as an ISP to even be able to get on this network? And if so any gateway/proxy to work around this availble perhaps or something even more simple?

    Thanks for your effort in this subject keep going!

  35. fli says:

    @Jesper

    If you would like to get an address from the DHCP server, you’ll first need to capture the Vendor-class-identifier your box sends by sniffing the traffic. Then you’ll need to configure a dhcp client to send this option (this is easy with the ISC dhclient).

  36. fli says:

    @SPKNO

    Sorry, no news on the encryption/scrambled front. I haven’t touched my box in a while.

  37. SPKNO says:

    Any updates?
    I really want to watch encrypted channels (using the new plugin for MediaPortal’s TVServer)

  38. Jesper says:

    Hi!

    Thanks for your research! My settop box is connected via a hub (so that I can have several boxes) and when I tried connecting the computer to the network instead of a settop box I got everything working really quickly. I didn’t get any connection to the DHCP server, but I didn’t care and tried connecting to udp://@239.16.16.1:5555 anyway using VLC, and instantly SVT1 turned up on my computer.

    So I tried every IP address in the range 239.16.16.[1..254] and got the following channels:
    udp://@239.16.16.1:5555 » SVT1
    udp://@239.16.16.2:5555 » SVT2
    udp://@239.16.16.3:5555 » SVT24
    udp://@239.16.16.4:5555 » SVTB
    udp://@239.16.16.17:5555 » SVT2
    udp://@239.16.16.21:5555 » TV4
    udp://@239.16.16.22:5555 » TV4+ (scrambled)
    udp://@239.16.16.23:5555 » TV400 (scrambled)
    udp://@239.16.16.24:5555 » TV4 Film (scrambled)
    udp://@239.16.16.26:5555 » TV4 Fakta (scrambled)
    udp://@239.16.16.27:5555 » TV4 Guld (scrambled)
    udp://@239.16.16.28:5555 » TV4 Komedi (scrambled)
    udp://@239.16.16.29:5555 » TV4 Science Fiction (scrambled)
    udp://@239.16.16.31:5555 » EuroNews (scrambled)
    udp://@239.16.16.32:5555 » CANAL+ First (scrambled)
    udp://@239.16.16.33:5555 » CANAL+ Comedy (scrambled)
    udp://@239.16.16.34:5555 » CANAL+ Hits (scrambled)
    udp://@239.16.16.35:5555 » CANAL+ Sport 1
    udp://@239.16.16.43:5555 » TV-biljett 4
    udp://@239.16.16.44:5555 » TV-biljett 5
    udp://@239.16.16.45:5555 » TV-biljett 1
    udp://@239.16.16.46:5555 » TV-biljett 2
    udp://@239.16.16.47:5555 » TV-biljett 3
    udp://@239.16.16.48:5555 » CANAL+ Action (scrambled)
    udp://@239.16.16.49:5555 » CANAL+ Sport 2 (scrambled)
    udp://@239.16.16.50:5555 » CANAL+ Sport Extra (scrambled)
    udp://@239.16.16.51:5555 » TV3 (scrambled)
    udp://@239.16.16.52:5555 » TV6 (scrambled)
    udp://@239.16.16.53:5555 » Viasat Nature (scrambled)
    udp://@239.16.16.54:5555 » Viasat Sport 1 (scrambled)
    udp://@239.16.16.55:5555 » Viasat Sport 2 (scrambled)
    udp://@239.16.16.56:5555 » Viasat Sport 3 (scrambled)
    udp://@239.16.16.57:5555 » TV8
    udp://@239.16.16.58:5555 » TV1000 (scrambled)
    udp://@239.16.16.59:5555 » TV1000 Nordic
    udp://@239.16.16.60:5555 » TV1000 Action
    udp://@239.16.16.61:5555 » TV1000 Classic
    udp://@239.16.16.62:5555 » Viasat Explorer
    udp://@239.16.16.63:5555 » ??? (scrambled)
    udp://@239.16.16.64:5555 » ??? (Romanian channel?, scrambled)
    udp://@239.16.16.65:5555 » Disney Channel
