RTSP

Overview

The AirPlay 2 sender communicates with receivers through the RTSP protocol defined in RFC2326. However, Apple RTSP implementation has been customized to behave similarly to both an RTSP and a HTTP server.

The request-URI ends with RTSP/1.0 e.g. GET /info RTSP/1.0.

An RTSP HTTP-like request can have the following headers:

GET /info RTSP/1.0
X-Apple-ProtocolVersion: 1
Content-Length: 70
Content-Type: application/x-apple-binary-plist
CSeq: 0
DACP-ID: 93842EE68464F5B9
Active-Remote: 1149412352
User-Agent: AirPlay/409.16

Instead, a standard RTSP request can have the following headers:

SETUP rtsp://192.168.1.12/15566703517752576217 RTSP/1.0
Content-Length: 819
Content-Type: application/x-apple-binary-plist
CSeq: 1
DACP-ID: 93842EE68464F5B9
Active-Remote: 1149412352
User-Agent: AirPlay/409.16

RTSP headers

Header	Description
X-Apple-ProtocolVersion	Protocol version
Content-Length	Length of the content/body after the headers
Content-Type	Type of content
CSeq	Specifies the sequence number for an RTSP request/response pair. Receiver must reply with the same CSeq. Incremented by one in every request.
DACP-ID	64-bit value identifying the DACP server (remote control of the sender)
Active-Remote	Authentication token for the DACP server (remote control of the sender)
RTP-Info	Sent with `FLUSH` for RTP synchronization

RTSP requests

The receiver must implement the endpoints reported in the following subsections. Their behavior could be different depending on the content type.

`GET /info`

Sender needs info from the receiver

Content-type: application/x-apple-binary-plist

The sender asks for specific info. The request body is encoded in a binary plist. Usually the sender initiates the communication demanding the txtAirPlay qualifier of the receiver with the following binary plist:

{'qualifier': ['txtAirPlay']}

This requests actually asks the TXT record of the _airplay._tcp mDNS service as a binary plist. This also suggests that a receiver can have a minimal TXT mDNS record and then declare further information at this stage.

server -> client ↕

GET /info RTSP/1.0
X-Apple-ProtocolVersion: 1
Content-Length: 70
Content-Type: application/x-apple-binary-plist
CSeq: 0
DACP-ID: 13C27320A1CDFBC4
Active-Remote: 144558050
User-Agent: AirPlay/409.16

// {'qualifier': ['txtAirPlay']}
00000000: 62 70 6C 69 73 74 30 30  D1 01 02 59 71 75 61 6C  bplist00...Yqual
00000010: 69 66 69 65 72 A1 03 5A  74 78 74 41 69 72 50 6C  ifier..ZtxtAirPl
00000020: 61 79 08 0B 15 17 00 00  00 00 00 00 01 01 00 00  ay..............
00000030: 00 00 00 00 00 04 00 00  00 00 00 00 00 00 00 00  ................
00000040: 00 00 00 00 00 22                                 ....."

client -> server ↕

RTSP/1.0 200 OK
Content-Length: 589
Content-Type: application/x-apple-binary-plist
Server: AirTunes/366.0
CSeq: 0

// {'audioLatencies': [{'inputLatencyMicros': 0,
//                  'outputLatencyMicros': 400000,
//                  'type': 100},
//                 {'audioType': 'default',
//                  'inputLatencyMicros': 0,
//                  'outputLatencyMicros': 400000,
//                  'type': 100},
//                 {'audioType': 'media',
//                  'inputLatencyMicros': 0,
//                  'outputLatencyMicros': 400000,
//                  'type': 100},
//                 {'audioType': 'media',
//                  'inputLatencyMicros': 0,
//                  'outputLatencyMicros': 400000,
//                  'type': 102}],
// 'deviceID': 'aa:bb:cc:dd:ee:ff',
// 'features': 2255099430177280,
// 'keepAliveLowPower': True,
// 'keepAliveSendStatsAsBody': True,
// 'manufacturer': 'Sonos',
// 'model': 'One',
// 'name': 'Camera da letto',
// 'nameIsFactoryDefault': False,
// 'pi': 'ba5cb8df-7f14-4249-901a-5e748ce57a93',
// 'protocolVersion': '1.1',
// 'sdk': 'AirPlay;2.0.2',
// 'sourceVersion': '366.0',
// 'statusFlags': 4}

No content type

The server sends a second /info request to ask for additional information. The request has no body. The receiver replies with a binary plist which may contain the following key:value entries:

