What Is Stalker IPTV? How Stalker Middleware Works Explained (2026)

If you’ve spent any time on IPTV forums or browsed Reddit threads asking what is stalker IPTV, you’ve seen the term “Stalker portal” everywhere. Some people swear by it. Others find it confusing. The truth is, Stalker Middleware is one of the most powerful and widely deployed IPTV platforms in the world — and once you understand how it actually works, everything clicks.

This guide breaks it all down: the technical architecture, the full handshake flow, MAC authentication mechanics, compatible devices, admin setup, how to use stalker portal, how it compares to Xtream Codes and M3U, and how to fix every common problem. No fluff. Just everything you need to know.

---

What Is Stalker IPTV, Really?

Stalker Middleware is a professional IPTV middleware platform developed by Infomir, a European electronics manufacturer founded in 2001. Originally headquartered in Odessa, Ukraine and now based in Tallinn, Estonia, Infomir built Stalker as the native software layer for its MAG series of set-top boxes.

So, what is stalker IPTV used for, exactly? It acts as the intermediary layer between IPTV content servers and the devices subscribers use to watch TV. It doesn’t host or stream content itself. Think of it like the operating system of an IPTV service — the content servers are the hardware and Stalker is the OS managing everything on top.

Stalker handles:

• Authentication — verifying which devices are allowed access
• Channel delivery — organizing and serving live TV channel lists
• EPG (Electronic Program Guide) — the on-screen TV schedule
• VOD libraries — organizing movies and series with metadata
• Subscription tiers — controlling which content each subscriber can access
• The subscriber interface — everything the viewer sees on their TV

The platform powers over 4,500 IPTV/OTT projects across 150+ countries with more than 20 million households running Infomir hardware. Around version 5.3, Infomir officially rebranded the product to Ministra TV Platform — but the “Stalker” name stuck hard in the community. Tools, forums, and Reddit threads still use it almost exclusively.

---

The History Behind the Name

Understanding the naming situation saves a lot of confusion when researching this topic.

Infomir developed the original Stalker Middleware in the early 2000s alongside its first MAG set-top boxes. The name had nothing to do with surveillance — it referenced the 1979 Soviet film Stalker by Andrei Tarkovsky, a cultural touchstone in Eastern Europe. The software grew alongside Infomir’s hardware business through the 2000s and 2010s as MAG boxes became the default hardware choice for professional IPTV operators globally.

At version 5.3 (approximately 2017–2018), Infomir rebranded the product as Ministra TV Platform to reflect broader applicability beyond just MAG hardware. The free tier became Ministra and a paid professional tier called Ministra Pro launched with enhanced support and features for large operators.

Despite the official rebrand, virtually everyone in the IPTV industry still calls it Stalker. Search any IPTV community — whether Reddit threads discussing what is stalker IPTV, technical forums, or third-party tool documentation — and “Stalker portal” dominates. The rebrand changed the product name but not the culture around it.

---

What Middleware Actually Does in an IPTV System

To understand what is stalker IPTV used for in a real deployment, you need to understand where middleware fits in the broader IPTV infrastructure. The typical stack has three layers:

Layer 1 — Content and streaming infrastructure

This includes the source streams (satellite feeds, encoder outputs, licensed content libraries), the stream servers (often running Nginx-RTMP, Wowza, or Flussonic), and the CDN or multicast network delivering streams to subscribers.

Layer 2 — Middleware (Stalker)

Stalker sits here. It doesn’t touch the actual video streams in normal operation. Instead, it manages the relationship between the content infrastructure and the subscriber devices — who can watch what, when, on which device, in what interface.

Layer 3 — Client devices

MAG boxes, Android TV devices running STBEmu, smart TVs running Smart STB, and any other compatible client that connects to the Stalker portal.

When your MAG box or STBEmu app powers on, here’s what actually happens in sequence:

1. The device connects to the Stalker portal URL
2. The portal authenticates the device via MAC address
3. The device receives its configuration, subscription details, and channel list
4. Stalker renders a full TV-like interface on your screen with the channels, EPG, and VOD your subscription allows

The operator controls all of this from a single admin panel. The subscriber only ever interacts with the TV interface. The middleware defines exactly what that interface contains and what it permits.

---

The Technical Architecture — How the Server-Client Model Works

Stalker runs on a LAMP-style server stack with a specific dual-server configuration optimized for performance and separation of concerns.

Component	Role	Detail
Nginx (port 80)	Front-end reverse proxy	Serves static files (HTML, CSS, JS, images) with 30-day cache expiry
Apache2 (port 88)	Back-end application server	Processes all PHP logic behind the scenes
MySQL (stalker_db)	Primary database	Stores users, channels, subscriptions, tokens, EPG
Memcached	Query caching layer	Dramatically reduces database load under concurrent connections
Node.js/NPM	Front-end build tooling	Compiles the Smart Launcher client applications

Why Dual Web Servers?

The Nginx + Apache2 split is a deliberate architectural decision. Nginx excels at serving static files at high concurrency with minimal memory overhead — it handles thousands of simultaneous connections efficiently. Apache handles dynamic PHP requests, which are slower and more resource-intensive, but these happen less frequently than static file requests.

A typical STB session might load dozens of static assets (interface graphics, JavaScript files, CSS) but only make periodic dynamic API calls to load.php. Nginx handles the heavy static traffic cheaply and forwards only the dynamic requests to Apache. This separation significantly improves the portal’s ability to handle many simultaneous connected devices.

