Remote control your Pioneer VSX receiver over telnet

telnet <ip> VU<enter> #win!

I’m a hacker, developer and lazy guy. So when I found myself in the kitchen cooking, just realizing that my Pioneer VSX 921 receiver was turned down too low I didn’t walk over to turn it up or find the remote; I instead remembered that it has a bad app for iOS, meaning that it accepts being controlled remote over the network. A little bit of google searching and I found a plugin for an I-dont-know-what containing an XML with some Lua code (XML with code — yay), and also a very nice mapping table for commands the same code runs against a VSX 1021.

So a quick telnet session later I had yanked the volume up without ever leaving the kitchen! These commands probably work for most of the VSX  921/1021 series and later. Enjoy:



Power control:


Input selection

  • 05FN = TV/SAT
  • 01FN = CD
  • 03FN = CD-R/TAPE
  • 04FN = DVD
  • 19FN = HDMI1
  • 05FN = TV/SAT
  • 00FN = PHONO
  • 03FN = CD-R/TAPE
  • 26FN = HOME MEDIA GALLERY(Internet Radio)
  • 15FN = DVR/BDR
  • 05FN = TV/SAT
  • 10FN = VIDEO 1(VIDEO)
  • 14FN = VIDEO 2
  • 19FN = HDMI1
  • 20FN = HDMI2
  • 21FN = HDMI3
  • 22FN = HDMI4
  • 23FN = HDMI5
  • 24FN = HDMI6
  • 25FN = BD
  • 17FN = iPod/USB
  • FU = INPUT CHANGE (cyclic)

If you want to change input to the iPod port and turn up the volume, given you’re using OS X or some Unix derivative, you would do this:

  1. Open a terminal
  2. Run the command telnet <ip>
  3. Select input by typing: 17FN<enter>
  4. Nod volume up 1 time: VU<enter>
  5. Repeat VU until you are happy.

There is a tone of other commands you can use, I believe this manual for the VSX 1120 is very much valid for other devices in the series.

About Raymond Julin

Lead developer at Keyteq Labs, a product business in Bergen, Norway with a reputation for modern user friendly solutions.


  1. Simen

    Make an alias. alias amp_volup=’echo VU | nc ip port’ etc.

    • Raymond Julin

      Concretely this works in this case:
      alias amp_on=”printf ‘%s\r\n’ po | nc 192.168.1.x 23″

      • Brad

        That still leaves the connection open. Quick and dirty fix is “nc -w 1 192.168.1.x”.

        The -w 1 flag times out a idle session after one second. This kills the session with no return input.

        A -q 1 flag does a similar thing, however the quit option allows the Receiver to return the currently set volume.

      • $ printf ‘%s\r\n’ po


  2. FYI – This also works on a Pioneer VSX-822, but you need to use port 8102 instead of 23.

  3. chris

    Worked on my VSX-42 also on port 8102

  4. works on VSX-1023 on port 8102 – commands case sensitive.

  5. Imre

    Great! Works also on VSX-921-K (both port 23 and 8102)

    • Venras


      I want to control over an adroid app (telnet app) but i get no connection. Do i have to configure something?
      If i want to connect to the receiver with my PC (connectet over LAN) over telnet it works fine, but with my tablet i have problems.

      Maybe i have to change some settings in my wlan network?

      Thanks for Help!

      • Venras

        Now it’s working fine!

        I used another telnet client app from the android store.

  6. also working on VSX-528 only on port 8102

  7. Jan

    works on a vsx-922 @ standard telnet port

  8. David

    works on VSX-43 only on port 8102, requires uppercase commands

  9. Works on SC-1223 as well, but when listening to Internet Radio the display text is echo’d to the telnet terminal, resulting in long scrolling lines of numbers. This makes entering commands a big challenge. Not found a way to stop this

    • chris

      Run the following command on your local machine (example is using the Mute off MF command):

      { echo “MF”; sleep 1; } | telnet 8102

  10. Can’t get it to Power On when the unit is off … other commands work fine on my VSX-822. Any suggestions?

    • Figured it out – needed to change the “network standby” mode in the receiver to on.

  11. MilkmanCDN

    works great with my vsx-51. Thanks!

  12. Johannes

    Works great with VSX923 until power cord is detached and re-attached.

    Network standby only seems to work after soft power off.

    Anybody have a solution for this? I want to use the receiver in an automated system where power is interupted every night…

  13. Chris

    Works also with VSX-527 on port 8102 :) Tested only few commands but not all of them work – for example commands VU, VD (volume up/down) work fine but ***VL (volume set) doesn’t work. I don’t have codes for VSX-527 but for some other models – anybody has the proper codes for VSX-527 or has any idea why the ***VL command doesn’t work?