Key	Type	Description
initialVolume	Integer	A value from -144 to 0 corresponding to the initial volume of the receiver [dB]

server -> client ↕

GET /info RTSP/1.0
X-Apple-ProtocolVersion: 1
CSeq: 2
DACP-ID: 13C27320A1CDFBC4
Active-Remote: 144558050
User-Agent: AirPlay/409.16

client -> server ↕

RTSP/1.0 200 OK
Content-Length: 54
Content-Type: application/x-apple-binary-plist
Server: AirTunes/366.0
CSeq: 2

// {'initialVolume': -120}

`POST /auth-setup`

server -> client ↕

client -> server ↕

`POST /fp-setup`

server -> client ↕

client -> server ↕

`POST /pair-setup`

server -> client ↕

client -> server ↕

`POST /pair-verify`

server -> client ↕

client -> server ↕

`POST /command`

server -> client ↕

client -> server ↕

`POST /feedback`

Probably an heartbeat to ensure the ensure the receiver is alive. Sent until the receiver is disconnected.

server -> client ↕

POST /feedback RTSP/1.0
CSeq: 10
DACP-ID: 93842EE68464F5B9
Active-Remote: 1149412352
User-Agent: AirPlay/409.16

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 10

`POST /audioMode`

server -> client ↕

client -> server ↕

`SETUP`

This is the setup request used to establish the communication with the receiver and configure the time, event, control and data channels between the two. The time channel is used only with NTP synchronization and stays down when using PTP.

1) SETUP info and event

The sender communicate generic info about the device, timing protocol, timing peers and values related to encryption: ekey, eiv and et (encryption type). timingPeerInfo and timingPeerList are needed if receiver supports PTP and the sender announces timingProtocol=PTP.

The receiver sets up an event channel (TCP) and communicates the port, together with its timing info. If the receiver declares PTP time synchronization, then timingPort won't be used. If sender and receiver use NTP instead, the receiver must open a timing channel and declare its port into timingPort.

The event channel must be open or the RTSP won't continue.

server -> client ↕

SETUP rtsp://192.168.1.12/5736436306141987405 RTSP/1.0
Content-Length: 819
Content-Type: application/x-apple-binary-plist
CSeq: 1
DACP-ID: E7DE0387CF67C4A1
Active-Remote: 979899315
User-Agent: AirPlay/409.16

// {'deviceID': '11:22:33:44:55:66',
//  'eiv': b'=o\xa0\xc24\xcd\xee\xcb9\x99~l\x140\x08\x9c',
//  'ekey': b'\x08\x90x\xa6\x0e\x87$C\x88l\xc1MS[Q\xaf',
//  'et': 0,
//  'groupContainsGroupLeader': False,
//  'groupUUID': '67EAD1FA-7EAB-4810-82F7-A9132FD2D0BB',
//  'isMultiSelectAirPlay': True,
//  'macAddress': '11:22:33:44:55:68',
//  'model': 'iPhone10,6',
//  'name': 'iPXema',
//  'osBuildVersion': '17B111',
//  'osName': 'iPhone OS',
//  'osVersion': '13.2.3',
//  'senderSupportsRelay': True,
//  'sessionUUID': '3195C737-1E6E-4487-BECB-4D287B7C7626',
//  'sourceVersion': '409.16',
//  'timingPeerInfo': {'Addresses': ['192.168.1.86', 'fe80::473:74c7:28a7:3bee'],
//                     'ID': '67EAD1FA-7EAB-4810-82F7-A9132FD2D0BB',
//                     'SupportsClockPortMatchingOverride': True},
//  'timingPeerList': [{'Addresses': ['192.168.1.86', 'fe80::473:74c7:28a7:3bee'],
//                      'ID': '67EAD1FA-7EAB-4810-82F7-A9132FD2D0BB',
//                      'SupportsClockPortMatchingOverride': True}],
//  'timingProtocol': 'PTP'}

client -> server ↕

RTSP/1.0 200 OK
Content-Length: 171
Content-Type: application/x-apple-binary-plist
Server: AirTunes/366.0
CSeq: 1

// {'eventPort': 58168,
//  'timingPeerInfo': {'Addresses': ['192.168.1.12', 'fe80::fd:1487:448:e8ce'],
//                     'ID': '192.168.1.12'},
//  'timingPort': 0}

2) SETUP control and data

This SETUP requests is sent as soon as audio streaming must start. The sender declares audio format, latencies, its control port and the following parameters:

audioFormat - the audio format;
ct - compression type;
shk - shared encryption key;
spf - Frames per packet.

The key type is used to declare the type of streaming.

Type	Description
96	General audio - Real time
103	General audio - Buffered
110	Screen
120	Playback
130	Remote control

The key ct stands for compression type.

Compression type	Description
1	LPCM (Linear Pulse Code Modulation)
2	ALAC (Apple Lossless)
4	AAC (Advanced Audio Coding)
8	AAC ELD (Enhanced Low Delay)
32	OPUS¹

The receiver prepares its control and data channels (UDP or TCP depending on the type) and communicates the respective ports in controlPort and dataPort. The control channel will receive RTCP² packets while the data channel the actual streaming payload over RTP³.

