Hello Tello Pilot!
Join our DJI Tello community & remove this banner.
Sign up

Low-Level Protocol


New member
Feb 6, 2021
Reaction score
A lot of collaborative effort has taken place via these forums to decode the low-level protocol that the Tello uses to communicate with its native app.

We will try to gather the information that has been obtained together on these pages.

The Tello communicates with its controller via Wifi on a default port number 8889 using UDP messages. Most of these messages consist of a structured packet of data in the following general format:

Tello General UDP Packet Structure
0HeaderAlways 0xCC
1-2Packet Size13-bit total packet size
3CRC-8CRC from Header to Packet Size
4Packet Type InfoBits are: F|T|TYP|SUB - See below
5-6Message IDLittle-endian - See below
7-8Sequence No.Little-endian - Either 0 for some types, or ascending for others
9...PayloadOptional, varies by Packet Type
End-1, EndCRC16CRC from Header to end of Payload

The Packet Size is in a strange little-endian format where the lower (first) byte is normal, but the upper (second) byte is shifted 3 bits to the left. So decoding the size looks something like this: size = buffer[1] + ((buffer[2]<<8)>>3)

Packet Type Info Format
Bit012 - 45 - 7
Meaning1 if From Drone1 if To Drone3-bit Packet Type3-bit Packet Subtype

The Packet Type dictates the structure of the Payload (if there is one). Subtype seems to be always zero.

Packet Types
1Get Info
2Data 1
4Data 2
5Set Info
(3 & 7)Unknown

Here are the currently known message IDs. Click on the function for further details.
Tello Message IDs and Meanings
ID (Hex) Tello Function Dir Comments
0x0001 Connect Pseudo-command sent as plain-text
0x0002 Connected Pseudo-command received as plain-text
0x0011 Query SSID
0x0012 Set SSID
0x0013 Query SSID Password
0x0014 Set SSID Password
0x0015 Query Wifi Region
0x0016 Set Wifi Region
0x001a Wifi Strength Seems to max. out at 90%
0x0020 Set Video Bit-Rate
0x0021 Set Video Dyn. Adj. Rate
0x0024 Set EIS
0x0025 Request Video Start
0x0028 Query Video Bit-Rate (Unverified)
0x0030 Take Picture Can also be a response
0x0031 Set Video Aspect
0x0032 Start Recording
0x0034 Exposure Values
0x0035 Light Strength Sent by drone approx every 2 secs
0x0037 Query JPEG Quality
0x0043 Error 1
0x0044 Error 2
0x0045 Query Version
0x0046 Set Date & Time
0x0047 Query Activation Time
0x0049 Query Loader Version
0x0050 Set Sticks Tello needs these regularly as a 'heartbeat'
0x0054 Take Off Normal take-off and climb to approx. 1.8m agl
0x0055 Land
0x0056 Flight Status Not all fields are set
0x0058 Set Height Limit
0x005c Flip
0x005d Throw Take Off
0x005e Palm Land
0x0062 File Size eg. for chunk of photo
0x0063 File Data eg. chunk of photo
0x0064 File Done a.k.a. EOF. eg. end of photo data
0x0080 Start Smart Video
0x0081 Smart Video Status
0x1050 Log Header
0x1051 Log Data
0x1052 Log Config.
0x1053 Bounce Toggles the Bounce flight mode
0x1054 Calibration Payload (1 byte): 0 to calibrate IMU, 1 to calibrate Center of Gravity (should be hovering)
0x1055 Set Low Battery Threshold Certain commands are ignored below the threshold
0x1056 Query Height Limit
0x1057 Query Low Battery Threshold
0x1058 Query Attitude (Limit?)
0x1059 Set Attitude (Limit?)

PinguSoft has made a wireshark dissector which can be used to analyze the packets getting sent between the tello and your app.


New member
Feb 6, 2021
Reaction score
Just wanted to start a discussion thread regarding this protocol. I think there is a mistake in the size decoder, which reads
size = buffer[1] + ((buffer[2]<<8)>>3)
I think it should be
size = (buffer[1]>>3) + (buffer[2]<<5)
Could someone verify this?

EDIT: the original godot article says that its ([2] << 8) | ([1] >> 3), which I think is wrong as well (if we only use 5 bits of the first byte (>>3 means discard 5 bits), then we need to push the second byte by 5, not 8).
Last edited:

Members online

Forum statistics

Latest member