Server Directory Structure

The portal installs to /var/www/stalker_portal/ on the server filesystem. Knowing this structure matters when you’re learning how to use stalker portal at the admin or developer level:

The /c/ directory is what STBs connect to. It contains index.html and a JavaScript application that runs inside the STB’s embedded WebKit browser. Every piece of dynamic data — channel lists, EPG, VOD titles, account info, configuration — arrives via AJAX requests to load.php. The entire subscriber-facing experience is a web application running in a constrained browser environment.

PHP Extensions Required

The back-end PHP environment requires specific extensions for full functionality:

• php-mysql — Database connectivity
• php-curl — External HTTP requests (stream health checks, TMDB metadata fetching)
• php-imagick — Image processing for channel logos and VOD art
• php-mcrypt — Encryption functions
• php-memcache — Caching integration

Missing any of these extensions causes specific features to silently fail rather than producing obvious errors — a common source of debugging frustration during initial setup.

---

The Full Handshake Flow — Step by Step

Every connection between a device and a Stalker portal follows a precise, predictable sequence governed by OAuth 2.0 with Bearer tokens (RFC 6750). This is the core mechanism behind how to use stalker portal at the protocol level. Here’s exactly what happens from power-on to watching live TV.

Step 1 — Handshake (Token Request)

The device sends a GET request to:

/stalker_portal/server/load.php?type=stb&action=handshake&token=&JsHttpRequest=1-xml

The MAC address travels as a Cookie header:

The User-Agent mimics real MAG hardware. The server receives this request and performs several operations:

1. Extracts the MAC address from the Cookie header
2. Runs SELECT * FROM users WHERE mac=’00:1A:79:18:05:75′ against the stalker_db database
3. Checks whether the account status field equals 1 (active)
4. Generates a session token using strtoupper(md5(uniqid(rand(), true)))
5. Stores the token in the database with a timestamp
6. Returns the token as a 32-character uppercase hexadecimal string

Example token response:

{

  “js”: {

    “token”: “C00F7332ED272F00D5FD3E82F567A282”,

    “random”: “some_random_string”

  }

}

This token is now the device’s session credential. Every subsequent request in the session includes it.

Step 2 — Profile Retrieval

With the token in hand, the device immediately requests its full profile:

type=stb&action=get_profile

This request includes extensive hardware parameters in the query string:

serial_number=AB1234567890

device_id=01AB23CD45EF

device_id2=67890ABCDEF0

stb_type=MAG254

hw_version=2.9-BD-00

image_version=218

timestamp=1234567890

signature=<calculated_hash>

All requests from this point forward include two critical headers:

Authorization: Bearer C00F7332ED272F00D5FD3E82F567A282

Cookie: mac=00:1A:79:18:05:75; stb_lang=en; timezone=Europe/Amsterdam

The server returns a massive JSON profile with 100+ fields covering:

• Device display settings (screen resolution, aspect ratio, audio output)
• Subscription information and expiry date
• Assigned tariff plan and its permissions
• Feature flags (catch-up enabled, time-shift enabled, VOD access, radio access)
• UI configuration parameters
• The critical watchdog_timeout value — typically 88 seconds — defining how often the device must send heartbeats
• play_token_salt used for generating secure stream access tokens
• Maximum concurrent connections allowed for this account

The profile response essentially tells the device everything about what it’s allowed to do and how to behave. A device on a basic tariff plan gets a profile with VOD and catch-up disabled. A device on a premium plan gets a profile with every feature enabled.

Step 3 — Genre and Channel List Fetch

The device requests channel categories first:

type=itv&action=get_genres

Response example:

{

  “js”: [

    {“id”: “1”, “title”: “All”, “alias”: “all”, “censored”: “0”},

    {“id”: “2”, “title”: “Sports”, “alias”: “sports”, “censored”: “0”},

    {“id”: “3”, “title”: “Movies”, “alias”: “movies”, “censored”: “0”}

  ]

}

Then the device fetches the paginated channel list for each genre:

type=itv&action=get_ordered_list&genre=1&p=1&sortby=number&fav=0&search=

Pages return 14 channels each. Each channel entry contains:

{

  “id”: “123”,

  “name”: “BBC One HD”,

  “number”: “101”,

  “cmd”: “ffmpeg http://stream.server.com/bbc1/index.m3u8”,

  “logo”: “http://portal.server.com/stalker_portal/misc/logos/bbc1.png”,

  “tv_genre_id”: “1”,

  “base_ch”: “1”,

  “archive”: “1”,

  “archive_days”: “7”,

  “epg_progname”: “BBC One”,

  “xmltv_id”: “bbc-one-hd”

}

The device loads page after page until it has the complete channel list. For portals with 2,000+ channels, this involves dozens of API calls in rapid succession.

Step 4 — EPG Data

After loading channels, the device fetches EPG (program guide) data:

type=epg&action=get_simple_data_table&ch_id=123

The server returns current and upcoming program data for that channel. The EPG data comes from XMLTV files that the operator imports and the server processes into the database. The device typically requests EPG for the currently visible channels rather than the entire list at once.

Step 5 — Stream Link Creation

When you select a channel, the device doesn’t use the stream URL from the channel list directly. Instead, it requests a dynamically generated link:

type=itv&action=create_link&cmd=ffmpeg http://stream.server.com/bbc1/index.m3u8&series=0&forced_storage=undefined&disable_ad=0&download=0&JsHttpRequest=1-xml

The server generates a time-limited play token and returns the actual playable URL:

{

  “js”: {

    “cmd”: “ffmpeg http://stream.server.com/bbc1/index.m3u8?play_token=D4F823A1B509”,

    “streamer_name”: “bbc1”

  }

}

The play_token in the returned URL is unique to this session and expires after a short window. This prevents static stream URLs from leaking and being used outside the authenticated session — a meaningful (if not impenetrable) security layer.