The value of audioFormat is encoded as described in section Audio codecs

server -> client ↕

SETUP rtsp://192.168.1.12/5736436306141987405 RTSP/1.0
Content-Length: 276
Content-Type: application/x-apple-binary-plist
CSeq: 15
DACP-ID: E7DE0387CF67C4A1
Active-Remote: 979899315
User-Agent: AirPlay/409.16

// {'streams': [{'audioFormat': 262144,
//           'audioMode': 'default',
//           'controlPort': 60242,
//           'ct': 2,
//           'isMedia': True,
//           'latencyMax': 88200,
//           'latencyMin': 11025,
//           'shk': b'\xdbc\x9b,\xdb\x15\x82\x19\x0b\xbf\xd3\xd0\x81\xc5\x7f7'
//                  b'\xaf\x7f\xb2l\xec\xca\xc8\xd0\x8d\x9d\x1d\xa8'
//                  b'\xda\xa2\xf7\xd0',
//           'spf': 352,
//           'supportsDynamicStreamID': True,
//           'type': 96}]}

client -> server ↕

RTSP/1.0 200 OK
Content-Length: 116
Content-Type: application/x-apple-binary-plist
Server: AirTunes/366.0
CSeq: 15

// {'streams': [{'controlPort': 58170, 'dataPort': 58169, 'type': 96}]}

`SET_PARAMETER`

Used to set parameters on the receiver end or to communicate something, depending on Content-Type.

Content-Type	Body	Description
text/parameters	"volume: N”	Volume to set on the receiver
text/parameters	"progress: X/Y/Z”	Progress of the current track (start/current/end)
image/jpeg	data	JPEG image of the artwork
application/x-dmap-tagged	data	Now playing info using DAAP

server -> client ↕

SET_PARAMETER rtsp://192.168.1.12/15566703517752576217 RTSP/1.0
Content-Length: 20
Content-Type: text/parameters
CSeq: 6
DACP-ID: 93842EE68464F5B9
Active-Remote: 1149412352
User-Agent: AirPlay/409.16

volume: -20.000000

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 6

`GET_PARAMETER`

Get a parameter from the receiver.

server -> client ↕

GET_PARAMETER rtsp://192.168.1.12/11453126448668165858 RTSP/1.0
Content-Length: 8
Content-Type: text/parameters
CSeq: 3
DACP-ID: 456B5E19F5B6B995
Active-Remote: 1565155860
User-Agent: AirPlay/409.16

volume

client -> server ↕

RTSP/1.0 200 OK
Content-Length: 14
Content-Type: text/parameters
Server: AirTunes/366.0
CSeq: 3

volume: -100

`SETPEERS`

Used to communicate other possible receivers in the multi-room group. It is a binary plist containing a list of IPv4 and IPv6 addresses of the devices in the group.

server -> client ↕

SETPEERS rtsp://192.168.1.12/16168720036618061465 RTSP/1.0
Content-Length: 128
Content-Type: /peer-list-changed
CSeq: 9
DACP-ID: 44A75743C01170A0
Active-Remote: 3125175229
User-Agent: AirPlay/409.16

// ['192.168.1.12', 'fe80::fd:1487:448:e8ce', // Receiver
// '192.168.1.86', 'fe80::473:74c7:28a7:3bee'] // Sender
00000000: 62 70 6C 69 73 74 30 30  A4 01 02 03 04 5C 31 39  bplist00.....\19
00000010: 32 2E 31 36 38 2E 31 2E  31 32 5F 10 16 66 65 38  2.168.1.12_..fe8
00000020: 30 3A 3A 66 64 3A 31 34  38 37 3A 34 34 38 3A 65  0::fd:1487:448:e
00000030: 38 63 65 5C 31 39 32 2E  31 36 38 2E 31 2E 38 36  8ce\192.168.1.86
00000040: 5F 10 18 66 65 38 30 3A  3A 34 37 33 3A 37 34 63  _..fe80::473:74c
00000050: 37 3A 32 38 61 37 3A 33  62 65 65 08 0D 1A 33 40  7:28a7:3bee...3@
00000060: 00 00 00 00 00 00 01 01  00 00 00 00 00 00 00 05  ................
00000070: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 5B  ...............[

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 9

server -> client ↕

SETPEERS rtsp://192.168.1.12/16168720036618061465 RTSP/1.0
Content-Length: 173
Content-Type: /peer-list-changed
CSeq: 9
DACP-ID: 44A75743C01170A0
Active-Remote: 3125175229
User-Agent: AirPlay/409.16

