A lot of collaborative effort has taken place via these forums to decode the low-level protocol that the Tello uses to communicate with its native app.
We will try to gather the information that has been obtained together on these pages.
The Tello communicates with its controller via Wifi on a default port number 8889 using UDP messages. Most of these messages consist of a structured packet of data in the following general format:
Tello General UDP Packet Structure
| Position(s) | Content | Comments |
|---|
| 0 | Header | Always 0xCC |
| 1-2 | Packet Size | 13-bit total packet size |
| 3 | CRC-8 | CRC from Header to Packet Size |
| 4 | Packet Type Info | Bits are: F|T|TYP|SUB - See below |
| 5-6 | Message ID | Little-endian - See below |
| 7-8 | Sequence No. | Little-endian - Either 0 for some types, or ascending for others |
| 9... | Payload | Optional, varies by Packet Type |
| End-1, End | CRC16 | CRC from Header to end of Payload |
The Packet Size is in a strange little-endian format where the lower (first) byte is normal, but the upper (second) byte is shifted 3 bits to the left. So decoding the size looks something like this: size = buffer[1] + ((buffer[2]<<8)>>3)
Packet Type Info Format
| Bit | 0 | 1 | 2 - 4 | 5 - 7 |
|---|
| Meaning | 1 if From Drone | 1 if To Drone | 3-bit Packet Type | 3-bit Packet Subtype |
The Packet Type dictates the structure of the Payload (if there is one). Subtype seems to be always zero.
Packet Types
| Value | Meaning |
|---|
| 0 | Extended |
| 1 | Get Info |
| 2 | Data 1 |
| 4 | Data 2 |
| 5 | Set Info |
| 6 | Flip |
| (3 & 7) | Unknown |
Here are the currently known message IDs. Click on the function for further details.
Tello Message IDs and Meanings
| ID (Hex) | Tello Function | Dir | Comments |
|---|
| 0x0001 | Connect | → | Pseudo-command sent as plain-text |
| 0x0002 | Connected | ← | Pseudo-command received as plain-text |
| 0x0011 | Query SSID | ↔ | |
| 0x0012 | Set SSID | → | |
| 0x0013 | Query SSID Password | → | |
| 0x0014 | Set SSID Password | → | |
| 0x0015 | Query Wifi Region | → | |
| 0x0016 | Set Wifi Region | → | |
| 0x001a | Wifi Strength | ← | Seems to max. out at 90% |
| 0x0020 | Set Video Bit-Rate | → | |
| 0x0021 | Set Video Dyn. Adj. Rate | → | |
| 0x0024 | Set EIS | → | |
| 0x0025 | Request Video Start | → | |
| 0x0028 | Query Video Bit-Rate | ↔ | (Unverified) |
| 0x0030 | Take Picture | ↔ | Can also be a response |
| 0x0031 | Set Video Aspect | ↔ | |
| 0x0032 | Start Recording | → | |
| 0x0034 | Exposure Values | | |
| 0x0035 | Light Strength | ← | Sent by drone approx every 2 secs |
| 0x0037 | Query JPEG Quality | → | |
| 0x0043 | Error 1 | ← | |
| 0x0044 | Error 2 | ← | |
| 0x0045 | Query Version | ↔ | |
| 0x0046 | Set Date & Time | ↔ | |
| 0x0047 | Query Activation Time | → | |
| 0x0049 | Query Loader Version | → | |
| 0x0050 | Set Sticks | → | Tello needs these regularly as a 'heartbeat' |
| 0x0054 | Take Off | ↔ | Normal take-off and climb to approx. 1.8m agl |
| 0x0055 | Land | ↔ | |
| 0x0056 | Flight Status | ← | Not all fields are set |
| 0x0058 | Set Height Limit | → | |
| 0x005c | Flip | → | |
| 0x005d | Throw Take Off | → | |
| 0x005e | Palm Land | → | |
| 0x0062 | File Size | ← | eg. for chunk of photo |
| 0x0063 | File Data | ← | eg. chunk of photo |
| 0x0064 | File Done | ← | a.k.a. EOF. eg. end of photo data |
| 0x0080 | Start Smart Video | → | |
| 0x0081 | Smart Video Status | ← | |
| 0x1050 | Log Header | ↔ | |
| 0x1051 | Log Data | ← | |
| 0x1052 | Log Config. | ← | |
| 0x1053 | Bounce | → | Toggles the Bounce flight mode |
| 0x1054 | Calibration | ↔ | Payload (1 byte): 0 to calibrate IMU, 1 to calibrate Center of Gravity (should be hovering) |
| 0x1055 | Set Low Battery Threshold | ↔ | Certain commands are ignored below the threshold |
| 0x1056 | Query Height Limit | ↔ | |
| 0x1057 | Query Low Battery Threshold | ↔ | |
| 0x1058 | Query Attitude (Limit?) | → | |
| 0x1059 | Set Attitude (Limit?) | → | |
PinguSoft has made a
wireshark dissector which can be used to analyze the packets getting sent between the tello and your app.