Step 6 — Heartbeat/Watchdog

Every 88 seconds (based on the watchdog_timeout value from the profile), the device sends a keep-alive signal:

type=watchdog&action=get_events&cur_play_type=1&init_num=101&buffering_err=0&need_quality=0

The cur_play_type field tells the server what the device is currently doing (1 = watching live TV, 2 = VOD, etc.). The server performs several operations on receiving each heartbeat:

1. Updates the keep_alive and last_watchdog timestamps for this MAC in the database
2. Checks whether this MAC is appearing from multiple IP addresses simultaneously (MAC cloning detection)
3. Delivers any pending events — messages from the operator, reboot commands, channel update notifications
4. Verifies subscription status and token validity

If heartbeats stop arriving, the server marks the session inactive. When the device reconnects (after a network drop, for example), it performs a full handshake again and gets a fresh token. Sessions don’t resume — they restart.

---

How MAC Address Authentication Works

A MAC (Media Access Control) address is a 48-bit hardware identifier permanently assigned to every network interface. It’s written as six hexadecimal octets separated by colons: XX:XX:XX:XX:XX:XX. Every genuine Infomir MAG device uses the OUI (Organizationally Unique Identifier) prefix 00:1A:79, so all real MAG addresses follow the pattern 00:1A:79:xx:xx:xx.

Stalker uses the MAC address as the primary — and by default only — authentication credential. No username or password required. This design reflects the reality of the STB environment: subscribers use remote controls, not keyboards, and every physical MAG box carries a unique factory-assigned MAC that authenticates automatically without user input.

How MAC Authentication Flows Through the System

When a device connects and sends its MAC in the Cookie header, the server runs a series of checks:

SELECT u.*, t.*, s.*

FROM users u

LEFT JOIN tariffs t ON u.tariff_id = t.id

LEFT JOIN stb_settings s ON u.mac = s.mac

WHERE u.mac = ’00:1A:79:18:05:75′

The result determines the entire session:

status value	Result
1 (active)	Authentication proceeds, token generated
0 (blocked)	Subscriber sees “Your STB is blocked / call the provider”
Not found	Subscriber sees an error or empty portal depending on configuration

Administrators register MACs through the Users section of the admin panel, specifying the MAC address, assigned tariff plan, account number, account status, and billing expiry date. The allowed_stb_types configuration parameter controls which STB model types the portal accepts, and by default Stalker only accepts MACs with the Infomir OUI prefix.

Why MAC Authentication Has Vulnerabilities

The MAC-based system has an inherent structural weakness: MAC addresses can be spoofed in software. Any device can present any MAC address to a network. This is precisely how STBEmu works — the Android app presents a virtual MAC address of the operator’s choosing to the Stalker server, mimicking a physical MAG box. The server has no reliable way to distinguish a real MAG254 from an Android phone presenting 00:1A:79:AB:CD:EF.

For legitimate operators, this means:

• A subscriber can use their Stalker credentials on multiple devices simultaneously if the operator doesn’t enforce session limits
• Credentials can be shared between users trivially
• STBEmu on a phone and a physical MAG box can both use the same MAC if the subscriber switches between them

Security enhancements available in Stalker to mitigate this:

oauth_force_serial_number_check — Validates the serial number alongside the MAC. Since serial numbers aren’t as easily spoofed as MACs (STBEmu lets users set them, but casual sharing is less common), this reduces unauthorized sharing.

strict_stb_type_check — Enforces that the STB model reported in the profile request matches what the operator expects for that MAC. Prevents a MAG254 MAC from being used by an app claiming to be a MAG256.

log_mac_clones — Logs and optionally blocks cases where the same MAC appears from multiple different IP addresses in short succession. This is the primary tool for detecting account sharing.

max_connections_per_mac — Hard limits concurrent sessions per MAC address.

---

What a Stalker Portal URL Looks Like

The standard portal URL format:

http://[server_ip_or_domain]/stalker_portal/c/

Here’s what each component means:

Component	Meaning
http:// or https://	Protocol — always push operators to use HTTPS in production
[server_ip_or_domain]	Server IP or domain, optionally with custom port (e.g., :8080)
/stalker_portal/	Base application path (maps to /var/www/stalker_portal/ on the filesystem)
/c/	Client portal directory — the STB-facing web application lives here

Missing the /c/ at the end is the single most common mistake when configuring a Stalker portal in STBEmu or any other client. Without it, the app hits a different path and authentication fails immediately with no helpful error message.

URL Variations in the Wild

Not every Stalker deployment uses the standard path. Operators sometimes customize:

• http://server/c/ — Shortened path with Nginx alias configuration
• http://server:2095/stalker_portal/c/ — Custom port (common for ISP IPTV deployments)
• https://iptv.provider.com/stalker_portal/c/ — HTTPS with domain name (production standard)
• http://192.168.1.100/stalker_portal/c/ — Local IP for home lab or testing setups

When troubleshooting portal connectivity, always confirm the exact URL with your provider. Even a trailing slash difference can matter depending on server configuration.

Other Key Server Endpoints

Beyond the main client URL, several other endpoints matter:

• /stalker_portal/server/adm/              → Admin panel login
• /stalker_portal/auth/token.php           → OAuth2 endpoint for REST API v2/v3
• /stalker_portal/server/tools/m3u.php     → M3U playlist generator
• /stalker_portal/api/                     → REST API v1 for programmatic management
• /stalker_portal/server/load.php          → Primary STB API endpoint

The M3U generator at m3u.php is particularly useful for operators who want to offer M3U playlists to subscribers alongside or instead of the full portal experience — it generates an M3U from the same channel database the portal uses.