    udp://@239.16.16.66:5555 » Toon Disney (scrambled)
    udp://@239.16.16.67:5555 » ZTV (scrambled)
    udp://@239.16.16.68:5555 » Nickelodeon (scrambled)
    udp://@239.16.16.69:5555 » TV1000 Family (scrambled)
    udp://@239.16.16.70:5555 » TV1000 Plus One (scrambled)
    udp://@239.16.16.72:5555 » Zone (scrambled)
    udp://@239.16.16.73:5555 » Playhouse Disney (scrambled)
    udp://@239.16.16.74:5555 » Viasat Golf
    udp://@239.16.16.81:5555 » National Geographic Channel (scrambled)
    udp://@239.16.16.82:5555 » History Channel
    udp://@239.16.16.83:5555 » ESPN Classic
    udp://@239.16.16.84:5555 » NASN
    udp://@239.16.16.93:5555 » Animal Planet (scrambled)
    udp://@239.16.16.95:5555 » BBC Prime
    udp://@239.16.16.96:5555 » BBC World (scrambled)
    udp://@239.16.16.98:5555 » CNN (scrambled)
    udp://@239.16.16.100:5555 » Cartoon Network (scrambled)
    udp://@239.16.16.101:5555 » Discovery Channel (scrambled)
    udp://@239.16.16.102:5555 » Discovery World (scrambled)
    udp://@239.16.16.103:5555 » Discovery Science (scrambled)
    udp://@239.16.16.104:5555 » Discovery Travel & Living (scrambled)
    udp://@239.16.16.106:5555 » Eurosport (scrambled)
    udp://@239.16.16.107:5555 » Eurosport 2
    udp://@239.16.16.109:5555 » Travel (scrambled)
    udp://@239.16.16.110:5555 » Kanal 5 (scrambled)
    udp://@239.16.16.111:5555 » MTV (scrambled)
    udp://@239.16.16.112:5555 » Kanal 9 (scrambled)
    udp://@239.16.16.113:5555 » Nickelodeon (scrambled)
    udp://@239.16.16.114:5555 » Silver (scrambled)
    udp://@239.16.16.115:5555 » Showtime (scrambled)
    udp://@239.16.16.116:5555 » ??? (scrambled)
    udp://@239.16.16.117:5555 » Voice (scrambled)
    udp://@239.16.16.119:5555 » Aftonbladet TV7 (scrambled)
    udp://@239.16.16.120:5555 » VH1 (scrambled)
    udp://@239.16.16.122:5555 » TV4 Sport (scrambled)
    udp://@239.16.16.164:5555 » NT24
    udp://@239.16.16.166:5555 » Kanal Lokal Malmö
    udp://@239.16.16.167:5555 » Kanal Lokal Göteborg (scrambled)
    udp://@239.16.16.168:5555 » Kanal Lokal Östergötland
    udp://@239.16.16.169:5555 » Kanal Lokal Skåne
    udp://@239.16.16.172:5555 » TV Finland
    udp://@239.16.16.177:5555 » DR1 (scrambled)
    udp://@239.16.16.178:5555 » DR2 (scrambled)
    udp://@239.16.16.242:5555 » Musik (audio)
    udp://@239.16.16.243:5555 » Musik (audio)
    udp://@239.16.16.244:5555 » Musik (audio)
    udp://@239.16.16.245:5555 » Musik (audio)
    udp://@239.16.16.252:5555 » TV3 (scrambled)

    In case anyone wants them…

    It’s especially interesting that some of the channels that I do not normally have were unscrambled, whereas some of the channels that I do have were scrambled.

    And it’s no problem watching several channels simultaneously using VLC on my computer. I like it!

    /Jesper

  39. SPKNO says:

    Finally some progress!

    I have a IPTV myself, and same goal as you.

    Currently using Motorola VIP1960 (DVR w/160GB + usb <- not in use).

    Living in Norway.

    Will monitor your site. Thanks for the hard work so far!

  40. julian gardner says:

    i write software for settop boxes and i was looking to convert one of out pvr to a ip-pvr, so thanks for all the hard work, i was going to start looking but you have given me a lot of info to start my home project.

  41.