How to get the ECM info and CAIDs for channels with dvbsnoop in Merlin3+gp3.2?



How to get the ECM info and CAIDs for channels with dvbsnoop ?

Some are suggested that I should run the following command in telnet. But when I run it nothing happens:

dvbsnoop -n 1 -nph 1 | grep CA_system_ID | awk -F "(" '{print $2}' | awk -F ")" '{print $1}'

Some have suggested the following command:

dvbsnoop -n 1 -nph 1

When I run it, a series of information be appears but ECM info and CAIDs did not appear.



I mean when the ECM info of a channel with CW (BISS) coding system is changed, how to gain the new ECM ?
The first command works only for pay TV, NOT FOR a channel with CW (BISS) coding system.


No ecm ecm fake cw prc id
I did not understand what you mean. Please explain more.

for example, the ECM info of IRIB Varzesh (26.0°E) changed from 1FFF to 0A28, so for several days I was looking for a new ECM.

when the ECM info of a channel with CW (BISS) coding system is changed, how to gain the new ECM ?


Senior Member
To record the PowerVU EMM/ECM

dvbsnoop -b 0x005a > pv.bin

This will log in binary mode the powervu PID that logs the EMM/ECMS and write it to file pv.bin


Well Known Member
Now you will tell him how to stop it,right?

First day you know about dvbsnoop,and you try to help others to use it,but there is one problem : you tell him how to start it but not how to stop it.

You must use a limit in that command or dvbsnoop will run endlessly.
Use time option of numbers of packets you want to log.

For example use
dvbsnoop -n 1000
This option will log 1000 packets,and then dvbsnoop will stop.
Now add it to your command to make sure dvbsnoop stops.
You must also make sure about how many packets are enough for you,1000 maybe too small,or really really big,only you know how much you need to log.
Last edited:


Senior Member
Hey, at least I'm trying to help people.. This post was posted over a year ago, and NO ONE bothers to respond.. At least my post got the answer out there, and you added to it.. Great... You don't need to be smug.

As for exiting... Control-C works just fine to exit the logging. A certain packet size is useless for me, as some would take forever to generate 1000 packets and others will generate it quite quickly. I watch the file size, and when it hit the size i wanted, i hit control-c and exited the dvbsnoop.


Right then to log ecm from putty or telnet terminal using user root and ur pwd

Second, retrieve the PID PMT hex value from Webif or converting the PID PMT from Kingofsat for the given channel. For example, on Hispasat 30° West, for TVE International, it is 0331 (HEX) value in DEC is 817 as show on Webif PID PMT 817 (0331)

dvbsnoop will display list of MPEG-DescriptorTag = Ca_descriptor according to the number of accesses control available (simulcrypt often)

In TVE International case, only one block is displayed as followed

MPEG-DescriptorTag: 9 (0x09) [= CA_descriptor]
descriptor_length: 4 (0x04)
CA_system_ID: 6146 (0x1802) [= Kudelski SA]
reserved: 7 (0x07)
CA_PID: 578 (0x0242)

Third, retrieve the the hex ca_pid value. In that case, 0x0242

Four, type in dvbsnoop -n 1 -ph 2 0x0242 where -n indicates the number of ECMs to be displayed, -ph ecm log format

Example of ECM log

81 30 66 52 21 (PROVID > NOS TV) 00 07
5c (LEN/LL) 00 6a 5a cd a2 f7 45 b5 59 7e 19 ff d6 0c 1f b7 45 54 00 1d 3a c9 b8 cb c6 1e 7b fb fe 46 6f 16 65 bd bc fc f8 6e bf 14 2d b8 34 71 73 aa d0 0c 04 ea f7 37 96 46 f4 e8 99 28 d2 62 8f 5b 49 eb a4 a7 98 bc 05 35 ef f0 b9 94 55 e8 6e 25 1d f0 02 10 6b 48 e7 7e 32 c1 4b 01 ea 13 0b 03 00 00 80

As a reminder, dvbsnoop -help

dvbsnoop - a dvb/mpeg2 stream analyzer tool
Version: 1.4.56/api-3 (Sep 18 2022 04:18:37)
(c) 2001-2007 Rainer Scherg (rasc)

This is a modified version of dvbsnoop, see for more info.