---

Compatible Devices and Players

MAG Set-Top Boxes — The Native Hardware

MAG boxes are Infomir’s own hardware, designed from the ground up for Stalker. Each generation brought meaningful improvements in processing power, codec support, and resolution:

Model	Year	CPU	RAM	Max Resolution	Key Feature
MAG250	2012	STi7105 450 MHz	256 MB	1080p	Foundational model, no HEVC
MAG254	2014	STiH207 650 MHz	512 MB	1080p	Most widely deployed for years
MAG256	2016	ARM Cortex-A9 1.5 GHz	1 GB	1080p	First with HEVC/H.265
MAG322	2017	Broadcom BCM75839	512 MB	1080p	HEVC, marketed as MAG254 evolution
MAG420	2019	HiSilicon Hi3798MV200 quad-core	512 MB	4K UHD	First 4K MAG
MAG424	2019	HiSilicon Hi3798MV200 quad-core	1 GB	4K UHD	USB 3.0
MAG524	2021	Amlogic S905X2 quad-core	1 GB	4K HDR	HDMI 2.1
MAG540/544	Current	Amlogic S905Y4	2 GB	4K HDR 60fps	AV1 + HEVC
MAG555	Current	Android-based	2 GB	4K	Full Android OS

Choosing a MAG box: The MAG254 was the workhorse of the IPTV industry for nearly a decade but lacks HEVC support — a real limitation now that many providers encode HD channels in H.265 for bandwidth efficiency. If you’re buying new hardware, the MAG322 or MAG420+ are the realistic minimum depending on whether you need 4K. The MAG555 runs full Android, giving you access to any Android app alongside the native Stalker interface.

STBEmu — The Most Important Third-Party Client

If you’ve ever searched what is stalker IPTV on Reddit, you’ve seen STBEmu mentioned constantly — and for good reason. This Android app emulates complete MAG box behavior, presenting a virtual MAC address to the Stalker server so the portal responds exactly as if a physical device connected.

Key facts about STBEmu:

• Supports only the Stalker portal protocol — no M3U or Xtream Codes
• Available as free and Pro versions on Google Play
• Works on Android phones, tablets, Android TV boxes, Amazon Fire TV Stick, NVIDIA Shield, and any Android TV device
• The Pro version adds features like multiple profile support, no ads, and additional STB model emulation profiles

Setting up STBEmu step by step:

1. Install STBEmu (or STBEmu Pro) from the Google Play Store
2. Open the app and go to Settings (gear icon in top right)
3. Navigate to Profiles → Add Profile (or edit the default profile)
4. Under STB configuration:
   • Set Portal URL to your provider’s portal URL (must end in /c/)
   • Set MAC address to the MAC your provider registered (format: 00:1A:79:XX:XX:XX)
   • Set STB model to MAG254 or MAG322 (most universally compatible)
5. Return to the main screen and the app automatically performs the handshake
6. After ~10 seconds, your channel list loads

If authentication fails, return to settings and verify the portal URL ends exactly with /c/ and the MAC matches what your provider has registered. Case matters — use uppercase for the hex digits.

A note on IPTV stalker player GitHub: Several developers maintain open-source clients and tooling built around the Stalker protocol on GitHub. Searching “stalker portal client” or “stalker IPTV” on GitHub reveals community-built players, Python libraries for programmatic portal access, and admin tools that extend or replace the official interface. These are useful for developers integrating Stalker into custom workflows but require technical knowledge to deploy.

Smart STB for Samsung and LG Smart TVs

Smart STB is a Smart TV app that brings full Stalker portal support to Samsung (Tizen OS) and LG (webOS) televisions. It works by emulating a MAG box within the TV’s app environment, presenting a virtual MAC address just like STBEmu does on Android.

Configuration mirrors STBEmu: enter the portal URL in the app settings and set your MAC address. Smart STB supports multiple profiles so you can switch between providers. One important caveat — the MAC address Smart STB presents needs to match what your provider has registered. Contact your provider for the specific MAC assigned to your account, or ask them to register the MAC that Smart STB generates.

Full Compatibility Matrix

Player	Platform	Stalker	M3U	Xtream Codes	Notes
STBEmu	Android / Fire TV	✅	❌	❌	Stalker only; most faithful emulation
TiviMate	Android TV	✅	✅	✅	Best Android TV player overall
IPTV Smarters Pro	iOS, Android, Windows	✅	✅	✅	Cross-platform workhorse
Smart STB	Samsung / LG Smart TV	✅	❌	❌	Best option for Smart TVs
OTT Navigator	Android	✅	✅	✅	Highly customizable
STB IPTV	iOS	✅	✅	❌	Native Stalker on iPhone/iPad
SFVIP Player	Windows	✅	✅	✅	Good Windows option
Kodi + PVR IPTV Simple	Cross-platform	❌	✅	❌	M3U only; no native Stalker
Perfect Player	Android / Windows	❌	✅	✅	No Stalker support
GSE Smart IPTV	iOS / Android	❌	✅	✅	No Stalker support
VLC	Cross-platform	❌	✅	❌	Can play individual streams, not portal

The critical takeaway: Perfect Player and GSE Smart IPTV do not support Stalker portals at all. These are popular apps but if your provider gives you only a Stalker portal URL, you need a different app — or you need to ask your provider for M3U or Xtream credentials.

---

Installing and Managing Stalker Middleware as an Operator

Understanding how to use stalker portal at the admin level requires knowing the full stack. This section covers what operators actually do to deploy and manage the system.

