Skip to content

Finding an IntelliCenter controller

Jump to bottom
parnic edited this page Jan 4, 2025 · 5 revisions

IntelliCenter controllers respond to mDNS queries. That is, a multicast UDP query to 224.0.0.251:5353 following the mDNS packet format.

Specifically, that means (all in big-endian):

  • Transaction ID: 0x0000
  • Flags: 0x0000
  • Questions: 0x0001
  • All RRs: 0x0000
  • Queries:
    • 1:
      • Name: _http._tcp.local (dots are not part of the query, only delimiters here; each segment is prefixed by the length of the segment and the entire string ends with a 0 octet, so [05]_http[04]_tcp[05]local[00])
      • Type: PTR (0x000c)
      • Class: IN (0x0001)

The unit will respond with a unicast packet. For my local system, that packet contains (for an IPv4 system):

  • Transaction ID: 0x0000
  • Flags: 0x8400 (Breaking down the bits here, that means 1 0000 1 0 0 0 0 0 0 0000, or 1: "is response", 0000: "opcode 0", 1: "is authority", 0: "not truncated", 0: "no recursion desired", 0: "no recursion available", 0: reserved 0 bit, 0: "answer is not authenticated", 0: "non-authenticated data is unaccaptable" (🤷), 0000: "no error")
  • Questions: 0x0000
    • For some queries, the issued Question will be included as part of the response. If this value is > 0, you'll need to process/skip over the questions after reading RRs and before processing answers. Question segments follow the format laid out above (Name, Type, Class).
  • Answer RRs: 0x0004
  • Authority RRs: 0x0000
  • Additional RRs: 0x0000
  • Answers:
    • 1:
      • Name: _http._tcp.local
      • Type: 0x000c
      • Class: 0x0001
      • TTL: 0x00001194
      • Data: Pentair -i -nHome[._http._tcp.local] (Length: 20, where the section in []s is a pointer to the name earlier in the packet)
    • 2:
      • Name: [Pentair -i -nHome[._http._tcp.local]]
      • Type: 0x0010 (TXT)
      • Class: 0x8001
      • TTL: 0x00001194
      • Data: (Length: 1, just a 00 octet)
    • 3:
      • Name: [Pentair -i -nHome[._http._tcp.local]]
      • Type: 0x0021 (SRV)
      • Class: 0x8001
      • TTL: 0x00000078
      • Data: pentair[.local]:6680
        • This is represented as: Data length: 0x0010 which consists of Priority: 0x0000, Weight: 0x0000, Port: 0x1a18 (6680), Target: pentair[.local] ([.local] is a pointer; Port here is the port for the websocket connection, 6681 is the controller's telnet port)
    • 4:
      • Name: [pentair[.local]]
      • Type: 0x0001 (A)
      • Class: 0x8001
      • TTL: 0x00000078
      • Data: 10.0.0.41 (which is the IP of your controller, represented by bytes: 00 04 0a 00 00 29 - 0004 is the length, then each octet of the address)

For decoding the Answers name pointers, see https://mislove.org/teaching/cs4700/spring11/handouts/project1-primer.pdf pages 4 and 5.

Search terms: pentair intellicenter api documentation locate find search query broadcast controller device control panel

Clone this wiki locally