Let's see how much I can do without actually having an iPad... Nmap against a Series 3: PORT STATE SERVICE 80/tcp open http 443/tcp open https 2190/tcp open unknown 2191/tcp open unknown 3791/tcp open unknown 31339/tcp open unknown Nmap against a Premiere running 14.7RC7: PORT STATE SERVICE 80/tcp open http 443/tcp open https 1390/tcp open iclpv-sc 1393/tcp open iclpv-nls 1400/tcp open cadkey-tablet 1410/tcp open hiq 1413/tcp open innosys-acl 2190/tcp open unknown 2191/tcp open unknown 8430/tcp open unknown 31339/tcp open unknown FWIW, port 8430 disappeared when I repeated the scan. Avahi Zeroconf Browser lists some new services, Premiere only: _tivo-mindrpc._tcp _tivo-device._tcp These are in addition to the existing _tivo-remote._tcp, etc. that other TiVos report. According to this, the "mindrpc" service runs on port 1413. ("tivo-device" just shows as port 80.) Perhaps the mindrpc service works like mind.tivo.com?