Server Requirements

Stalker needs a Linux server — Ubuntu LTS is the recommended distribution (18.04, 20.04, or 22.04 all have community support). Minimum specs for a small deployment (under 500 concurrent users):

• 4 CPU cores
• 8 GB RAM
• 100 GB SSD storage
• 100 Mbps network interface (for portal traffic only — stream bandwidth is separate)

Larger deployments with thousands of concurrent users require proportionally more resources, particularly RAM for Memcached and MySQL query caching.

Installation Overview

The full installation stack requires:

# Core web servers

• nginx
• apache2

# PHP and required extensions

• php7.4
• php7.4-mysql
• php7.4-curl
• php7.4-imagick
• php7.4-mcrypt
• php7.4-memcache
• php7.4-xml

# Database and caching

• mysql-server
• memcached

# Node.js for building front-end

• nodejs
• npm

# Build tooling

• php-pear
• php-phing

The deployment process involves:

1. Creating the stalker_db MySQL database and granting permissions to the stalker user
2. Deploying portal files to /var/www/stalker_portal/
3. Configuring Nginx as reverse proxy on port 80 (or 443 for HTTPS)
4. Configuring Apache2 on port 88 for PHP processing
5. Running phing from the deploy directory to initialize the database schema and build front-end assets
6. Setting file permissions correctly for the web server user
7. Changing default admin credentials from admin/1 immediately

Docker deployment via docker-compose exists and is increasingly popular for operators who want cleaner environment management. Community auto-install scripts for Ubuntu automate most of the above but require careful review before running on production systems.

The Admin Panel — What Every Section Controls

Once installed, the admin panel at /stalker_portal/server/adm/ is where all management happens.

IPTV Channels

Adding a channel requires:

• Channel name — What subscribers see in the channel list
• Number — Position in the channel list (determines ordering)
• Genre — Category assignment for filtering
• Stream command — The actual stream URL with a protocol prefix:
  • ffmpeg http://stream.server.com/channel/index.m3u8 — HTTP/HTTPS streams (HLS, most common)
  • ffmpeg rtsp://stream.server.com/channel — RTSP streams
  • udp://239.1.1.1:1234 — Multicast UDP (for closed network deployments like hotels)
  • http://stream.server.com/live/user/pass/12345 — Direct HTTP streams
• Logo URL — Channel logo image (served from the portal server or external CDN)
• XMLTV ID — Matches this channel to an EPG source for program guide data
• Archive settings — Enable/disable catch-up TV and set the recording retention period (days)

Video Club (VOD)

The VOD section manages the on-demand library. Stalker integrates with TMDB (The Movie Database) for metadata autofill — enter a title and the system automatically pulls poster art, descriptions, cast information, and ratings. You can organize content into categories (movies, series, children’s content, etc.) and assign access by tariff plan.

For series content, Stalker supports multi-season structures with individual episode entries, progress tracking (so subscribers can resume from where they left off), and series-level subscriptions.

Users (Subscriber Management)

The Users section is the most actively used section for day-to-day operations. Each subscriber record contains:

• MAC address — The primary identifier
• Account number — Internal reference
• Status — Active (1) or blocked (0)
• Tariff plan — Which service package this subscriber accesses
• Account expiry date — When the subscription runs out (Stalker automatically blocks access after expiry)
• Package expiry date — Separate VOD package expiry if applicable
• Last active — Timestamp of last heartbeat received (invaluable for troubleshooting)
• IP address — Last known IP of the device
• Notes — Free-text field for operator reference

Bulk operations let operators import subscriber lists via CSV, useful when migrating from another platform.

Tariffs (Service Packages)

Tariffs define what each subscription tier includes. A typical deployment might have:

• Basic — Live TV only, no VOD, no catch-up, SD and HD channels
• Standard — Live TV + VOD + 3-day catch-up, all channels except premium sports
• Premium — Everything, including premium sports, 7-day catch-up, 4K channels where available

Each tariff specifies exactly which channel genres are accessible and which VOD categories are available. When you assign a tariff to a subscriber, their profile response reflects those permissions and the client interface only shows what they’re allowed to access.

EPG (Electronic Program Guide)

Stalker imports EPG data in XMLTV format — an XML standard widely used in the IPTV industry. The import process:

1. Obtain an XMLTV file from a provider or generate one (community tools like EPG Importer produce compatible files)
2. Upload or specify the URL of the XMLTV file in the admin panel
3. Match each XMLTV channel id to the corresponding channel in your database via the xmltv_id field
4. Schedule automatic updates (EPG files typically cover 7–14 days and need regular refreshing)

The quality of your EPG depends entirely on the quality of the XMLTV source. Many IPTV providers purchase EPG data from commercial providers for accuracy. Free XMLTV sources exist but coverage varies significantly by region and channel.

Statistics

The Statistics section provides real-time and historical operational data:

• Online now — Current active sessions with device info, channel being watched, and IP address
• Activity log — Historical session data including connection times, channels watched, and session durations
• Error log — Authentication failures, stream errors, and system events
• Top channels — Most-watched channels over selectable time periods

This section is genuinely useful for capacity planning (identifying peak usage times), content decisions (which channels justify the licensing cost), and troubleshooting (diagnosing why a specific subscriber is having issues).

The REST API for Programmatic Management

Stalker’s REST API v1 at /stalker_portal/api/ enables integrating the portal with billing systems, customer portals, and automation tools. Key endpoints:

• GET  /api/accounts/           → List all subscriber accounts
• POST /api/accounts/           → Create a new account
• PUT  /api/accounts/{mac}/     → Update account details (status, tariff, expiry)
• DELETE /api/accounts/{mac}/   → Remove an account
• GET  /api/itv/                → List all channels
• POST /api/itv/                → Add a channel
• PUT  /api/itv/{id}/           → Update channel details
• GET  /api/tariffs/            → List all tariff plans
• POST /api/send_event/         → Send commands to specific devices

The send_event endpoint is particularly powerful. You can push the following commands to specific MAC addresses:

• reboot — Remotely restart a device (useful after adding channels or changing settings)
• update — Trigger a firmware update reload_stb — Reload the portal without full reboot
• show_message — Display a message on the subscriber’s screen
• channel_changed — Notify the device that the channel list has been updated so it refreshes without restart

Operators running large deployments use the API to integrate Stalker with WHMCS or similar billing platforms, so subscriptions activate and expire automatically based on payment status.

