Discovery Protocol

A factory reset UniFi device will send discovery packets as multicast to 233.89.188.1. The packets are based on Type-Length-Value (TLV). The value is a list of TLVs.

Packet Structure

OffsetSizeName
0u8Packet version
1u8Type
2-3u16Length
4[u8]Value

There are currently two (maybe three?) packet versions. At the moment this document is only covering version 2.

Packet Value Types

TypeNameContent
0x01HardwareAddress[u8; 6]
0x02IpInfoHardwareAddress([u8; 6]), IPv4([u8; 4])
0x03FirmwareVersionString
0x04UnknownUnknown
0x05UnknownUnknown
0x06UsernameString
0x07Salt[u8]
0x08Challenge[u8]
0x09UnknownUnknown
0x0AUptimei64
0x0BHostnameString
0x0CPlatformString
0x0DESSIDString
0x0EWModei32
0x0FUnknownUnknown
0x10UnknownString
0x11UnknownUnknown
0x12Sequence *i32
0x13Serial **String
0x14UnknownUnknown
0x15ModelString
0x16MinimumControllerVersionString
0x17IsDefaultbool
0x18Unknownbool
0x19Unknownbool
0x1AUnknownbool
0x1BVersionString
0x1CUnknowni32
0x1DUnknownString

* Sequence is an incrementing number
** Serial is usually the hardware address without any separators