Remote.app

Remote is an app and protocol released by Apple to allow an iTunes library to be accessed and controlled over the network. The iTunes Remote app is available for iOS, and is included with tvOS 9.0 and later.

Background
Remote.app uses the DAAP (Digital Audio Access Protocol) to communicate with iTunes. DAAP, is just HTTP over port 3689. Responses are returned in a binary format that lists different aspects of every request including its status code, DAAP protocol version and the server name. The following is some initial information gathered by mxweas

Finding clients
The Remote.app like most things uses Bonjour to find suitable clients. Once found it tries to initiate a session.

Initiate a session
First Remote.app calls /server-info on the server (iTunes) with the following headers: User-Agent: Remote/1.0 Accept-Encoding: gzip Viewer-Only-Client: 1 Connection: keep-alive NOTE: /server-info will return nothing if the Viewer-Only-Client header is not set to 1.

Here is a plain text sample of what iTunes will usually return: Tag: msrv, size: 252                                  ; Container of the Response Tag: mstt, Size: 4, Status: 200                      ; Response Status Tag: mpro, Size: 4, Version: 0.2.0.4                 ; DMAP Protocol Version Tag: apro, Size: 4, Version: 0.3.0.6                 ; DAAP Protocol Version Tag: aesv, Size: 4                                   ; Unknown Tag: aeFP, Size: 1                                   ; Unknown Tag: ated, Size: 2                                   ; Unknown Tag: msml, Size: 16                                  ; Unknown Tag: minm, Size: 15, Data: Max\342\200\231s Library  ; Server (iTunes Library) Name Tag: mslr, Size: 1, Data: True                       ; Login Required To Query Tag: mstm, Size: 4, Timeout: 1800 Seconds            ; Connection Timeout Tag: msal, Size: 1, Data: True                       ; Server Can Auto-Logout The Client Tag: msas, Size: 1                                   ; Unknown Tag: msup, Size: 1, Data: True                       ; Server Supports The /update Call Tag: mspi, Size: 1, Data: True                       ; Server Supports Persistent ID's  Tag: msex, Size:  1, Data: True                       ; Server Supports Extensions Tag: msbr, Size: 1, Data: True                       ; Server Supports Browse Tag: msqy, Size: 1, Data: True                       ; Server Supports Query Tag: msix, Size: 1, Data: True                       ; Server Supports Indexing Tag: msrs, Size: 1, Data: True                       ; Server Supports The /resolve Call Tag: msdc, Size: 4, Count: 1                         ; # Of Database's Available Tag: mstc, Size: 4                                   ; Unknown Tag: msto, Size: 4                                   ; Unknown

Tag Description Help: DAAP - Server Info Request

Once that data has been received, Remote.app calls /ctrl-int on the server with the same headers as the /server-info call. Below is a sample return: Tag: caci, Size 118

Next Remote.app calls /login?pairing-guid= with a random hex value that can only be assumed as a special representation of the 4 digit code used to pair in the Remote.app. The return response looks something like this: Tag: mslog, Size: 24                                  ; Container Tag: mstt, Size: 4, Status: 200                      ; Response Status Tag: mlid, Size: 4, Id: <8-digit numeric code>       ; Session ID?

After this has completed the Remote.app uses its session-id in all further calls which I will be documenting later.