---

Stalker Middleware vs. Xtream Codes API

This comparison comes up constantly in communities discussing what is stalker IPTV and how it differs from other delivery formats. The core difference is the authentication model, but the implications run deeper.

Authentication Model

Stalker: MAC address authentication. The credential is bound to a specific hardware identifier. The subscriber doesn’t manage credentials — the device authenticates automatically. The downside is that changing devices requires re-registering the MAC with the provider.

Xtream Codes: Username + password authentication. Fully portable across any device or app. The subscriber can use the same credentials on a phone, smart TV, laptop, and MAG box simultaneously. Much more flexible but also much more easily shared.

The Xtream Codes History

Xtream Codes was a competing IPTV middleware platform that Eurojust dismantled in a September 2019 operation codenamed “Eclisse.” Italian authorities arrested the Greek operators and seized servers serving an estimated 50 million users across Europe. The platform was accused of facilitating large-scale piracy.

However, the API format survived the shutdown because it was simple and well-documented. Clones like Xtream UI, XUI One, and Xtream Panel replicated the format exactly. Today, the Xtream Codes API is essentially a public standard that dozens of independent platforms implement. The format’s simplicity — a handful of HTTP endpoints using username/password authentication — made it easy to clone.

Feature Comparison

Feature	Stalker	Xtream Codes
Authentication	MAC address (hardware-bound)	Username + password
Device portability	Limited (MAC-specific)	Full (any device, any app)
App support	Moderate (STBEmu, TiviMate, Smarters, Smart STB)	Broad (virtually every IPTV player)
Interface quality	Full integrated TV experience	Depends entirely on the player app
M3U generation	Via m3u.php tool	Native via get.php?type=m3u_plus
Admin control	Comprehensive (admin panel + REST API)	Varies by platform
Anti-sharing	MAC clone detection, session limits	IP limits, connection tracking
Best deployment	Hotels, telecoms, managed MAG environments	Consumer multi-platform IPTV
Perfect Player support	❌	✅
GSE Smart IPTV support	❌	✅
TiviMate support	✅	✅

Which Should You Use?

The answer depends on your use case. For operators managing a hotel, hospital, or telecom network where devices are fixed and controlled, Stalker’s hardware-binding is actually an advantage — you know exactly which physical device has which subscription and can enforce usage strictly.

For consumer IPTV providers competing in a market where subscribers expect to watch on phones, tablets, smart TVs, and laptops interchangeably, Xtream Codes’ broader app support is a significant advantage.

Many providers now offer both. The same subscription gets a Stalker portal URL for MAG boxes and STBEmu users plus Xtream Codes credentials for TiviMate and other apps. This is increasingly the standard approach.

---

Stalker Portals vs. M3U Playlists — A Detailed Comparison

These two approaches represent fundamentally different philosophies for IPTV delivery.

What an M3U Playlist Actually Is

An M3U file is a plain text document. Nothing more. It lists stream URLs with metadata tags:

#EXTM3U

#EXTINF:-1 tvg-id=”bbc1″ tvg-name=”BBC One” tvg-logo=”http://logos.server.com/bbc1.png” group-title=”UK”,BBC One HD

http://stream.server.com/live/username/password/12345

#EXTINF:-1 tvg-id=”itv” tvg-name=”ITV” tvg-logo=”http://logos.server.com/itv.png” group-title=”UK”,ITV HD

http://stream.server.com/live/username/password/12346

Any text editor creates one. Any media player reads one. There’s no server handshake, no authentication flow, no session management. The URLs in the file work as long as the streaming server accepts them.

The Trade-Off Table

Aspect	M3U Playlist	Stalker Portal
Infrastructure required	None (just a URL or file)	Full server stack (LAMP + Stalker)
App compatibility	Universal	Limited to compatible players
EPG integration	Via separate tvg-url reference	Built-in, server-managed
VOD support	None natively	Full library with metadata
Catch-up TV	None	Full server-side recording support
Authentication	URL-embedded credentials	MAC-based session management
Security	URLs easily extracted and shared	Session tokens, MAC binding
Setup complexity	Minimal	Significant
Operator control	None after delivery	Complete centralized control
Load time	Instant (parsing a text file)	Slower (multiple API calls)
Offline usability	Can cache the file	Requires server connection

When Each Makes Sense

Use M3U when:

• You’re setting up a personal IPTV solution quickly
• Your preferred player doesn’t support Stalker
• You want maximum compatibility across devices
• You don’t need catch-up TV or a managed VOD library

Use a Stalker portal when:

• You’re running a professional IPTV service for subscribers
• You need centralized control over subscriber access
• Catch-up TV and a proper VOD library are important
• You’re deploying to a closed environment (hotel, business, hospital)
• MAG boxes are your primary device ecosystem

---

Common Problems and How to Fix Them

Authentication Failed

This is the most frequent issue. Work through these checks in order:

1. Portal URL format The URL must end with /c/. Not /c, not /stalker_portal/, not just the domain. The exact format: http://server/stalker_portal/c/

Test the URL in a desktop browser first. You should see a basic HTML page or loading indicator. If you get a 404 error, the URL is wrong.

