Dissecting the Sonos Controller

I’ve been eyeing the Sonos devices for some time now, but never found a chance to sit down and play with them. For the folks that have never heard of Sonos, they make high-quality wireless speakers that you can set up in your home to stream music through. The interesting thing about them is that they’re fairly easy to configure—just plug in power and connect to your home network—and they play well with each other. Adding multiple speakers is as easy as plugging them in and joining them to your home network. The devices automatically find each other, and from there you can easily arrange them however you like (have all the speakers play the same song, have two playing one song in one room and another playing a different song in another room, and so on). The downside is that they’re quite expensive (the cheapest speaker costs ~$300), which made it hard for me to justify getting one. However, that all changed recently. I was in Australia for Music Hack Day Sydney this past weekend and, as a sponsor of the event, Sonos was there with a bunch of Play:5 speakers!

Realizing that this was the perfect opportunity to finally tinker with the Sonos players, I started digging through their developer documentation. What I quickly found out though, was that while there were plenty of docs (and sample code) for creating applications that stream music through the speakers, there was no documentation on how one could control the speakers themselves. After a bit or reading, I learned that the Sonos devices communicate with each other over UPnP, so controlling the speakers would simply be a matter of working with that protocol. Unfortunately, that was easier said than done. Despite being an open protocol, UPnP is lacking in easy to understand documentation and easy to use libraries. To be fair, there seem to be good UPnP libraries in C, but I didn’t want to dust off my ancient C programming skills for a weekend hackathon. I was able to find two Python libraries, BRisa and sonospy, but neither worked when I gave them a go. It was time to get creative.

Peaking Under the Hood

I had a working Sonos controller on my computer, the official Sonos application, I just needed to figure out how it did its magic. Enter Wireshark, the revealer of secrets. After a few packet sniffing sessions, I had what I needed. Sonos devices can be controlled by sending them SOAP messages. For example, to pause the currently playing track, you would make the following HTTP POST request:

POST http://[Sonos speaker’s IP address]:1400/MediaRenderer/AVTransport/Control

POST Headers: 
Content-type: text/xml 
SOAPACTION: "urn:schemas-upnp-org:service:AVTransport:1#Pause"

POST Body: 
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Pause xmlns:u="urn:schemas-upnp-org:service:AVTransport:1"><InstanceID>0</InstanceID><Speed>1</Speed></u:Pause></s:Body></s:Envelope>

Finding out the Sonos speaker’s IP address is done programmaticaly through the Simple Service Discovery Protocol (SSDP). I wasn’t able to write the code to do dynamic discovery over the weekend, so I took the easier route. If you have the official Sonos application installed, you can get a report of all the speakers’ IPs by clicking on “About My Sonos System” in the Sonos menu.

About Sonos Menubar

It’ll give you an output similar to the one below.

Associated ZP: 10.0.0.103 
——————————— 
BRIDGE: BRIDGE 
Serial Number: 00-0E-58-4F-87-AC:F 
Version: 3.7 (build 17551200) 
Hardware Version: 1.5.0.0-2 
IP Address: 10.0.0.100 
——————————— 
PLAY:5: HACK CHILL ROOM1 
Serial Number: 00-0E-58-5D-15-32:E 
Version: 3.7 (build 17551200e) 
Hardware Version: 1.16.4.1-2 
IP Address: 10.0.0.102 
OTP: 1.1.1(1-16-4-zp5s-0.5) 
———————————

I was able to implement the other basic controller functionality, like play, stop, next track, previous track, and get information about the currently playing track, by sending similar SOAP messages. A few hours into the weekend, and I was able to control the hackathon’s Sonos speakers through my terminal! (This got pretty annoying for the other hackers at the event since those were the sames speakers that were playing the music for the weekend.)

Spicing Things Up

A terminal prompt makes for a lousy hackathon demo, so I decided to code up some simple applications on top of my base Sonos controller library. The first was a web app version of the Sonos controller. To spice things up, I used the Rovi API to bring in high-quality cover art and editorial album reviews. I also used the Rdio API to add in a “favorite” button. Push it and the currently playing track gets added to an Rdio playlist.

Screenshot of SoCo web app

For my second example application, I used the Twilio API to let me control the Sonos speaker through SMS. This was particularly cool because the official Sonos application for the iPhone only works when you’re in your home network. With SMS, I could control the speakers even when I was out. Ran out of the house, but forgot to turn off your music? Just send your speaker a text message.

The Payoff

Sonos Play:3 and BridgeAll three demos went over well with the audience at the hackathon during my presentation on Sunday night, and I ended up winning a Sonos Play:3 and bridge of my very own!

Sonos Play:3 and Bridge

The Real Payoff

While winning some hardware of my own is awesome, the real win for me is the potential for great things in the near future. All of my code for the weekend and the sample applications is available on my Github page. With the basic groundwork laid, I hope developers at future hackdays will be able to create all kinds of interesting takes on controlling Sonos devices. Bring on the Kinect and OpenCV hacks! If you build something cool, please let me know about it through e-mail or Twitter.