Tellstick Net and ZNet

The Telldus Tellstick products are excellent for hacking home automation geeks. They work with many 433Mhz devices, even cheap chinese ones and at comes at a moderate price. And the new generation Znet devices works with Z-Wave as well.

But the documentation is poor. Or maybe everything can be found on the wiki, but I cannot. So I'll put some of my findings here.

Getting local sensor data from the Tellstick Net

Since firmware version 17 you can get local "access" to the Tellstick Net device. The protocol page does not outline any thing more than how to discover the device and how to send data to it.

In fact, you don't even have to ask for the data. The device will send a broadcast message whenever it gets a signal from a sensor. You can listen to the broadcasts using this command.

sudo tcpdump -n -X "src "

The resulting message looks something like this

20:11:40.159871 IP xxx.xxx.xxx.xxx.4098 > 0.0.0.0.0: UDP, length 81
 0x0000:  4500 006d 1251 0000 6411 39d6 0a00 005a  E..m.Q..d.9....Z
 0x0010:  0000 0000 1002 0000 0059 0000 373a 5261  .........Y..7:Ra
 0x0020:  7744 6174 6168 353a 636c 6173 7336 3a73  wDatah5:class6:s
 0x0030:  656e 736f 7238 3a70 726f 746f 636f 6c36  ensor8:protocol6
 0x0040:  3a6f 7265 676f 6e35 3a6d 6f64 656c 6931  :oregon5:modeli1
 0x0050:  4132 4473 343a 6461 7461 6934 3046 3339  A2Ds4:datai40F39
 0x0060:  3532 3438 3034 3434 4139 3273 73         52480444A92ss

The data string:

7:RawDatah5:class6:sensor8:protocol6:oregon5:modeli1A2Ds4:datai40F3952480444A92ss

Can then be transcribed to JSON using the instructions here.

RawData {
 class: sensor,
 protocol: oregon,
 model: 1A2D,
 data: 40F3952480444A92
}

Now comes the hard part, decoding the data byte string.

The Telldus Tellstick products are excellent for hacking home automation geeks. They work with many 433Mhz devices, even cheap chinese ones and at comes at a moderate price. And the new generation Znet devices works with Z-Wave as well.

But the documentation is poor. Or maybe everything can be found on the wiki, but I cannot. So I'll put some of my findings here.

Getting local sensor data from the Tellstick Net

Since firmware version 17 you can get local "access" to the Tellstick Net device. The protocol page does not outline any thing more than how to discover the device and how to send data to it.

In fact, you don't even have to ask for the data. The device will send a broadcast message whenever it gets a signal from a sensor. You can listen to the broadcasts using this command.

sudo tcpdump -n -X "src [tellstick ip]"

The resulting message looks something like this

20:11:40.159871 IP xxx.xxx.xxx.xxx.4098 > 0.0.0.0.0: UDP, length 81
 0x0000:  4500 006d 1251 0000 6411 39d6 0a00 005a  E..m.Q..d.9....Z
 0x0010:  0000 0000 1002 0000 0059 0000 373a 5261  .........Y..7:Ra
 0x0020:  7744 6174 6168 353a 636c 6173 7336 3a73  wDatah5:class6:s
 0x0030:  656e 736f 7238 3a70 726f 746f 636f 6c36  ensor8:protocol6
 0x0040:  3a6f 7265 676f 6e35 3a6d 6f64 656c 6931  :oregon5:modeli1
 0x0050:  4132 4473 343a 6461 7461 6934 3046 3339  A2Ds4:datai40F39
 0x0060:  3532 3438 3034 3434 4139 3273 73         52480444A92ss

The data string:

7:RawDatah5:class6:sensor8:protocol6:oregon5:modeli1A2Ds4:datai40F3952480444A92ss

Can then be transcribed to JSON using the instructions here.

RawData {
 class: sensor,
 protocol: oregon,
 model: 1A2D,
 data: 40F3952480444A92
}

Now comes the hard part, decoding the data byte string.

Clicking a button on a code switch will come out like this.

21:54:03.254971 IP xxx.xxx.xxx.xxx.4098 > 0.0.0.0.0: UDP, length 60
 0x0000:  4500 0058 1ca0 0000 6411 2f9c 0a00 005a  E..X....d./....Z
 0x0010:  0000 0000 1002 0000 0044 0000 373a 5261  .........D..7:Ra
 0x0020:  7744 6174 6168 383a 7072 6f74 6f63 6f6c  wDatah8:protocol
 0x0030:  373a 6172 6374 6563 6835 3a6d 6f64 656c  7:arctech5:model
 0x0040:  413a 636f 6465 7377 6974 6368 343a 6461  A:codeswitch4:da
 0x0050:  7461 6945 3332 7373                      taiE32ss

And decoded

RawData {
 protocol: arctech,
 model: codeswitch,
 data: E32
}

E32 is reported when clicking "ON" and 632 when clicking "OFF". The "32" part changes with the code which is configured on the back side of the switch. Furthermore I have other switches which will report protocol archtech and model selflearning and one that only reports protocol everflourish.