2. MAC address format and registration The MAC must be:

• Uppercase hex digits: 00:1A:79:AB:CD:EF not 00:1a:79:ab:cd:ef
• Colon-separated, not dash-separated: 00:1A:79 not 00-1A-79
• Registered by your provider with active status

Contact your provider and confirm the exact MAC they have registered for your account. Copy it directly rather than typing.

3. STB model profile in STBEmu Some providers configure their portal to only accept specific STB model types. If you’re using STBEmu, try switching the STB model profile to MAG254 first — it’s the most universally accepted. If that fails, try MAG322.

4. Subscription status Expired subscriptions return authentication errors. Check with your provider whether your subscription is active and when it expires.

5. IP restrictions Some providers block connections from certain countries or IP ranges. A VPN can resolve this — connect to a server location your provider accepts.

Portal URL Not Loading

If the portal URL times out or returns a connection error:

• DNS resolution failure: Try alternative DNS servers. Google’s 8.8.8.8 and Cloudflare’s 1.1.1.1 resolve most DNS blocking. In STBEmu, check if there’s a DNS server setting in network configuration.
• ISP blocking: Some ISPs block IPTV portal domains or IP addresses, particularly in countries with aggressive anti-piracy enforcement. A VPN bypasses this reliably.
• Server downtime: Test whether the issue is on your end by asking your provider or checking their status page. Stalker portals go offline for maintenance and updates.
• Port blocking: If the portal uses a non-standard port (like 8080 or 2095), your network might block it. Try connecting from a mobile data connection to test whether the issue is network-specific.

Buffering and Freezing

This is the most nuanced problem because multiple causes produce identical symptoms.

Bandwidth: HD streams typically need 15–20 Mbps sustained throughput. 4K streams need 25–50 Mbps. Run a speed test at fast.com and check whether your available bandwidth matches.

Wi-Fi interference: Wi-Fi introduces variable latency and packet loss that even high-bandwidth connections can suffer from. The single most effective hardware fix is a wired Ethernet connection. If running cable isn’t practical, a powerline adapter or MoCA adapter provides near-wired performance over your existing home wiring.

ISP throttling: Some ISPs throttle IPTV traffic specifically during peak hours (typically 7–11 PM). Symptoms are buffering that consistently appears during evening hours but not at other times. A VPN using the WireGuard protocol (lower overhead than OpenVPN) typically bypasses throttling with minimal speed penalty.

Buffer size settings: Most IPTV players let you configure the playback buffer size. For stable connections, 10–15 seconds is appropriate. For unstable connections (mobile data, congested Wi-Fi), increase to 20–25 seconds. A larger buffer prevents interruptions but increases the delay before playback starts.

Server-side stream quality: Sometimes the issue is upstream — the stream source itself is problematic. Test by switching to a different channel on the same provider. If all channels buffer equally, your connection is likely the issue. If specific channels buffer but others don’t, the stream source for those channels is the problem.

Black Screen

A black screen after selecting a channel (with audio but no video, or complete silence) usually indicates a codec mismatch.

• HEVC/H.265 on older hardware: If you’re on a MAG250 or MAG254 (no HEVC support), any channel encoded in H.265 produces a black screen. The fix is either hardware upgrade or asking your provider for H.264 stream alternatives.
• Hardware decoding conflicts: Toggle hardware decoding off in your player settings. Software decoding is slower but more compatible. If the channel plays correctly with hardware decoding off, there’s a hardware acceleration compatibility issue.
• HDR on non-HDR displays: 4K HDR streams on non-HDR TVs can produce black screens if the HDR metadata confuses the display’s HDMI handshake. Adjust video output settings to disable HDR passthrough.

Session Drops and Reconnections

Frequent disconnections mid-stream usually come from one of three causes:

Token expiry: Stalker session tokens have a finite lifespan. If your client loses network connectivity even briefly and misses heartbeat windows, the server marks the session expired. The client needs to perform a full handshake on reconnection. This is normal behavior — the session restarts automatically.

MAC cloning detection: If your provider has log_mac_clones enabled and your MAC appears from multiple IP addresses (because you’re sharing credentials or because your IP changed mid-session through CGNAT), the server may force a session reset.

Network instability: Intermittent packet loss causes the heartbeat mechanism to miss its 88-second window, triggering a session drop. Diagnose with a continuous ping to your provider’s server while watching — any significant packet loss (>2%) correlates with session drops.

---

Advanced Topics for Operators and Developers

Running Multiple Stalker Portals on One Server

Large IPTV operators sometimes serve multiple brands or client bases from a single server. Stalker supports this through separate portal installations, but they share the underlying MySQL instance. Each portal installation gets its own virtual host in Nginx/Apache and its own database prefix.

This architecture reduces hardware costs but requires careful resource planning — one database server handles all portals simultaneously, so query optimization and Memcached configuration become critical at scale.

Integrating DRM with Stalker

For operators distributing premium licensed content (sports, premium channels), Digital Rights Management (DRM) prevents stream recording and redistribution. Stalker supports integration with:

• Widevine — Google’s DRM system; works on Android, Chrome, and Widevine-certified devices
• FairPlay — Apple’s DRM; required for iOS device support
• PlayReady — Microsoft’s DRM; used in Windows and some smart TV ecosystems
• Verimatrix — Enterprise-grade DRM common in telecoms

DRM integration requires additional server components beyond the base Stalker installation and typically involves contracts with DRM licensing organizations. The complexity is significant but unavoidable for operators distributing content under studio licensing agreements.

