RDS through any firewall. No VPN. No ports.
Getting RadioText and HD program data to the exporter usually means a fight with IT — a VPN tunnel, a forwarded UDP port, a static IP, a change request that takes three weeks. BNM ends that fight. The agent already lives on the studio LAN and hands PSD straight to the exporter, locally.
Agent → Exporter on 127.0.0.1:11000 (HDP) and :10010–10013 (ID3). The internet never touches your exporter.
The open port is how stations get hijacked.
Broadcast gear is a soft target, and the break-ins are public record. In 2013, intruders reached stations’ EAS encoders and aired a fake “zombie apocalypse” emergency alert — the boxes sat on the open internet, many still on default passwords. Years later, researchers were still finding dozens of those same EAS units exposed through Shodan, the search engine that indexes internet-connected devices. In 2016, a run of U.S. radio stations had their Barix audio boxes found the same way — logged into and hijacked, owners locked out. The recipe never changes: a control or web port reachable from the internet, a weak password, and a scanner that sweeps the whole internet in minutes. After 2013, the FCC’s guidance to stations was blunt — get the equipment behind a firewall.
BNM’s agent removes the target entirely. Your RDS exporter — and everything else it watches — never needs a port forwarded, a VPN, or a public IP. The agent only ever reaches outbound over TLS, so there’s nothing inbound to find and nothing for Shodan to index.
- ✓Zero inbound ports — nothing for a scanner to find
- ✓No device on a public IP — invisible to Shodan
- ✓Outbound TLS only — the firewall stays shut
If the agent can’t reach your RDS box, you know it’s down.
Because the agent lives on the same LAN as your exporter, it doesn’t wait for the box to phone home or for a cloud service to notice from the outside. It talks to your RDS encoder directly, every poll. The moment that local conversation stops — the box locked up, lost power, fell off the switch — the agent reports the silence and BNM tells you the RDS is down. The thing sitting right next to it knows first — and it does that staying outbound-only, so you never open a port to watch it.
- ✓The agent polls the exporter on the LAN, every cycle
- ✓Lose that local heartbeat and it’s a real ‘RDS down’ alert
- ✓No exposed port required to watch it
The exporter is on a network the cloud can't reach.
Your HD exporter sits behind the station firewall, and rightly so — nobody wants UDP 11000 open to the internet. So cloud RDS services ask for a VPN, a port-forward, or a public IP, and your IT department says no. The data never arrives, and the HD slots sit empty.
BNM flips the direction. The agent is already inside the firewall, so it delivers locally and only ever talks outbound to the cloud. Nothing inbound, nothing exposed.
Native PSD, the way the exporter wants it.
- ✓Native iBiquity HDP for HD1/MPS on UDP 11000
- ✓Bare ID3 for HD2–HD5 on UDP 10010–10013
- ✓Zero inbound ports — the firewall stays closed
- ✓No VPN, no static IP, no IT change request
- ✓Scheduled messaging & rotation for RadioText built in
From your dashboard to the air, four hops.
You set the text
Now-playing, RadioText, scheduled messaging and rotation — edited in the dashboard.
Cloud → agent
The cloud sends the agent plain text over an outbound TLS connection. Nothing inbound.
Agent builds the frame
The agent wraps it as native HDP for MPS, or bare ID3 for the SPS channels.
Local handoff
Straight to the exporter on 127.0.0.1 — on-LAN, never across the internet.
Finally get your HD slots filled.
We'll drop the agent on your studio LAN and have RadioText and HD-PSD landing on the exporter — without a single firewall change.