Limits and Untested

Limits and Untested

This page lists the protocol limits that apply even on tested devices and everything that is not verified on real hardware.

Source marks [measured], [in use], [khtool], [manual], [Sennheiser]: see the legend on Home. Statements marked [khtool] are not verified on own hardware.

Tested hardware

Model	SSC product name	Firmware	Status	Source
KH 120 II	KH 120 II	1_7_3	Tested	[measured]
KH 750 DSP	KH 750 (no "DSP")	2_1_2	Tested	[measured]

On both, every typed leaf the device's own schema lists answers a get: 52 on the KH 120 II, 131 on the KH 750 [measured]; the 12 untyped osc/* protocol nodes are covered in SSC-Paths. Everything else on this page is either untested or a limit observed on these two models.

Not verified on hardware

Item	Status	Source
KH 80 DSP	Not tested on hardware	–
KH 120 (without "II")	Not tested; unknown whether this model speaks SSC at all	–
KH 150	Not tested on hardware	–
AES67 variants (KH 120 II AES67, KH 150 AES67)	Not tested; the exact product name these devices report over SSC is unknown	–
Value ranges on other models	Not measured; they may differ from the tested models (level, delay, standby, logo brightness, EQ band counts)	–
KH 750 firmware 1.2.x output level/mute in audio/out5	Reported, not tested on hardware. On 2_1_2, audio/out is used and audio/out5 answers 404	[khtool] (source code), [measured]
KH 80 save behaviour	That the KH 80 needs an explicit device/save_settings is a khtool-side statement	[khtool] (issue tracker)
device/save_settings on KH 120 II / KH 750	Measured 404 on both (path does not exist)	[measured]
KH 805 II / KH 810 II / KH 870 II	Completely untested	–
SSC-triggered factory reset, reboot duration	Not tested on hardware	–
Writes to device/update/*, device/auth/exclusive, device/system	Not tested on hardware	–
What mute_persist does; whether null keeps an entry of mixer/levels	Not tested on hardware (both are write-tested, see SSC-Paths)	–
audio/out/delay unit on the KH 750	Not measured directly (REW times a subwoofer from its impulse start and scattered by several ms); a summed measurement showed the delay acting in the bass only. On the KH 120 II the unit is measured (see SSC-Paths)	[measured]
Shelves steeper than the cookbook form allows for their height; the crossover's deep stop band	Not measured	–

Facts taken only from khtool

These come from khtool's source code or its maintainer's statements in the khtool issue tracker, and are not measured by this project:

Statement	Source
KH 750 level/mute path is chosen by firmware version: 1.0, 1.1 and 2.x use audio/out, anything else (named example: 1.2.4) uses audio/out5	[khtool] (source code)
The KH 80 forgets changes at power-off unless device/save_settings is sent; other KH DSP models save automatically	[khtool] (issue tracker)

Protocol limits

Limit	Effect	Source
No container dumps	{"device":null} and the EQ container audio/out/eq2 answer 404 [measured]. A message with several leaves (gets and sets mixed) is answered partially: existing leaves are answered or applied, the rest come back as errors in the same line [measured]. Every value costs one request unless a client bundles or uses patterns (see SSC-Protocol)	[measured]
Error position	The [code, {"desc": text}] pair sits inside the request's address tree under osc/error, not flat. Its position does not always name the failed leaf: an unknown path reports at the first missing node, an unknown leaf in a bundle at its parent	[measured]
Matching replies	The device echoes an osc/xid in the same reply line, error replies included (401, 404, 405, 406; not the 413 refusal). Without one, a reply can only be matched by its path; on the tested devices every leaf query is answered with exactly one line	[measured]
No authentication	SSC has no authentication: requests are answered without any login, so any host on the same LAN segment can read and change every setting, and mDNS records (including the announced serial) can be forged. Forging was not tested on hardware. The 401 authorisation needed a KH 750 returns for writes on LOCAL comes from the rear switch, not from a login	[measured]
Control mode LOCAL	With the CONTROL / CONTROL MODE switch on LOCAL, every write to a writable leaf is refused with 401 authorisation needed (a read-only leaf still answers 405); reads keep working. The KH 750 then uses its local settings instead of the network configuration (measured: a different output level and auto standby time). See Device-Behaviour	[measured]
Standby	A speaker in standby does not answer SSC at all (see Device-Behaviour)	[measured]
Connection slots	With one client connection open, 3 more connections to each model were accepted and the next one timed out at connect, without refusal or reset: probably 4 per speaker. When other clients (Neumann software such as MA 1, scripts, home automation) use up the slots, a new connection times out instead of being refused	[measured]
Out-of-range set	Depends on the path: the KH 750 clamps audio/out/delay (2000 gave 1000, -5 gave 0); the KH 120 II refuses ui/logo/brightness 200 and -10 with 406 and keeps the value. Other paths not tested	[measured]
EQ arrays	A set must have the container's full length; null keeps a band unchanged, a shorter array answers 406 (see EQ)	[measured]
Request size	At most 29 JSON tokens per request, else 413 request too long (both models); a 20-band EQ leaf fits only without an osc/xid, a whole band never fits in one message (see SSC-Protocol)	[measured]

