Browsed by
Category: Home Automation

Posts that broadly concern the topic of Home Automation, including hardware and software issues.

Technical Inspection of Insteon Hub2 2245-222

Technical Inspection of Insteon Hub2 2245-222

The following are some notes I gathered while investigating the technical possibilities of the Insteon Hub2.

Starting Nmap 6.40 ( )
Nmap scan report for 192.168.XXX.XXX
Host is up (0.00058s latency).
Not shown: 65535 open|filtered ports, 65531 filtered ports
23/tcp open telnet
443/tcp open https
992/tcp open telnets
25105/tcp open unknown
MAC Address: 00:0E:XX:XX:XX:XX (Smarthome)

Nmap done: 1 IP address (1 host up) scanned in 2306.43 seconds

I can connect to both telnet ports, but all I get is a blank screen that doesn’t seem to respond to any commands.  It also doesn’t seem to broadcast the buffer contents.

After a lot of futzing, I was able to connect to the https 443 port.  It uses the deprecated RC4-MD5 cipher and a self-signed certificate.  You will also need to use Basic Auth and the username and password.  Once in, the webpage looked identical to the one described below, I was unable to determine any other benefits of this port.

The 25105 port is configurable.  It is a basic http port that requires Basic Auth using the username and password printed on the bottom of your hub.  The default webpage is very basic, with a link to and the product manual and support pages.

There is some rudimentary available at this port.  It is rather crudely documents (as is Insteon’s style) here:  See pages 6-10.  Note that this document is actually for the Hub1, I have yet to find any developer notes for the Hub2.

The buffstatus.xml page provides access to the incoming messages for the Hub2.  Of note, the Hub2 has a 200 character buffer not the 100 listed for the 2242-222.  Also, undocumented is the final two characters of the buffer.  These turn out to be a hexadecimal representation of the last position written to.  Essentially, the incoming messages are written left to right and when the 200th position is reached it goes back to 1.  The characters are never cleared (unless you call a special command to do so) but are merely overwritten.

It is possible to poll the Hub2 about twice a second and to use the buffer to see all of the messages received by the Hub2.  This seems to work rather reliably, and the constant polling doesn’t seem to upset the device.

I am not aware of a way to see outgoing messages.

The interface also allows for sending of some messages.  See the documentation in the above pdf.  This seems to provide an interface to communicate with devices from the hub.   However, as of yet, I am not able to communicate much if at all with the hub using this interface.  As a result, I am unable to scan the hub’s link table.  Update: Figured it out.  So far all of the common PLM commands seem to work with the 3?<CMD STR>=I=3 style message.  But, anytime a 3?<CMD STR>=I=3 style message is sent, the buffer is zeroed out and the buffer position is reset to 00.

Finally, I took a TCPDump of the Hub2.  Best I can tell, the Hub2 doesn’t open any outside ports on my router.  This is contrary to the claim that it does “automatic port forwarding.”  This is probably for the best security-wise anyways.

Instead it appears that the Hub creates a persistent connection to (hosted on Amazon Ec2).  Poking around confirms this.  The communication is all SSL encrypted.  I thought about placing a man-in-the-middle and trying to decode this messaging, but I doubt it would be much help.

A Temperature Controlled Whole House Fan with MisterHouse

A Temperature Controlled Whole House Fan with MisterHouse

MisterHouse Web Interface for a Temperature Controlled Whole House FanThe main feature of MisterHouse that sets it apart from other home automation systems is the ability to customize practically every aspect of the system.  The following example is a perfect demonstration of this.

I recently purchased a whole house fan, basically a giant fan that sucks hot air out from the highest point in my house. They are great if you live in a climate with cool nights.

The controls for my fan were very basic, an on/off switch and a two-speed setting.

With Misterhouse, I created an “auto” mode which will only turn on the fan if both the indoor temperature is above a defined threshold and the outdoor temperature is 5 degrees below the indoor temperature.

This is how I did it.

