If you've run cec-client -m (monitoring mode) or built an integration against libCEC, you'll see CEC traffic represented as raw hex — for example, 0f:36. This article explains how to read that, and lists the opcodes you're most likely to encounter.
cectypes.h in the libCEC source.Reading a CEC frame
A CEC message has two parts: a header byte, and one or more following bytes.
0f:36The first byte, 0f, is the header. It's split into two 4-bit halves (a "nibble" each): the first nibble is the logical address of the device sending the message, and the second nibble is the destination address. 0xF as a destination means broadcast — sent to every device on the bus. So 0f means "device 0, broadcasting to everyone."
The second byte, 36, is the opcode — the actual command. 0x36 is Standby, so 0f:36 means "device 0 has broadcast a Standby command to the whole bus" — for example, the TV telling every connected device to power down.
Some opcodes are followed by further bytes (operands) carrying additional data, such as a physical address or a key code. Monitoring mode output shows these as extra hex pairs after the opcode.
Common opcodes
| Hex | Name | Typical use |
|---|---|---|
0x04 | Image View On | Sent to bring a display out of standby and switch to the sending device's input. |
0x0D | Text View On | Similar to Image View On, but also clears any menus/text overlays first. |
0x36 | Standby | Puts the addressed device (or all devices, if broadcast) into standby. |
0x44 | User Control Pressed | A remote control button press. Followed by an operand identifying the button. |
0x45 | User Control Released | The corresponding button release. No operand. |
0x82 | Active Source | Broadcast by a device announcing it is now the active source (i.e. the TV should show its input). |
0x85 | Request Active Source | Asks all devices to identify which one is currently active. |
0x86 | Set Stream Path | Sent by the TV to request a device switch to a given physical address/input. |
0x80 | Routing Change | Sent by a CEC switch when the active route changes. |
0x81 | Routing Information | Sent by a CEC switch to indicate its current active route. |
0x83 | Give Physical Address | Requests a device report its physical address. |
0x84 | Report Physical Address | A device's response, reporting its physical and logical address. |
0x8F | Give Device Power Status | Asks a device to report its power state. |
0x90 | Report Power Status | The response — on, standby, or transitioning. |
0x9E | CEC Version | Reports the CEC protocol version a device supports, in response to Get CEC Version. |
0x9F | Get CEC Version | Requests the CEC version a device supports. |
0x00 | Feature Abort | Sent when a device can't or won't process a received message. |
cectypes.h in the libCEC source, or the HDMI specification directly.Building logic around opcodes
If you're using monitoring mode to trigger your own logic (see: Building Custom CEC Integrations), the pattern is usually: parse each TRAFFIC: line, extract the opcode byte, and match it against the commands you care about. For example, watching for 0x36 (Standby) to trigger your own devices to power down alongside the TV, or 0x82 (Active Source) to detect an input change.
Related Articles
If you run into adapter-specific issues while developing your integration, get in touch.
UK: 01202 413 610 | US: (858) 748-8250 | support@pulse-eight.com