AirPlay and IPv6

Background

I went to the HI-TEC conference and I saw a talk by @mqaissaunee in which he used Airplay to send his iPad screen to a Mac.

After a few tries, I got that working.

Then @ehorley asked whether it was using IPv6 or not, and the answer was more complicated than I expected: it uses IPv6 for session control, but IPv4 for actual streaming video. I don't know why.

Setup

I have AirServer running on my MacBook Air (details at right).

The MacBook Air is hosting an ad-hoc wireless network "protected" by WEP, which is the only encryption available (thanks a lot, Apple). This is lousy security, but it means I don't get any other traffic to confuse the results.

I am connecting with an iPad Mini, and displaying live camera images from the iPad on the MacBook Air screen.

I captured the network traffic with Wireshark.

Here is the PCAPNG file (24 MB).

TCP Conversations

As you can see below, there are 8 conversations, five over IPv6 and three over IPv4. Since I don't have a router on the network, all IP addresses are assigned by autoconfiguration and link-local: 169.254.y.z in IPv6, and fe80::/64 in IPv6.

Stream 0: RTSP over IPv6

Stream # 0 goes over IPv6, and it's the RTSP channel, which sets up sessions to stream the actual audio and video data.

Here are excerpts from the stream, showing that it set up sessions for both audio and video over IPv6:

ANNOUNCE rtsp://fe80::2acf:e9ff:fe4f:2b55/8449035571049553832 RTSP/1.0
X-Apple-Device-ID: 0xe48b7f644789
X-Apple-Client-Name: Sam's iPad Mini

SETUP rtsp://fe80::2acf:e9ff:fe4f:2b55/8449035571049553832/audio RTSP/1.0
Transport: RTP/AVP/UDP;unicast;mode=screen;timing_port=49234;events;control_port=54059;redundant=2

SETUP rtsp://fe80::2acf:e9ff:fe4f:2b55/8449035571049553832/video RTSP/1.0

TEARDOWN rtsp://fe80::2acf:e9ff:fe4f:2b55/8449035571049553832 RTSP/1.0

You can see the whole stream here .

Streams 1-3

Streams 1-3 have only handshake packets but no data.

Stream 4: Video over IPv4

This is the main video stream carrying screen-mirrored video from the iPad to the MacBook Air. It's an HTTP server with different request methods.

As explained in the article referenced below, this runs over port 7100 on the server:

Unofficial AirPlay Protocol Specification

Even though the session was set up with IPv6 addresses, it actually runs over IPv4. I don't know why--my Mac is listening on port 7100 for both IPv4 and IPv6:

Streams 5-7

Streams 5-7 have only handshake packets but no data.

Posted 12:04 PM 7-25-13 by Sam Bowne