// ['192.168.1.12', 'fe80::fd:1487:448:e8ce', // Receiver
// '192.168.1.61', 'fe80::7a28:caff:fec0:cd02', // Second receiver in the
group
// '192.168.1.86', 'fe80::473:74c7:28a7:3bee'] // Sender
00000000: 62 70 6C 69 73 74 30 30  A6 01 02 03 04 05 06 5C  bplist00.......\
00000010: 31 39 32 2E 31 36 38 2E  31 2E 31 32 5F 10 16 66  192.168.1.12_..f
00000020: 65 38 30 3A 3A 66 64 3A  31 34 38 37 3A 34 34 38  e80::fd:1487:448
00000030: 3A 65 38 63 65 5C 31 39  32 2E 31 36 38 2E 31 2E  :e8ce\192.168.1.
00000040: 36 31 5F 10 19 66 65 38  30 3A 3A 37 61 32 38 3A  61_..fe80::7a28:
00000050: 63 61 66 66 3A 66 65 63  30 3A 63 64 30 32 5C 31  caff:fec0:cd02\1
00000060: 39 32 2E 31 36 38 2E 31  2E 38 36 5F 10 18 66 65  92.168.1.86_..fe
00000070: 38 30 3A 3A 34 37 33 3A  37 34 63 37 3A 32 38 61  80::473:74c7:28a
00000080: 37 3A 33 62 65 65 08 0F  1C 35 42 5E 6B 00 00 00  7:3bee...5B^k...
00000090: 00 00 00 01 01 00 00 00  00 00 00 00 07 00 00 00  ................
000000A0: 00 00 00 00 00 00 00 00  00 00 00 00 86           .............

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 9

`RECORD`

The sender wants to start streaming.

server -> client ↕

RECORD rtsp://192.168.1.12/11526465198168688239 RTSP/1.0
CSeq: 3
DACP-ID: 1913C64099403CD6
Active-Remote: 869310329
User-Agent: AirPlay/409.16

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 3

`FLUSH`

Sent every time the audio streaming is about to start. The RTSP request includes the header RTP-Info: seq=X;rtptime=Y. X is the first RTP sequence number and Y the first RTP timestamp.

server -> client ↕

FLUSH rtsp://192.168.1.12/15566703517752576217 RTSP/1.0
RTP-Info: seq=33288;rtptime=423687366
CSeq: 14
DACP-ID: 93842EE68464F5B9
Active-Remote: 1149412352
User-Agent: AirPlay/409.16

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 14

`TEARDOWN`

Sent when audio is paused or AirPlay is stopped. The body is a binary plist containing active streams, if audio is on pause, or empty if AirPlay is disconnected.

server -> client ↕

TEARDOWN rtsp://192.168.1.12/5736436306141987405 RTSP/1.0
Content-Length: 84
Content-Type: application/x-apple-binary-plist
CSeq: 33
DACP-ID: E7DE0387CF67C4A1
Active-Remote: 979899315
User-Agent: AirPlay/409.16

// {'streams': [{'streamID': 0, 'type': 96}]}
00000000: 62 70 6C 69 73 74 30 30  D1 01 02 57 73 74 72 65  bplist00...Wstre
00000010: 61 6D 73 A1 03 D2 04 05  06 07 58 73 74 72 65 61  ams.......Xstrea
00000020: 6D 49 44 54 74 79 70 65  10 00 10 60 08 0B 13 15  mIDTtype...`....
00000030: 1A 23 28 2A 00 00 00 00  00 00 01 01 00 00 00 00  .#(*............
00000040: 00 00 00 08 00 00 00 00  00 00 00 00 00 00 00 00  ................
00000050: 00 00 00 2C                                       ...,

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 33

server -> client ↕

TEARDOWN rtsp://192.168.1.12/3882801712562652865 RTSP/1.0
Content-Length: 42
Content-Type: application/x-apple-binary-plist
CSeq: 12
DACP-ID: 55195518C322ECCB
Active-Remote: 847803400
User-Agent: AirPlay/409.16

// {}
00000000: 62 70 6C 69 73 74 30 30  D0 08 00 00 00 00 00 00  bplist00........
00000010: 01 01 00 00 00 00 00 00  00 01 00 00 00 00 00 00  ................
00000020: 00 00 00 00 00 00 00 00  00 09                    ..........

client -> server ↕

RTSP/1.0 200 OK
Server: AirTunes/366.0
CSeq: 12

Definition of the Opus Audio Codec - https://tools.ietf.org/html/rfc6716 ↩︎
RTP: A Transport Protocol for Real-Time Applications - SR: Sender Report RTCP Packet - https://tools.ietf.org/html/rfc3550#section-6.4.1 ↩︎
RTP: A Transport Protocol for Real-Time Applications - https://tools.ietf.org/html/rfc3550 ↩︎