Platform index / Wireless microphone system
Shure QLXD4
A receiver whose documented control interface is plain ASCII on a TCP port — and which, mounted on a Yamaha console, does not use it. The console-mount path is standards-based ACN, discovered on a multicast group one digit off the registered one and driven entirely by subscriptions.
The load-bearing finding. A QLX-D mounted on a Yamaha console speaks ANSI E1.17 ACN — SLPv2 discovery, SDT sessions, DMP properties — and not one byte of the Command Strings interface Shure documents. Both parties join each other, the console subscribes to twelve properties, and the receiver then pushes changes at about 8 Hz. The console never polls.
Verdict. Two interfaces, and the interesting one is the one nobody documents. Shure publish Command Strings — plain ASCII on TCP 2202 — and a QLX-D mounted on a Yamaha console does not send a byte of it: the console-mount path is standards-based ACN, with SLPv2 discovery on a group one digit off the registered one, symmetric SDT channels where both ends join each other, and DMP subscriptions that make the console a listener rather than a poller. Almost everything a monitoring tool wants is on that path and confirmed against ground truth — model, name, channel, frequency, RF, battery, and the AF gain the console writes. What is not on it, as far as this work could establish, is audio level: the obvious candidate property drifts continuously with no carrier at all and no transmitter powered, which is not what an audio meter does. The honest summary is a well-mapped telemetry path with one hole in it, and a lost capture standing between it and an active client.
Method
Passive packet capture of a real QLXD4 mounted on a real QL1 on our lab network, across four sessions: the receiver mounted and idle, its AF output level driven from the console's own encoder, a power-cycle spanning the full session setup, and a run with a transmitter switched on partway. Decoded with a hand-written parser checked byte for byte against Wireshark's own ACN dissector, which decodes these packets natively — where the two disagreed on vector names, Wireshark won. No firmware was analysed, the receiver was never opened, and not one packet was ever transmitted to it.
Artifacts examined
- Four captures from a mirrored port: 181 s of the receiver mounted and idle, 40 s with the AF output level swept from the console, 356 s with a transmitter switched on partway, and 160 s spanning a receiver power-cycle — which is the one that is lost, see the traps
- The receiver's own SLPv2 advertisement, repeated every two seconds: component id, fixed model name, user-assigned name, the services it offers, and where to open a session
- Ground truth from the receiver's front panel, read at known moments — the battery scale was pinned by removing and refitting cells and comparing against the display
No manufacturer firmware, binaries or documentation are redistributed here. Artifacts are referenced by name and version only. See the method and legal statement for the basis on which this analysis was performed and the boundaries it observes.
Hardware architecture
| Item | Finding | Confidence |
|---|---|---|
| What was examined | Nothing inside the receiver. No firmware was obtained, no update package was opened, no part number was read and the unit was never taken apart. Everything on this page is the behaviour of the box on a network — a deliberate limit, not an omission | Unknown |
| The unit under observation | A QLXD4 half-rack receiver on 606.700 MHz, named House 1 with its channel named Head 6, mounted on a Yamaha QL1. Both devices sat on IPv4 link-local addresses with no DHCP server present, and there was no Dante audio between them — the receiver was on the network purely as a control device | Measured |
| The published figures used as ground truth | The AF output level range (−18 … +42 dB) and the five-segment battery display are Shure's own published specifications, and both were used to check the decoding rather than derived from it: the observed level sweep clamped exactly at the documented minimum, and the battery property's 0–5 scale matches the panel's five segments | Public |
Software architecture
| Item | Finding | Confidence |
|---|---|---|
| Discovery — SLPv2, one digit off | Every two seconds each device multicasts an SLPv2 attribute reply to 239.255.254.253:8427 — both the group and the port are one digit off the registered SLP values (239.255.255.253:427), so a standard SLP library pointed at the standard group finds nothing and reports no error. The advertisement carries the model name as a fixed string, the user-assigned name, a component id whose low bytes are the device MAC, and the address and device-class id needed to open a session. Passive listening on that group enumerates model, name and address for every ACN-speaking Shure receiver on the segment, with no connection made | Measured |
| The device description is advertised and not served | Every advertisement points at a TFTP URL for the receiver's DDL — ACN's machine-readable device description, which would hand over the property map for free. There is no TFTP server on the receiver. Requests for the advertised name, for the device-class id in upper and lower case, and for the model name drew no response of any kind — not even the error a running server sends for a missing file | Measured |
| Transport — symmetric SDT sessions | Sessions run on UDP 57383, source and destination, with the console also multicasting into the E1.17 SDT range. Each party owns a channel and both parties join each other: this is a symmetric pair of channels, not a client connecting to a server. Steady state uses only the unreliable wrapper carrying payload, with acknowledgements coming back; session setup uses the reliable path | Measured |
| Session setup | Captured across a receiver power-cycle and about 80 ms end to end: a join and its accept in each direction, a connect naming DMP as the protocol, six subscriptions and their accepts, nine property reads and their replies, then a second batch of six subscriptions. Teardown on power-off is leave, leaving, disconnect, disconnecting | Measured |
| Steady state is push, at about 8 Hz | After setup the receiver pushes unsolicited events carrying whichever subscribed properties changed, and the console never polls. Twelve properties are subscribed in two batches of six; addresses are four-byte absolute and non-virtual, and strings are length-prefixed with a 16-bit total that includes the two length bytes and no terminator | Measured |
