I have a RM3 Mini and have been watching this thread develop and all the work that has gone into it... what determination!
I've trying to duplicate some of the methods that have been suggested without success so far.
For my latest efforts -
installed e-Control app and captured the power toggle command for my AVR, which works from the app
installed tPatcketCapture on my phone
started tPacketCapture and put in running state with VPN
toggled power from e-Control to AVR (AVR powered off)
Copied the file to my (windows) laptop for analysis with wireshark.
When looking at the packets in wireshark I can see traffice to and from my phone, and some broadcast packets, but no packets directed to the IP address of the RM3.
My phone is connected to the same wireless network as the RM3.
Did I miss something in my procedure?
Also, it seems from the latest posts that the python script can now be used to capture packets during learning, is that correct? If so, could someone give the steps for how this is setup? ie, what has to be connected to network, wireless etc?