IPTV Installation Guides: Every Provider on Every Device

All three deliver the same channels. Xtream Codes API uses player_api.php JSON endpoints so the player lazy-loads categories and EPG in seconds. An M3U URL (get.php) downloads a single text playlist of every stream, which is slow with 45,000 channels but works on any player. Stalker Portal authenticates by MAC address through a /c/ portal URL and is used by MAG receivers and some Smart TV apps.

Set the largest option (5,000 ms in TiviMate, "Large" in Smarters). Buffer time in seconds equals buffer bytes multiplied by 8, divided by the stream bitrate in Mbps: a 15 MB allocation on an 18.5 Mbps 4K feed yields 6.5 seconds of protection, which covers typical ISP shaping bursts of 2-4 seconds without a visible freeze.

Stalker / Ministra middleware authenticates a set-top box by its 48-bit MAC address (MAG boxes use the 00:1A:79 OUI prefix) instead of a username and password. The reseller panel binds that MAC to a subscription line; apps such as IBO Player and Smarters on Samsung or LG TVs generate a virtual MAC that must be registered the same way. If you replace the device, the panel must re-bind the new MAC or the portal returns an "unregistered device" error.

The Xtream Codes player_api.php handshake returns max_connections and active_cons. Each live or VOD stream request opens one session counted against that limit; a second TV, phone, or multi-view tile is a second connection. When active_cons would exceed max_connections, the server answers the new stream request with HTTP 403 / 458 and the player shows "max connections reached". Resellers should sell lines with 2-5 connections for households and enable IP-lock only for single-device subscribers.

Run a speed test on the same device while a stream buffers. If raw throughput is above 25 Mbps but the player reports a bitrate below 8 Mbps, your ISP is applying traffic shaping to the stream flow, usually triggered by deep packet inspection of the TLS SNI or by sustained UDP/TCP flows to known hosting ASNs. Stop it by routing the player through a WireGuard tunnel (which hides destination and SNI inside ChaCha20-Poly1305 encryption), switching DNS to 1.1.1.1 over HTTPS, and keeping a 5,000 ms player buffer so short shaping bursts never reach the decoder.