  14. I’m figuring out what I can do with my new VSX-923-K, and so far I’ve mapped the input selection to these commands..

    01FN = CD
    02FN = Tuner
    06FN = Sat/CBL
    15FN = BDR
    17FN = iPod/USB
    19FN = HDMI1
    20FN = HDMI2
    21FN = HDMI3
    22FN = HDMI4
    23FN = HDMI5/MHL
    24FN = HDMI6
    25FN = BD
    34FN = HDMI7
    38FN = Internet Radio
    45FN = Favorites
    48FN = HDMI5/MHL (Not sure why it’s there twice)

  15. Thank for this article, I’ve done a little software for Windows to control your VSX on the network : PioneerMRC. You’ll find it here :

    Pioneer Mini Remote Controller is a little software which allow you to controller your Pioneer AV via your network.

    PioneerMRC has been designed for Pioneer VSX-527 but is compatible with a lot of others models like the VSX-42/43/528/822/921/1021/1022/1023/1120…

    Hope you’ll like it.

    • Derek

      Google Chrome not allowing it to download … :(

      • Hi, this is a false positive from chrome because Pioneer MRC make telnet communications… Please check with , you will se, PioneerMRC is fully warranty withtout spyware.

  16. rafi

    (sleep 3; echo “COMMAND”; sleep 1; echo “quit”) | telnet vsx-923.local
    (sleep 3; echo “PO”; sleep 10; echo “01FN”; sleep 1; echo “quit”) | telnet vsx-923.local

  17. Im also working on a windows application COMPLETELY FREE coming soon, check out

  18. Chris

    Hello, I’m a telnet noob. I have lock remote and panel problem on my vsx922. Which commands shall I send with telnet to unlock ? PKL ? What do I type exactly when on telnet ? thanks

    • Chris

      ?PKL and ?RML I meant

      • Chris

        damn ?PKL and ?RML I meant

  19. Niels

    VSX2120 uses port 8102

  20. Binoix

    VSX-S510 uses port 8102

    • Michael

      I have a VSX-1020 and it uses port 8102. i’ve testet some command and they works. but… what data replies the vsx

      • Michael

        ok … found ithe answer in the pdf

  21. Ava:lon

    Hi There!
    Using VSX 527 with telnetlib on python.
    Cant close the connection.

  22. Anyone have idea for sending ‘sleep in 90 minutes’ command? I looked pdf with commands with no success

  23. worbianbrownia

    Works nice with my 922. Only issue is telnet isnt showing any chars and wont close – i have tried localecho :(

  24. seb

    Hi all I have a VSX-528 and all work fine with ip command have just 2 issue….it’s impossible to adjust the volum (exemple 101VL) or I have some internet radio in favories……..;the command 45FN works but how can I send a command to play the favory one or two…..?

    • jamie hutton

      Hi Seb,
      Did you get a response to the above? I have a VSX824 and am able to control it via telnet, but setting the volume (using 100VL) doesnt work.
      If you got an answer that would be very useful

  25. I’ve been playing around with this telnet interface for the past couple of weeks. For those of us who keep a terminal open and have a command history handy, it’s a much faster way to control the receiver than the iOS app. I’ve also run into instances in which both sending sound to the receiver via airplay and the power button in the iOS app fail to power up the receiver, but sending a ‘po’ string via netcat works every time.

    One end goal for me is going to be setting up a few shell scripts to control the receiver, placing them on my jailbroken iPhone, and hooking them to PebbleActivator actions so that I can control the receiver from my watch. It would be very useful to be able to toggle power and to be able to control the volume without having to hunt for a terminal or remote. For volume I’m planning to have it increment by 1 unit for each button press, or 5 at a time if the button is held down.

    The Pioneer SC-81 can be controlled at port 23 or port 8102, and the hostname SC-81.local can be used in lieu of an IP address.

    After reading this web page, I’d been successfully sending commands like the following:
    printf ‘%s\r\n’ po | nc -w 1 SC-81.local 8102
    printf ‘%s\r\n’ 080VL | nc -w 1 SC-81.local 8102

    But it can be nice to see the receiver’s response to those commands.

    I don’t know if netcat is always one-way-only or just on OS X, but I found no combination of command line arguments to nc that would show me the receiver’s response. So instead I’ve got the following script (concept borrowed from ) running in the background:


    nc -k -l 65023 | telnet SC-81.local 8102 2>&1 | while read line
    echo “output is $line”

    The use of netcat in that command allows one to send commands to port 65023 on localhost and have them forwarded through the telnet connection. This isn’t really necessary for my purposes. Thankfully the receiver also spits out its response to every command to that script’s open telnet connection regardless whether or not it’s receiving commands from that connection, or from a command sent over nc from the same or other computer, or even from button presses on the remote and front panel. But when I removed the nc listener from that line telnet would just quickly close the connection and report no output –I suppose it’s necessary to have something piping into telnet in order to keep it listening (maybe I should replace that ‘nc’ with ‘/dev/null’ to reduce the memory footprint?).

    In order to keep the receiver from dropping the telnet connection after a few minutes of inactivity, I had to set the following to set OS X’s keepalive interval to something other than the default of ‘0’.

    sudo sysctl -w net.inet.tcp.always_keepalive=1
    (got that one from )

    That’s all so far.