Catch-Up TV Architecture

Catch-up TV (watching broadcasts that aired in the past) requires server-side recording infrastructure beyond what Stalker itself provides. The typical setup:

1. A transcoding/recording server (Flussonic or similar) continuously records streams for channels with catch-up enabled
2. Recordings are stored on high-capacity storage (NAS or object storage)
3. Stalker’s EPG system tracks what was broadcast when
4. When a subscriber requests catch-up, Stalker generates a time-shifted stream link pointing to the appropriate recording segment

The archive_days setting per channel controls how many days of recordings to retain. More retention days means more storage requirements — a single HD channel recording continuously at 3 Mbps consumes roughly 32 GB per day.

Security Hardening Checklist

For operators deploying Stalker in production:

• [ ] Change default admin credentials (admin/1) immediately after installation
• [ ] Enable HTTPS with a valid SSL certificate (Let’s Encrypt works well)
• [ ] Configure firewall rules so port 88 (Apache) is only accessible from localhost
• [ ] Enable log_mac_clones in config.ini to detect sharing
• [ ] Set strong MySQL root and stalker user passwords
• [ ] Keep Stalker/Ministra updated — version 5.4.1 had a documented SQL injection vulnerability
• [ ] Enable fail2ban to block repeated authentication failures
• [ ] Restrict admin panel access by IP address if your admin team uses static IPs
• [ ] Enable two-factor authentication on the admin panel if your Ministra Pro version supports it
• [ ] Configure regular automated backups of the stalker_db database

---

Legal and Security Considerations

Let’s be clear: Stalker Middleware is completely legal software. Infomir is a registered European company manufacturing electronics since 2001. Ministra (formerly Stalker) comes in free and professional (Ministra Pro) tiers for licensed IPTV operators. Hotels, hospitals, telecom providers, universities, and cruise ships use it daily for entirely legitimate services.

The middleware is content-neutral. What determines legality is whether the content being delivered has proper licensing — not the platform delivering it. A Stalker portal serving licensed content from a legitimate IPTV provider is no different from any other licensed streaming service infrastructure. A Stalker portal distributing pirated streams operates illegally. The software itself is neutral.

This principle was reinforced in the Xtream Codes case, where Italy’s Court of Appeals found no evidence that the software platform itself acted unlawfully — the illegality lay in the content served, not the delivery mechanism.

Privacy Considerations for Subscribers

MAC addresses transmit in plaintext HTTP headers with every request. Without HTTPS, anyone on the network path between your device and the portal server can observe your MAC address, what channels you watch, and when you watch them. On a home network this is a low-risk scenario. On a public or shared network (hotel Wi-Fi, for example), it becomes a meaningful privacy concern.

If your provider’s portal uses HTTP rather than HTTPS, a VPN encrypts the entire connection, effectively solving the plaintext transmission problem regardless of whether the provider has deployed SSL.

---

Glossary

Term	Definition
Middleware	Software layer between IPTV infrastructure and end-user devices managing authentication, content delivery, UI, and subscriptions
Portal	The web-accessible endpoint STBs connect to — e.g., http://server/stalker_portal/c/
MAC address	48-bit hardware identifier (XX:XX:XX:XX:XX:XX); Infomir MAGs use prefix 00:1A:79
Token	32-character hex session credential generated during handshake and included in all subsequent requests
STB	Set-Top Box — a physical device connecting a TV to an IPTV service
EPG	Electronic Program Guide — TV schedule data, imported in XMLTV format
Handshake	Initial authentication exchange where client sends MAC address and receives session token
Heartbeat/Watchdog	Keep-alive signal sent every ~88 seconds to maintain active session status
Stalker Portal API	The HTTP interface at load.php using type/action parameters for all STB communication
VOD	Video on Demand — an on-demand content library accessible from the portal
Catch-up TV	Server-side recording of past broadcasts available for later on-demand playback
XMLTV	XML standard format for TV schedule data used for EPG imports
OUI	Organizationally Unique Identifier — the first three octets of a MAC address identifying the manufacturer
Tariff plan	Subscription package defining which channels and features a subscriber can access
DRM	Digital Rights Management — encryption technology preventing unauthorized recording or redistribution of content
HEVC/H.265	High-Efficiency Video Coding — newer compression standard offering better quality at lower bitrates than H.264
Ministra	The current official product name for what the community still calls Stalker Middleware

---

Frequently Asked Questions

---

Conclusion: Mastering the Stalker IPTV Ecosystem

Understanding what Stalker IPTV is reveals why it remains a cornerstone of the professional streaming industry. Originally developed by Infomir for their MAG set-top boxes, this middleware—now officially known as the Ministra TV Platform—serves as the critical “operating system” that connects content servers to your viewing device.

To ensure your setup is successful and SEO-friendly for future troubleshooting, keep these core takeaways in mind:

• Authentication and Hardware: Stalker relies primarily on MAC address authentication, binding your subscription to a specific hardware identifier for a secure, “plug-and-play” experience.
• The Power of Emulation: While MAG boxes are the native hardware, apps like STBEmu allow users to access Stalker portals on nearly any Android or Fire TV device by emulating a physical set-top box.
• Crucial Configuration: The single most common technical failure is a malformed URL. For any Stalker portal to function, the URL must end exactly with the /c/ directory (e.g., http://yourprovider.com/stalker_portal/c/).
• A Professional Standard: Unlike simple M3U playlists, Stalker provides a fully integrated TV experience, including built-in EPG (Electronic Program Guide), VOD libraries, and server-side Catch-up TV.

Whether you are an operator managing a hotel network or a viewer seeking a stable home entertainment setup, Stalker Middleware offers a level of centralized control and interface quality that few platforms can match. As long as you prioritize HTTPS for privacy and ensure your content is from a legally licensed provider, Stalker remains one of the most powerful tools in the IPTV world.