Discover, which locates HDHomeRun devices on the network
Get/Set, which read and write variables
Upgrade, used to upgrade the firmware (I've only done this using the provided tool)
The variables are used to tune one of the two tuners on the device to a particular frequency (i.e. select an MPEG-2 Transport Stream from the many that might be provided by source), to get status information (e.g. the signal strength and error count measured by each tuner), and of course to specify where the selected video data stream is to be sent.
Except for the video data stream, all packets to and from the HDHomeRun have the following structure:
Packet Type (16-bit big endian integer)
Payload Length in Bytes (16-bit big endian integer)
CRC (32-bit little endian integer)
The payload of the Discover and Get/Set packets consists of a sequence of TLV (Tag, Length, Value) tuples with this structure:
Tag (8-bit integer)
Value Length in Bytes (variable length integer, 1 or 2 bytes, described below)
When the value length is 127 or less, it is just 1 byte. But when it is 128 or greater, the first byte is the low-order 7 bits, with bit 8 (the high bit) set, and the next byte is the length shifted down by 7 bits. The value length won't be larger than 1460, because that is the maximum length of an entire packet, so we won't ever need to send more than 11 bits of length. For those familiar with Unicode, this is vaguely reminiscent of UTF-8 (though UTF-8 is big endian, and supports encoding code points with more bits).