| What the properties are | Confirmed against ground truth: model name, device name, channel name, AF output level, frequency in kHz, RF level in dBm, an RF meter of 0–5 segments, and battery bars of 0–5 with −1 as a sentinel. Two further properties move together and are not what they first appeared to be; two more were subscribed and emitted no event at all across every capture | Measured |
| The one writable property | AF output level is the only property observed being written. The console sets it, the receiver echoes an event carrying the same value 10–25 ms later, and answers reads with a reply. Confirmed by 37 sets sweeping the console's own encoder across −18 … +40: signed 8-bit, plain dB, no scaling, clamping hard at the documented minimum. A later mount read back exactly where the previous session's sweep had left it | Measured |
| Battery, and two behaviours to build around | The battery property was pinned against the receiver's own front panel — 2 bars held across ten consecutive samples, the sentinel with the cells removed, and 5 immediately on link with fresh cells. Two behaviours matter for anything reading it: the first sample after a link comes up is a transient that does not match the panel and settles within about four seconds, and the sentinel means no recent data, not no carrier — on a dropout the value holds its last reading and only later falls to it | Measured |
| RF | RF level reads a flat −50 dBm with no carrier — a floor rather than a measurement — and −19 … −35 dBm with a transmitter on. The 0–5 segment meter is 0 with no carrier and 1–5 with one, moving in lockstep with it | Measured |
Update path & security model
| Item | Finding | Confidence |
|---|---|---|
| Nothing in the observed exchange carries a credential | No credential appears anywhere in discovery or in session setup: a channel is offered and accepted, a connect names a protocol, and subscriptions follow. Whether the receiver would accept a session from anything other than the console it is mounted on is not known — nothing was ever transmitted to it, so this is the shape of the exchange and not a tested claim | Measured |
| Network posture | Discovery is multicast and readable from anywhere on the segment; telemetry is unicast to the console, so on an ordinary switch port a third-party listener sees the receiver announce itself and nothing more. Everything on this page past discovery needed a mirrored port, which is also the honest limit on what any passive tool built from it can do | Measured |
These rows describe how a platform validates a firmware image, because that is a structural fact about its architecture. They are not a vulnerability disclosure and no exploit, bypass or circumvention technique is published here. Licensing and entitlement mechanisms are out of scope throughout — seescope boundaries.
What is programmable
- 1Command Strings on TCP 2202 — the documented interface
Shure publish it, it is plain ASCII, and it remains the supported way to talk to these receivers. Nothing here changes that: the ACN path is what a console mount actually uses, not a better way to control a receiver.
- 2Passive ACN telemetry, with a mirrored port
Model, name, channel name, frequency, RF level, RF bars, battery bars and AF gain all arrive without transmitting a single packet — which is the safest possible way to instrument a rig somebody else is operating. The cost is port mirroring, and that is the whole cost.
- 3An active ACN client — blocked, and for one reason
It needs the session handshake at byte level, and the only capture that contained one is gone. Re-recording a receiver power-cycling while mounted unblocks it; nothing else is missing.
Traps
Mistakes this analysis actually made, or came close to making. They are recorded because each one produces a plausible-looking wrong answer rather than an obvious failure.
- The capture containing the session handshake is gone. The 160-second power-cycle recording is the only one that held a join, a connect or a subscribe, and it is neither in the capture archive nor on the machine. The sequence survives because it was written down as prose at the time; the byte-level field layouts did not, and without them nothing can open its own session. The lesson is the boring one: the capture is the evidence, and prose about it is not a substitute.
- Calling the property that moves "the audio meter". With a carrier present it swings the way a meter would, which is exactly why the first reading of it said audio level. A later capture with no carrier at all — RF pinned at its floor, no transmitter powered — showed it still drifting continuously, which a receiver-side audio meter on a silent receiver does not do. It was demoted rather than quietly kept, and it still has no unit, because no calibrated signal was ever injected.
- Reading a battery trend that was not there. One run appeared to show the level sliding over 30 seconds. The carrier was in fact dropping repeatedly, so the acquisition transient was being seen over and over and read as a downward trend. Ground truth was the front panel, not the graph.
- Pointing a standard SLP library at the standard group. Both the multicast address and the port are one digit off the registered values, so the correct tool, correctly configured, finds nothing at all and reports no error.
- Believing the device-description URL. It is advertised in every announcement and there is no server behind it — not even one that answers with an error.
Open questions
- Audio level. Command Strings gives a figure for it and the ACN property that looked like its equivalent does not hold up. It may be one of the subscribed-but-silent addresses, or not exposed on this path at all.
- Battery run time. Two subscribed properties emitted no event across every capture, holding a sentinel throughout — consistent with a transmitter running alkaline cells, since there is no run-time estimate to report without a Shure rechargeable. It needs a run with an SB900-series pack fitted.
- Whether a QLX-D serves Command Strings and ACN simultaneously. These captures cannot say: Wireless Workbench was never running, so the absence of port-2202 traffic proves nothing either way.
- Whether ULX-D and Axient Digital share the property map. Both mount on Yamaha consoles the same way, and if the address space is common then one decoder covers the range. Untested, and worth knowing before anyone writes that decoder.
Status of this entry. Substantial findings recorded, but whole subsystems remain unexamined. Rows labelled Measured were read off a running unit; everything else on this page is derived from files and has not been checked against hardware.