Home

Fox-ess make a line of solar inverters. These inverters communicate with www.foxesscloud.com and this is an attempt to understand and document the protocol used.

From snooping the traffic from an inverter I have seen that a TCP connection to port 10001 on www.foxesscloud.com is made and kept open.

Aside from the standard TCP keep-alive and Ack, data is sent from the inverters wifi module periodically (approximately every 30 seconds).

Below is a list of the packets I have seen and an explanation of the contents.

general packet structure

The packet starts and ends with the following (byte values written in hex)

7e 7e ... e7 e7

packet 01

example

0030                     7e 7e 01 62 0e fb 95 00 28 31         ~~.b....(1
0040   2e 32 34 00 00 31 2e 30 32 00 00 31 2e 31 37 00   .24..1.02..1.17.
0050   00 00 01 48 00 48 31 2d 33 2e 37 2d 45 20 20 20   ...H.H1-3.7-E   
0060   20 20 20 20 20 0e 60 f7 2b e7 e7                       .`.+..

decoding

Bytes 1-2 are the start indicator (7e 7e) Bytes 3-8 are unknown (01 62 0e fb 95 00 28) Bytes 9-12 Software version "Master" '1.24' Bytes 13-14 ? zero separator ? Bytes 15-18 Software version "Slave" '1.02' Bytes 19-20 ? zero separator ? Bytes 21-24 Software version "Manager" '1.17' Bytes 25-26 ? zero separator ? Bytes ... Software version "afci" '' Bytes 27-28 ? zero separator ?

packet 06

example

                         7e 7e 06 62 0e fb 8b 00 15 48         ~~.b.....H
0040   31 30 36 30 30 36 36 42 48 33 37 32 54 31 37 54   1060066BH372T17T
0050   45 30 36 38 ae 3c e7 e7                           E068.<..```

### decoding
Bytes 1-2 are the start indicator (7e 7e)
Bytes 3-8 are unknown `06 62 0e fb 8b 00 15`
Bytes 9-14 are the protocol version 'H10600' = H1.06.00
Bytes 15-30 are the inverter serial number '66BH372T17TE068'
Bytes 31-32 are unknown `ae 3c`
Bytes 33-34 are the end indicator (e7 e7)