Pure Local (Long-term research) - Related research and data. 868MHz 6LoWPAN protocol

[ChrisMarriott38]

Copied this from the RoadMap -

Pure Local (Long-term research) - Investigating 868MHz 6LoWPAN protocol between Bridge and TRVs for 100% local control. Requires specialized RF hardware and community help.

I figure any research of investigation would be ideal posted in this thread as reference.

https://www.reddit.com/r/tado/comments/13s7bzu/868mhz_tado_6lowpan_vs_lutron_ra2/

https://www.loraantenna.com/whats-the-difference-between-433mhz-and-868mhz-for-lorawan-networks/

This was interesting....
"Interesting, I didn’t know ZigBee can use 868MHz in some regions. Thanks!"

https://www.reddit.com/r/tado/comments/11f5jpw/issues_tado_vs_hue/

Apparently this is a European thing:

“ZigBee utilizes 16 channels in the 2.4 GHz ISM band worldwide, 13 channels in the 915 MHz band in North America, and one channel in the 868 MHz band in Europe.”

I guess my Hue Zigbee bridge was in the one 868MHz channel it shared with the Tado bridge

https://support.tado.com/en/articles/3557440-how-does-the-tado-internet-bridge-communicate-with-other-tado-devices

[ChrisMarriott38]

Did a little back forth with Copilot, I do wonder if it's a better route to tap in to the Internet Bridge, rather than a separate dedicated RF piece of hardware?

https://copilot.microsoft.com/conversations/join/RGHqupqsPgagnAD8AYvRr

[hiall-fyi]

Great research thread @ChrisMarriott38! Love that you're digging into this. Let me share what we've found so far from our own research, and how it connects to the links you posted.

What We Know So Far

868MHz 6LoWPAN (Your Links)

Good finds on the 868MHz front. You're right that Tado uses 868MHz 6LoWPAN between the Bridge and TRVs — it's the standard European ISM band. The ZigBee interference point from your Reddit link is interesting but probably not a big concern in practice — Tado is a German company and 868MHz is their home turf, so they'll have designed around it. ZigBee only has 1 channel at 868MHz in Europe, so the overlap is minimal.

The challenge with going the SDR route is encryption. Tado almost certainly uses AES-128 on the 6LoWPAN layer (it's standard for IEEE 802.15.4). Even if we can capture and decode the radio frames, the payload would be encrypted. Without the encryption keys (which are exchanged during device pairing), we'd hit a wall.

We've done some preliminary SDR research (hardware options, software setup, protocol stack analysis) — happy to share the details if you're interested in experimenting. But realistically, there is a high chance of getting stuck at the encryption layer.

Tapping Into the Bridge

Your idea about tapping into the Bridge rather than separate RF hardware is smart thinking. We did a deep port scan and protocol analysis:

• Port 80 is the only open port — but it doesn't respond to any HTTP, WebSocket, TLS, or binary probes
• It accepts TCP connections but stays completely silent
• Best theory: it's a reverse tunnel listener — the Bridge connects outbound to Tado's cloud, and the cloud pushes commands back through
• The Bridge is essentially designed to only talk to Tado's servers, not to local clients directly

So unfortunately tapping into the Bridge's network side doesn't look promising for the 868MHz angle. The Bridge keeps its local communication strictly between itself and the TRVs over radio, with everything else going through the cloud tunnel.

Where This Leaves Us

For pure 868MHz local control, the path would be:

1. Capture radio traffic with SDR hardware (~$30 RTL-SDR)
2. Decode IEEE 802.15.4 / 6LoWPAN frames (doable — standard protocols)
3. Crack or obtain the AES-128 encryption keys (this is the hard part)
4. Reverse engineer the application-layer protocol on top

It's a fascinating research project but definitely long-term. Keep the links and research coming — every bit helps build the picture!

[ChrisMarriott38]

So i actually did wonder on this part below - IF it might mean there is a potential way to piggy back to the Tado's via Zigbee. More that direction rather than interfearance.

Good finds on the 868MHz front. You're right that Tado uses 868MHz 6LoWPAN between the Bridge and TRVs — it's the standard European ISM band. The ZigBee interference point from your Reddit link is interesting but probably not a big concern in practice — Tado is a German company and 868MHz is their home turf, so they'll have designed around it. ZigBee only has 1 channel at 868MHz in Europe, so the overlap is minimal.

The olver V2 and earlier V3 Bridges actually had the undocumented local interface on Port 80. I think they patched that out with firmware. SO it does may me wonder if there was an old one around if it could be looked in to. Or someone that has one show what it reports back, as it must be capable of being able to do it. But it doesnt appear to have been a control page sadly.

Doesnt sound like you can obtain old firmware either sadly.

I'm not convinced fully local will be possible to break. From what i've read people have been trying for 10 years.

An interesting thought,

Given i can see a truck load of bluetooth devices in our house in the Home Assistant Visualization scanner. It does make me wonder if 7+ of those are Tado related......... Food for thoguht.

[ChrisMarriott38]

Just saw the latest home assistant drop and it has notes about native RF integration., Also how to use ESP units with an RF adaptor.

https://www.home-assistant.io/blog/2026/05/06/release-20265/#meet-the-radio-frequency-platform

ESPHome, so any ESPHome device with a compatible sub-GHz transmitter can act as your home’s RF bridge. Most modules cover all common sub-GHz bands (315, 433, 868, and 915 MHz), so a single transmitter can talk to a wide range of devices. For DIY, we recommend the inexpensive CC1101 module (around $10), which you wire up to an ESP32 yourself. There’s a step-by-step guide on how to build one in the ESPHome documentation.