Starting Materials
– A Whole House Fan
– 2 IOLincs, (1 for on/off, 1 for fan speed)
– A MisterHouse enabled indoor temperature sensor (I used my Insteon Thermostat)
– A MisterHouse enabled outdoor temperature sensor (I used data from a neighbor’s weather station through weatherunderground)

I created the following items in my mht file:

GENERIC, house_fan, HVAC|WHF_Group
GENERIC, house_fan_temp, HVAC|WHF_Group
GENERIC, house_fan_setpoint, HVAC|WHF_Group
GENERIC, house_fan_ambient, HVAC|WHF_Group

I also had the following items already setup:

$upstairs_thermo_temp #the temperature upstairs
$w_temp #the outside temperature

First, I set the available states for my generic objects:

$house_fan-&gt;set_states('on', 'off', 'auto');
$house_fan_speed-&gt;set_states('high', 'low');
$house_fan_temp-&gt;set_states('cooler', 'warmer');

Then I tied my generic items to my Insteon Devices:

$house_fan-&gt;tie_event('$whf_main-&gt;set("on")', "on");
$house_fan-&gt;tie_event('$whf_main-&gt;set("off")', "off");
$house_fan_speed-&gt;tie_event('$whf_speed-&gt;set("on")', "high");
$house_fan_speed-&gt;tie_event('$whf_speed-&gt;set("off")', "low");

Then I tied my Generic temp item to my Generic setpoint item, and inserted some custom code:

sub house_fan_temp_change {
	my ($state) = @_;
	if ($state eq "warmer"){
		$house_fan_setpoint-&gt;set(int($house_fan_setpoint-&gt;state) + 1);
	} elsif ($state eq "cooler") {
		$house_fan_setpoint-&gt;set(int($house_fan_setpoint-&gt;state) - 1);

By doing this, I can have a nice cooler and warmer button in the web panel.

Finally, every minute I check to see if the device is in “auto” mode and whether or not it should turn on:

if ($New_Minute){ 
	if($house_fan-&gt;state eq 'auto') {
		if (int($upstairs_thermo_temp-&gt;state) &gt; int($house_fan_setpoint-&gt;state) &amp;&amp;
		(int($upstairs_thermo_temp-&gt;state) - 5) &gt; int($w_temp-&gt;state)) {
			if ($whf_main-&gt;state eq 'off') {
				::print_log("[] Auto: Turning on fan");
		} else {
			if ($whf_main-&gt;state eq 'on'){
				::print_log("[] Auto: Turning off fan");

The result, is a temperature controlled whole house fan.  The image above is a screen shot from my web interface.

Insteon RemoteLinc 2 Lacks the Heartbeat Feature?

Insteon RemoteLinc 2 Lacks the Heartbeat Feature?

A heartbeat is a simple broadcast packet sent at a predetermined interval.  The purpose of the packet is to announce to everyone that the device “is still alive.”

The Insteon RemoteLinc 2 is a battery powered insteon remote, that remains in a sleep state when it is not sending messages.  In this state the remote does not listen or respond to any packets sent to it.

As a battery operated device, the remotelinc will eventually need to be recharged, and it would be nice to know when a recharge is needed rather than finding out when the device doesn’t work.  The remotelinc has a command to query the battery level, but this query won’t work if the device is asleep.

This is where a heartbeat message would be nice.  It would automatically wake up the device at a periodic interval, allowing a battery level request to be sent to the device.

Best I can tell, the Remotelinc heartbeat function has been disabled or not included.  The following settings are supposed to control the hearbeat function:

Awake Interval Sets the amount of time the Remotelinc remains awake with no activity. This is editable
Sleep Interval Sets the amount of time the Remotelinc remains asleep, before waking up to send a heartbeat message. The device ACKs my changes, but the settings on the device don’t change.
Broadcast Number Sets the number of heartbeat messages that should be sent every time the sleep interval expires. The device ACKs my changes, but the settings on the device don’t change.
NoIAmAwake Bit A single bit to disable sending heart beat messages, presumably overrides all of the other settings. The device ACKs my changes, but the settings on the device don’t change.

Other users have reported similar problems over at the Indigo support forum.

As a work around, Misterhouse will send a battery level request immediately after receiving a message from the RemoteLinc.  The RemoteLinc will stay awake after sending a message for the amount of time specified in Awake Interval, I set mine to 10 seconds. Battery level requests will only be sent if the amount of time since the last battery level response has exceeded a defined threshold.

All of this works well, except for rarely used devices.  It is possible that such a remotelinc could die without there being a chance to query its battery level.

Insteon All-Link Control Flags

Insteon All-Link Control Flags

For whatever reason it is difficult to locate the breakdown of the Insteon All-Link Control Flags.

Link Control Flags:
Bit 7: 1 = Record is in use, 0 = Record is available
Bit 6: 1 = Controller (Master) of Device ID, 0 = Responder to (Slave of) Device ID
Bit 5: 1 = ACK Required, 0 = No ACK Required (currently always set to 1)
Bit 4: Reserved
Bit 3: Reserved
Bit 2: Reserved
Bit 1: 1 = Record has been used before (‘high-water’ mark)
Bit 0: Unused