The writeable flag is unreliable

Both firmwares answer osc/schema and osc/limits [measured]. osc/limits reports a writeable flag per leaf [measured], and the khtool schema dump carries the same flag [khtool] (schema dump). Write tests disagree with it in both directions:

• Flagged writeable, but writes are refused: the 17 fields below, 7 on the KH 120 II and 10 on the KH 750 [measured]; where the reply was recorded (ui/input_gain, ui/bass_management, ui/control_mode, ui/auto_standby) it was 405 "method not allowed" [measured]. The control mode is set by the CONTROL / CONTROL MODE switch on the back [manual]; on the KH 750 ui/control_mode reads LOCAL or NETWORK according to the switch, and device/standby/enabled and ui/auto_standby follow the AUTO STANDBY switch [measured].
• Writable, but without the flag: audio/out/mute, audio/out/delay, device/standby/auto_standby_time and device/standby/level (both models) accept writes although osc/limits does not flag them [measured]. audio/out/level and ui/logo/brightness carry no flag either [measured] and are written in normal operation [in use], without a separate recorded write test. The EQ leaves carry no writeable key and accept one-band writes on every container [measured]; mute_persist and mixer/levels carry no flag and accept writes on every output (see SSC-Paths) [measured].

Only a write test decides.

Model	Fields flagged writeable but measured as not writable	Source
KH 120 II (7)	ui/input_gain, ui/input_select, ui/bass_gain, ui/mid_gain, ui/treble_gain, ui/output_level, ui/control_mode	[measured]
KH 750 (10)	ui/bass_management, ui/channel_b_input_mode, ui/subwoofer_input_gain, ui/subwoofer_low_cut, ui/subwoofer_output_level, ui/subwoofer_phase, ui/subwoofer_phase_inversion, device/standby/enabled, ui/control_mode, ui/auto_standby	[measured]

Paths that do not exist at all (404) on both tested models: audio/out/dimm, device/save_settings [measured]. audio/out/phaseinversion is a 404 on the KH 750 [measured].

The writable input selection path is audio/in/interface (confirmed writable on both tested models) [measured].

Measured protocol features

Feature	Measured behaviour	Source
Address patterns	* and ? work in any position; at the leaf level they return only leaves, not sub-containers ({"audio":{"out":{"*":null}}} returns every leaf of audio/out, but not eq2), while {"audio":{"*":{"level":null}}} returns level of every output. No match returns {}. osc/feature/pattern is "*?"	[measured]
Transaction id	osc/xid (number or string) is echoed in the same line as the answer, error replies included (401, 404, 405, 406); the 413 refusal carries none	[measured]
Ping / version	osc/ping answers null; osc/version is "1.1"	[measured]
Subscriptions (osc/state/subscribe)	osc/feature/subscription is true. Details in SSC-Protocol. A subscription belongs to its connection [Sennheiser]	[measured], [Sennheiser]
Pitfall: duplicate "osc" key	One reply line can carry two top-level "osc" members (e.g. error 210 plus the subscription echo, seen on both models); standard JSON parsers keep only the last one	[measured]

See also: Home · SSC-Protocol · SSC-Paths · EQ