    Thanks Raymond and commenters for all the helpful information.

  26. I get a “connection refused” – anyone know access info for the VSX-528?

  27. I realize this thread’s fairly old, I’d be interested in making a standalone desktop app, if anyone’s so inclined. I can handle UX and light front-end work. Might be fun to do this as Photon app:

  28. Kev

    VSX-529 uses port 8102

    • My only problem with this is that I have to keep mine off the local Ethernet now. My sister loves trying to hack my stuff and this is just too easy and without any protection…

  29. Dave

    VSX-528: Port 8102, FN49 GAME

  30. Hi, I’ve updated my little software for Windows to control your VSX on the network : PioneerMRC v1.0.5.
    You’ll find it here :

    “Pioneer Mini Remote Controller” is a little Windows software which allow you to controller your Pioneer AV via your network.

    PioneerMRC has been designed for Pioneer VSX-527 but is probably compatible with a lot of others models like the VSX-42/43/528/822/921/1021/1022/1023/1120…

    Hope you’ll like it.

    • Schmurtz – I tried the demo of your app on a surface pro 4. The image is very small, similar resolution problem I’ve seen with some other apps on the surface pro. Any chance you might address this issue?

  31. I have a VSX1123. I’ve looked on the pioneer site and found some recent manuals but I cannot find anything that addresses the select functions for Pandora or Media Server. I can change the input to those but once there, I cannot navigate the menu to select a station, resume play etc. Anyone have any luck controlling Pandora, Media Server or their Favorites?

  32. John Wallace

    Has anyone managed to get the VSX 824 (UK) working over ip?

  33. Oblio

    Work Pionner 920K :D

  34. I know that this is older but anybody getting errors returned from the receiver. I’m working with a VSX-90 and I can get the query commands to work (i.e. ?P for power status) but I can’t seem to get any commands that make changes to work such as 128VL (set volume level). It returns an “E02″ Looked through as much documentation as I could find and I couldn’t figure out what this error signifies.

  35. Adrian Blakey

    A telnet from a Mac to an sc99 answers on port 23 and 8102. Interestingly without specifying the port to telnet the server answers with “BridgeCo AG Telnet server\n\r” and by explicitly providing the port 23 and port 8102 – with no banner at all.

    I have tried to get the python telnetlib to work without a lot of luck once the connection is open – any ideas?

  36. Rui

    what is the game input code for the VSX 822 & 1022? I been driving myself nuts trying to figure it out!

  37. Rudi
  38. Tom

    I’ve so far only managed to get the connection to come up from the same subnet. Any ideas on how to set up the connection from a separate subnet to a vsx-922 would be ideal (network communication between subnets is fine otherwise)!

  39. Chris

    Can’t see a reason it wouldnt work between subnets except if your amp doesnt have a default route/default gateway set. Does internet radio work (if it has that) as that obviously has to talk out of that subnet to the internet

    Incidentally for those scripting, the following works and returns a result too if the command has one (or ignore the result if it doesn’t need one). It has absolutely no protection against errors. Note its slow because of the 5 seconds sleep, you can probably drop that.

    (printf “%s\r\n” “?V” ;sleep 5;) | telnet -L 8102 2>/dev/null | tail -n 1

    Just change the command where it says ?V to whatever you want (that returns the current volume) and obviously change the IP address to your own

  40. John Wallace

    Im using a VSX 528 in the UK, I can get the commands working in examples above but I want the commands for set volume to a level… ie 50. On irule (universal remote) there is example commands which dont work. Has anyone managed to get this working?

    for Example ?V works
    PO works (as does PO\x0D in irule)
    but 00YV\X0D doesnt work….

  41. John Wallace

    Ive seen the command list and VOLXXX where XXX is 000-185 doesnt work on the UK 528. It must not be valid for this model?

  42. Nice hack Will test this on My 928 .

  43. Steve

    Anyone get this working with pioneer elite lx901? I can’t get telnet to connect using 23 or 8102. Any thoughts?

    • Mark

      It doesn’t work anymore. I had a SC-1522K that the telnet method worked on and was annoyed when that method didn’t work on my LX701. I used wireshark to sniff the traffic between my iPhone and LX701 and found out iControlAV5 uses Integra Serial Control Protocol (eiscp) instead. Apparently when Onkyo bought them out, they switched to eiscp. Thankfully someone has already written a python library for it. You can find it at Have fun!

      • Marcel

        Hello Mark,
        I wrote an Android App in CSharp with Xamarin for VSX-924 (an other Pioneers AVR’s)controlled by iControl5.
        I do not understand your statement above, what Pioneer has changed for LX701 with their new Remote App.
        You find my App under
        (the Onkyo link and then CSharp looks very different from mine).
        Can you explain, what I would have to change to get my App working also with the new AVR’s?

Trackbacks / Pings

Leave a Reply