Usage: dvbsnoop [opts] pid
-s type: snoop type or mode <type> [-s sec]
stream type: sec, pes, ps or ts
or special scan type:
pidscan = transponder pid scan,
bandwidth = data rate statistics for pid
signal = signal rate statistics
feinfo = frontend information
stream type or pidscan
-demux device: demux device [/dev/dvb/adapter0/demux0]
-dvr device: dvr device [/dev/dvb/adapter0/dvr0]
-frontend device: frontend device [/dev/dvb/adapter0/frontend0]
-adapter n: select dvb adapter/card no. <n> using default path
-devnr n: select device no. <n> using default dvb adapter/card
-if file: input file, reads from binary <file> instead of demux device
<file>="-" = /dev/stdin
-timeout ms: section/signal read timeout in <ms> msec. [-timeout 0]
-maxdmx n: max demux filters <n> to use in pidscan mode (0=max) [-maxdmx 0]
-buffersize kb: read buffersize in KBytes [-buffersize 0]
(0 = use default read buffer size)
-f filter: filtervalue for 'sec' demux [-f 0]
multibyte filter syntax: 0x1A.34.56.7F.01
-m mask: maskvalue for 'sec' demux [-m 0]
multibyte mask syntax: 0x1A.00.F6.55
-crc: CRC check when reading 'sec' [-nocrc]
-nocrc: no CRC check when reading 'sec' [-nocrc]
-softcrc: internal soft CRC check when reading 'sec' [-nosoftcrc]
-nosoftcrc: no internal soft CRC check when reading 'sec' [-nosoftcrc]
-sync: simple packet header sync when reading 'ts' or 'pes' [-snyc]
-nosync: (obsolete option)
-n count: receive/read max. <count> packets (0=no limit) [-n 0]
-N count: decode max. <count> packets (0=no limit) [-N 0]
this will limit -n, e.g. when using soft filters.
-spiderpid: snoop referenced section pids (sets -n 1)
-tssubdecode: sub-decode sections or pes from ts stream decoding
-tsraw: read raw/full TS in TS snoop mode
-b: binary output of packets (disables other output)
-ph mode: data hex dump mode, modes: [-ph 4]
0=none, 1=hexdump, 2=hex line 3=ascii line 4=hexdump2
-hexdumpbuffer: print hex dump of read buffer [-hexdumpbuffer]
-nohexdumpbuffer: don't print hex dump of read buffer [-hexdumpbuffer]
-nph: don't print hex dump of buffer [= -nohexdumpbuffer]
-pd verbose: print stream decode (verbose level 0..9) [-pd 7]
-npd: don't print decoded stream (= -pd 0)
-t[n|d|f]: print timestamp (no, delta, full) [-tf]
-privateprovider id: set provider <id> string for decoding private tables and descriptors
-hideproginfo: hide copyright and program info header at program start
-help: this usage info...

For the EMM log, it is quite the same. Only take the CA_PID value. Here 588 > DEC 024C > HEX

80 30 8f 07 8d ee fa 21 9b b2 ac e9 4c 14 55 ab 95 43 d6 4f 44 1d 85 a3 d0 f7 c6 91 22 a2 88 1b 2e 76 88 50 0d 28 8a b4 52 a6 3d 1e 19 24 88 bb be 38 b9 fc 40 f7 f3 40 30 9a a6 d0 60 74 f1 0f ec f6 f9 62 95 9b 27 e5 b2 d5 57 79 4d b0 b4 5d fa 3c 3d eb ee 73 fd ec b7 ba 65 ef 56 b4 31 3b 88 99 a6 a0 90 15 ba d5 b4 e9 76 57 3a dd 73 80 98 1f 96 f8 90 c9 6d 86 5e 13 90 d0 6f a1 54 bf 83 fd 10 6e a6 26 40 8d 63 ec 81 97 e6 da 50 cb 8a 13