No subject

to) an (unknown) ip address, port 7534. That doesn't really help much,
especially as we have no idea what's in that stream.

IPTV streams have a *destination* in the special multicast range of
224.0.0.0 to 239.255.255.255, and a source that can be any ip address.

When the set-top box first starts up, it will use DHCP to request an
IP address from the network, which will be answered by the router
(Probably forwarding from the DSLAM), giving it a temporary IP address
and a multicast location of a tftp server. When the box has it's
temporary IP address, it listens on the multicast ip/port it has been
given, which constantly sends out a firmware image. The box downloads
this firmware image, loads it into memory, and reboots from that
image, using DHCP again to get another IP address (Usually identifying
itself with a few extra fields in the DHCP request). The router/DSLAM
then gives it it's working IP address, which will be in a private
range (Sasktel uses 10.110.3.x). Then the box uses Multicast HTTP to
download the initial display page and the channels list (The on-screen
menus are all HTML pages and images).

To emulate the set-top box, you can use Wireshark to monitor the box
boot sequence, looking especially at the DHCP requests it sends, and
configuring DHClient to do the same thing.

I know that Sasktel protects some channels by having sections of the
stream blank (Literally, FF FF FF FF), which is then filled in from
another source that I've yet to find (Not that I'm looking
particularly hard for it, I don't watch anything on the protected
channels anyway). I don't know how or what AT&T uses, and would be
very interested to know what they're doing.
--=20
Robert "Anaerin" Johnston