Every forum says the Ethernet port of my 2009 Pioneer SC-LX73 receiver is only for internet radio and firmware updates. Internet radio on this model has been dead for years, so: a dead port.

I wanted Kodi to switch on the amp for movie night. So before giving up, I plugged in a cable and looked at what goes on the wire.

A dead port? No, it was waiting

I connected the Kodi Pi (LibreELEC) directly to the receiver. Link light on, nothing else.

LibreELEC has no tcpdump, so I wrote a small Python sniffer:

[ 23.4s] [the AVR]  UDP 68->67 [DHCP DISCOVER]
[ 31.0s] [the AVR]  UDP 68->67 [DHCP DISCOVER]   <- every ~18s

The receiver was asking for an IP address. On a direct cable, nobody answers. It was probably asking since 2009.

The fix: a 60-line DHCP server in Python on the Pi, only for Pioneer’s MAC prefix. The receiver got its address.

What is behind

OPEN  23/tcp     <- telnet
OPEN  80/tcp     <- web server
OPEN  8102/tcp   <- unknown

The web page is a complete remote control. The HTTP server says Server: Nu-OS/1.13, and the page is called « Pioneer Web Control System ». Its JavaScript (js/common.js) shows how each button works:

a = "EventHandler.asp?WebToHostItem=";
b = encodeURIComponent(query);           // "BPO", "VU", "19ZT"
req.open("get", c, true);                // GET /EventHandler.asp?WebToHostItem=BPO

There is even a function called webCon.http.sndRs232cEvent(query). The state comes back as JSON from GET /StatusHandler.asp. So each button just sends an RS-232 command over HTTP:

• Power: BPO on, BPF off
• Volume: VU up, VD down
• Mute: MO / MF
• Input: 19ZT (my theatre input)
• Listening mode: 0001SR stereo, 0010SR standard surround, 0050SR Home THX
• Status: ?AST, ?M…

Telnet gives the same commands, directly: ?AST answers AST0302…, ?M answers MUT1. No login, no session, ASCII ending with CR. Like in 2009.

First test, one that can be undone (I like this amp): volume 104 → 101 → 104, checked each time. It works. Ouf.

Kodi controls the amp

A small script asks Kodi every half second:

• Kodi volume → VU / VD on the amp, then Kodi’s own volume goes back to 100: the amp is the only volume button. Tested: Kodi 100 → 90 moved the amp from 104 to 101.
• Kodi mute → MO / MF
• Playback starts → power on + input 19

curl -s "http://<avr>/EventHandler.asp?WebToHostItem=BPO"     # power on
curl -s "http://<avr>/EventHandler.asp?WebToHostItem=19ZT"    # theatre input
printf '?AST\r' | nc -w 3 <avr> 23                            # raw RS-232 query

One problem: LibreELEC’s network manager also wants the port, and sometimes the receiver ends up with a link-local address. My script just finds the address it has.

There is no password: anyone on that cable can control the amp. That is why it is on its own cable, not on the home network.

Movie night is now one button.

How AI was used

An AI coding agent (Claude Code) did the network work through SSH on the Kodi Pi: the AF_PACKET sniffer, the 60-line DHCP server with the MAC filter, the port scan, reading the receiver’s JavaScript, and the Kodi bridge. My part: plug the cable, and stay next to the amp for the first volume test.

Note: I don’t have much time for the blog these days, so this post was written with the help of an AI, from my own notes, then read and corrected by me. Better to share the content this way than not at all.