Hi, first of all thanks for maintaining this library — it's been a huge help figuring out the plain HTTP API.
I'm trying to control the stereo balance setting (the one accessible in KEF Connect app under the speaker's EQ/sound settings) programmatically, ideally to integrate with Home Assistant. My speaker model is LSX II LT.
What I've tried:
Confirmed the plain HTTP API on port 80 works fine for reads/writes I already know about (player:volume, settings:/mediaPlayer/mute, etc.) — POST to /api/setData with JSON body works as expected for this model.
Brute-forced ~370 candidate paths on port 80 combining common prefixes (settings:/kef/host/, settings:/kef/play/, settings:/mediaPlayer/, kef:, player:) with balance/eq-related terms.
Found one existing path: settings:/mediaPlayer/balance (type double_, default value 0). However, changing balance in the KEF Connect app does not change this value — it stays at 0 even when the app's balance slider is moved all the way to one side (confirmed both by polling the value and by ear — audio does shift to one speaker). So this path appears to exist but isn't the one the app actually writes to.
Captured network traffic (via tcpdump on the AP, phone and speaker on different APs so traffic wasn't hairpinned in the radio) between the KEF Connect iOS app and the speaker. Found the app communicates over TCP port 4430 with what looks like a TLS/encrypted channel (application data records), separate from the plain port 80 API. This is presumably where the balance write actually happens.
Tried MITM'ing the app via mitmproxy (both explicit proxy and WireGuard transparent mode) to inspect this encrypted traffic, but ran into the app failing to reach the equalizer/balance screen when routed through the tunnel (possibly certificate pinning specific to this channel, or a Bonjour/mDNS multicast discovery step failing over the tunnel — wasn't able to isolate which).
Question:
Do you know the correct path for balance (maybe it's namespaced differently, e.g. under kef: rather than settings:), or is balance/EQ control on newer models indeed routed through this encrypted port 4430 channel? If the latter, do you have any insight into how that channel is authenticated/encrypted, or plans to support it in pykefcontrol?
Happy to help test on my LSX II LT if useful (packet captures, firmware version, etc.)
Hi, first of all thanks for maintaining this library — it's been a huge help figuring out the plain HTTP API.
I'm trying to control the stereo balance setting (the one accessible in KEF Connect app under the speaker's EQ/sound settings) programmatically, ideally to integrate with Home Assistant. My speaker model is LSX II LT.
What I've tried:
Confirmed the plain HTTP API on port 80 works fine for reads/writes I already know about (player:volume, settings:/mediaPlayer/mute, etc.) — POST to /api/setData with JSON body works as expected for this model.
Brute-forced ~370 candidate paths on port 80 combining common prefixes (settings:/kef/host/, settings:/kef/play/, settings:/mediaPlayer/, kef:, player:) with balance/eq-related terms.
Found one existing path: settings:/mediaPlayer/balance (type double_, default value 0). However, changing balance in the KEF Connect app does not change this value — it stays at 0 even when the app's balance slider is moved all the way to one side (confirmed both by polling the value and by ear — audio does shift to one speaker). So this path appears to exist but isn't the one the app actually writes to.
Captured network traffic (via tcpdump on the AP, phone and speaker on different APs so traffic wasn't hairpinned in the radio) between the KEF Connect iOS app and the speaker. Found the app communicates over TCP port 4430 with what looks like a TLS/encrypted channel (application data records), separate from the plain port 80 API. This is presumably where the balance write actually happens.
Tried MITM'ing the app via mitmproxy (both explicit proxy and WireGuard transparent mode) to inspect this encrypted traffic, but ran into the app failing to reach the equalizer/balance screen when routed through the tunnel (possibly certificate pinning specific to this channel, or a Bonjour/mDNS multicast discovery step failing over the tunnel — wasn't able to isolate which).
Question:
Do you know the correct path for balance (maybe it's namespaced differently, e.g. under kef: rather than settings:), or is balance/EQ control on newer models indeed routed through this encrypted port 4430 channel? If the latter, do you have any insight into how that channel is authenticated/encrypted, or plans to support it in pykefcontrol?
Happy to help test on my LSX II LT if useful (packet captures, firmware version, etc.)