![\"Front](\"https:\/\/www.fabidouille.com\/wp-content\/uploads\/2026\/09\/front.jpg\")
A dead port? No, it was waiting<\/h2>\n
I connected the Kodi Pi (LibreELEC) directly to the receiver. Link light on, nothing else.<\/p>\n LibreELEC has no tcpdump, so I wrote a small Python sniffer:<\/p>\n The receiver was asking for an IP address. On a direct cable, nobody answers. It was probably asking since 2009.<\/p>\n The fix: a 60-line DHCP server in Python on the Pi, only for Pioneer’s MAC prefix. The receiver got its address.<\/p>\n The web page is a complete remote control. The HTTP server says There is even a function called Telnet gives the same commands, directly: First test, one that can be undone (I like this amp): volume 104 \u2192 101 \u2192 104, checked each time. It works. Ouf.<\/p>\n A small script asks Kodi every half second:<\/p>\n One problem: LibreELEC’s network manager also wants the port, and sometimes the receiver ends up with a link-local address. My script just finds the address it has.<\/p>\n There is no password: anyone on that cable can control the amp. That is why it is on its own cable, not on the home network.<\/p>\n Movie night is now one button.<\/p>\n An AI coding agent (Claude Code) did the network work through SSH on the Kodi Pi: the AF_PACKET sniffer, the 60-line DHCP server with the MAC filter, the port scan, reading the receiver’s JavaScript, and the Kodi bridge. My part: plug the cable, and stay next to the amp for the first volume test.<\/p>\n Note: I don’t have much time for the blog these days, so this post was written with the help of an AI, from my own notes, then read and corrected by me. Better to share the content this way than not at all.<\/p>\n","protected":false},"excerpt":{"rendered":" Every forum says the Ethernet port of a 2009 Pioneer receiver is useless. It was just waiting for an IP address, with telnet and a web remote behind it.<\/p>\n","protected":false},"author":0,"featured_media":548,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-550","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-non-classe"],"_links":{"self":[{"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=\/wp\/v2\/posts\/550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=550"}],"version-history":[{"count":4,"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=\/wp\/v2\/posts\/550\/revisions"}],"predecessor-version":[{"id":582,"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=\/wp\/v2\/posts\/550\/revisions\/582"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=\/wp\/v2\/media\/548"}],"wp:attachment":[{"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fabidouille.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Rear](\"https:\/\/www.fabidouille.com\/wp-content\/uploads\/2026\/09\/lan-port.jpg\")
[ 23.4s] [the AVR] UDP 68->67 [DHCP DISCOVER]\n[ 31.0s] [the AVR] UDP 68->67 [DHCP DISCOVER] <- every ~18s<\/code><\/pre>\nWhat is behind<\/h2>\n
OPEN 23\/tcp <- telnet\nOPEN 80\/tcp <- web server\nOPEN 8102\/tcp <- unknown<\/code><\/pre>\nServer: Nu-OS\/1.13<\/code>, and the page is called \u00ab\u00a0Pioneer Web Control System\u00a0\u00bb. Its JavaScript (js\/common.js<\/code>) shows how each button works:<\/p>\na = \"EventHandler.asp?WebToHostItem=\";\nb = encodeURIComponent(query); \/\/ \"BPO\", \"VU\", \"19ZT\"\nreq.open(\"get\", c, true); \/\/ GET \/EventHandler.asp?WebToHostItem=BPO<\/code><\/pre>\nwebCon.http.sndRs232cEvent(query)<\/code>. The state comes back as JSON from GET \/StatusHandler.asp<\/code>. So each button just sends an RS-232 command over HTTP:<\/p>\n\n
BPO<\/code> on, BPF<\/code> off<\/li>\nVU<\/code> up, VD<\/code> down<\/li>\nMO<\/code> \/ MF<\/code><\/li>\n19ZT<\/code> (my theatre input)<\/li>\n0001SR<\/code> stereo, 0010SR<\/code> standard surround, 0050SR<\/code> Home THX<\/li>\n?AST<\/code>, ?M<\/code>…<\/li>\n<\/ul>\n?AST<\/code> answers AST0302\u2026<\/code>, ?M<\/code> answers MUT1<\/code>. No login, no session, ASCII ending with CR. Like in 2009.<\/p>\nKodi controls the amp<\/h2>\n
\n
VU<\/code> \/ VD<\/code> on the amp, then Kodi’s own volume goes back to 100: the amp is the only volume button. Tested: Kodi 100 \u2192 90 moved the amp from 104 to 101.<\/li>\nMO<\/code> \/ MF<\/code><\/li>\ncurl -s \"http:\/\/<avr>\/EventHandler.asp?WebToHostItem=BPO\" # power on\ncurl -s \"http:\/\/<avr>\/EventHandler.asp?WebToHostItem=19ZT\" # theatre input\nprintf '?AST\\r' | nc -w 3 <avr> 23 # raw RS-232 query<\/code><\/pre>\nHow AI was used<\/h2>\n