Low-Level Protocol

[samlaf]

A lot of collaborative effort has taken place via these forums to decode the low-level protocol that the Tello uses to communicate with its native app.

We will try to gather the information that has been obtained together on these pages.

The Tello communicates with its controller via Wifi on a default port number 8889 using UDP messages. Most of these messages consist of a structured packet of data in the following general format:

Tello General UDP Packet Structure

Position(s)	Content	Comments
0	Header	Always 0xCC
1-2	Packet Size	13-bit total packet size
3	CRC-8	CRC from Header to Packet Size
4	Packet Type Info	Bits are: F|T|TYP|SUB - See below
5-6	Message ID	Little-endian - See below
7-8	Sequence No.	Little-endian - Either 0 for some types, or ascending for others
9...	Payload	Optional, varies by Packet Type
End-1, End	CRC16	CRC from Header to end of Payload

The Packet Size is in a strange little-endian format where the lower (first) byte is normal, but the upper (second) byte is shifted 3 bits to the left. So decoding the size looks something like this: size = buffer[1] + ((buffer[2]<<8)>>3)

Packet Type Info Format

Bit	0	1	2 - 4	5 - 7
Meaning	1 if From Drone	1 if To Drone	3-bit Packet Type	3-bit Packet Subtype

The Packet Type dictates the structure of the Payload (if there is one). Subtype seems to be always zero.

Packet Types

Value	Meaning
0	Extended
1	Get Info
2	Data 1
4	Data 2
5	Set Info
6	Flip
(3 & 7)	Unknown

Here are the currently known message IDs. Click on the function for further details.

Tello Message IDs and Meanings

ID (Hex)	Tello Function	Dir	Comments
0x0001	Connect	→	Pseudo-command sent as plain-text
0x0002	Connected	←	Pseudo-command received as plain-text
0x0011	Query SSID	↔
0x0012	Set SSID	→
0x0013	Query SSID Password	→
0x0014	Set SSID Password	→
0x0015	Query Wifi Region	→
0x0016	Set Wifi Region	→
0x001a	Wifi Strength	←	Seems to max. out at 90%
0x0020	Set Video Bit-Rate	→
0x0021	Set Video Dyn. Adj. Rate	→
0x0024	Set EIS	→
0x0025	Request Video Start	→
0x0028	Query Video Bit-Rate	↔	(Unverified)
0x0030	Take Picture	↔	Can also be a response
0x0031	Set Video Aspect	↔
0x0032	Start Recording	→
0x0034	Exposure Values
0x0035	Light Strength	←	Sent by drone approx every 2 secs
0x0037	Query JPEG Quality	→
0x0043	Error 1	←
0x0044	Error 2	←
0x0045	Query Version	↔
0x0046	Set Date & Time	↔
0x0047	Query Activation Time	→
0x0049	Query Loader Version	→
0x0050	Set Sticks	→	Tello needs these regularly as a 'heartbeat'
0x0054	Take Off	↔	Normal take-off and climb to approx. 1.8m agl
0x0055	Land	↔
0x0056	Flight Status	←	Not all fields are set
0x0058	Set Height Limit	→
0x005c	Flip	→
0x005d	Throw Take Off	→
0x005e	Palm Land	→
0x0062	File Size	←	eg. for chunk of photo
0x0063	File Data	←	eg. chunk of photo
0x0064	File Done	←	a.k.a. EOF. eg. end of photo data
0x0080	Start Smart Video	→
0x0081	Smart Video Status	←
0x1050	Log Header	↔
0x1051	Log Data	←
0x1052	Log Config.	←
0x1053	Bounce	→	Toggles the Bounce flight mode
0x1054	Calibration	↔	Payload (1 byte): 0 to calibrate IMU, 1 to calibrate Center of Gravity (should be hovering)
0x1055	Set Low Battery Threshold	↔	Certain commands are ignored below the threshold
0x1056	Query Height Limit	↔
0x1057	Query Low Battery Threshold	↔
0x1058	Query Attitude (Limit?)	→
0x1059	Set Attitude (Limit?)	→

PinguSoft has made a wireshark dissector which can be used to analyze the packets getting sent between the tello and your app.

 

[samlaf]

Just wanted to start a discussion thread regarding this protocol. I think there is a mistake in the size decoder, which reads

size = buffer[1] + ((buffer[2]<<8)>>3)

I think it should be

size = (buffer[1]>>3) + (buffer[2]<<5)

Could someone verify this?

EDIT: the original godot article says that its ([2] << 8) | ([1] >> 3), which I think is wrong as well (if we only use 5 bits of the first byte (>>3 means discard 5 bits), then we need to push the second byte by 5, not 8).