<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>Hostapd on AlipourIm journeys</title>
    <link>http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/tags/hostapd/</link>
    <description>Recent content in Hostapd on AlipourIm journeys</description>
    <generator>Hugo -- 0.146.0</generator>
    <language>en</language>
    <lastBuildDate>Sun, 23 Nov 2025 00:00:00 +0000</lastBuildDate>
    <atom:link href="http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/tags/hostapd/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>I Beat My 8-Device Wi-Fi Limit with a Raspberry Pi (and Made an IoT Village)</title>
      <link>http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/posts/house_upgrade/</link>
      <pubDate>Sun, 23 Nov 2025 00:00:00 +0000</pubDate>
      <guid>http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/posts/house_upgrade/</guid>
      <description>Real-world guide: hardware choices, reasons, setup details, performance, and how many devices you can realistically support.</description>
      <content:encoded><![CDATA[<h2 id="the-day-my-wi-fi-said-eight-is-enough">The Day My Wi-Fi Said “Eight Is Enough”</h2>
<p>My apartment Wi-Fi (ASK4) has a hard cap of <strong>8 devices</strong>. That’s adorable until you own a phone, a laptop, a tablet, a TV, a smart speaker, and even a couple of smart plugs. My solution: put <strong>all the IoT stuff behind a Raspberry Pi</strong> that shows up as <strong>one</strong> device to the building’s network, but acts like a full-blown Wi-Fi for everything else I own.</p>
<p>This post is everything I did—no corporate firewall access, no exotic gear—just a Pi, a USB Wi-Fi adapter, and a little patience.</p>
<hr>
<h2 id="hardware-what-i-picked-and-why">Hardware: what I picked and why</h2>
<ul>
<li>
<p><strong>Raspberry Pi 4 (4GB)</strong><br>
It has enough CPU to route/NAT comfortably, USB 3 for fast Wi-Fi dongles, and solid Linux support. A Pi 3 works in a pinch, but the 4 stays cooler and handles bursts better.</p>
</li>
<li>
<p><strong>ALFA AWUS036ACHM (USB Wi-Fi)</strong><br>
Reliable, <strong>AP-mode</strong> friendly on Linux, and happy with <code>hostapd</code>. I used it to <strong>broadcast</strong> my IoT network (2.4 GHz, 20 MHz channel) while the Pi’s built-in Wi-Fi connects upstream. For better range, use a short <strong>USB 3 extension</strong> so the antenna sits away from the Pi (USB 3 noise can hurt 2.4 GHz).</p>
</li>
<li>
<p><strong>Fast USB-C power supply</strong> (official Pi 4 or 5V/3A equivalent)<br>
Wi-Fi spikes current draw; brown-outs cause random gremlins.</p>
</li>
<li>
<p><strong>16–32 GB microSD</strong>, <strong>heatsinks</strong>, <strong>ventilated case</strong><br>
The Pi 4 appreciates a bit of airflow.</p>
</li>
<li>
<p><strong>(Optional) Ethernet cable</strong><br>
If you can wire the Pi to the wall/router for upstream instead of using onboard Wi-Fi, do it. Wired upstream = higher, steadier throughput and frees the onboard radio.</p>
</li>
</ul>
<hr>
<h2 id="what-this-setup-actually-does">What this setup actually does</h2>
<ul>
<li>The Pi connects to the building’s <strong>ASK4 Wi-Fi</strong> as a <strong>client</strong> (<code>wlan0</code>).</li>
<li>The ALFA dongle creates a new access point called <strong><code>IoT_hub</code></strong> (<code>wlx…</code> interface) with password <code>Iman8118</code>.</li>
<li>Devices join <code>IoT_hub</code>. The Pi does <strong>NAT</strong>, so upstream sees <strong>one MAC address</strong> (the Pi), not dozens of gadgets. Device limit: defeated.</li>
<li><strong>Avahi mDNS reflector</strong> lets services like <strong>AirPlay/HomeKit</strong> be discoverable across the two subnets without touching the managed router.</li>
<li>If I’m on the building Wi-Fi and want to control IoT gear without switching, I can also use an optional overlay (e.g., <strong>Tailscale</strong>) to reach <code>192.168.50.0/24</code> from anywhere.</li>
</ul>
<hr>
<h2 id="setup-details-the-friendly-version">Setup details (the friendly version)</h2>
<h3 id="1-access-point-with-hostapd">1) Access point with hostapd</h3>
<p>I broadcast a simple WPA2 network on <strong>2.4 GHz</strong> (best compatibility). Channel <strong>1/6/11</strong>—pick the cleanest. 20 MHz channel width keeps legacy and low-power devices happy.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-ini" data-lang="ini"><span style="display:flex;"><span><span style="color:#a6e22e">interface</span><span style="color:#f92672">=</span><span style="color:#e6db74">wlx00c0cab7ab29</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">ssid</span><span style="color:#f92672">=</span><span style="color:#e6db74">&lt;A_NICE_SSID&gt;</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">country_code</span><span style="color:#f92672">=</span><span style="color:#e6db74">DE</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">hw_mode</span><span style="color:#f92672">=</span><span style="color:#e6db74">g</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">channel</span><span style="color:#f92672">=</span><span style="color:#e6db74">6</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">ieee80211n</span><span style="color:#f92672">=</span><span style="color:#e6db74">1</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">wmm_enabled</span><span style="color:#f92672">=</span><span style="color:#e6db74">1</span>
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Don&#39;t require HT or you&#39;ll reject some tiny IoT clients:</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">require_ht</span><span style="color:#f92672">=</span><span style="color:#e6db74">0</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">wpa</span><span style="color:#f92672">=</span><span style="color:#e6db74">2</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">wpa_key_mgmt</span><span style="color:#f92672">=</span><span style="color:#e6db74">WPA-PSK</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">rsn_pairwise</span><span style="color:#f92672">=</span><span style="color:#e6db74">CCMP</span>
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">wpa_passphrase</span><span style="color:#f92672">=</span><span style="color:#e6db74">&lt;STRONG_PASSWORD&gt;</span>
</span></span></code></pre></div><h3 id="2-dhcp-on-the-iot-side-dnsmasq">2) DHCP on the IoT side (dnsmasq)</h3>
<p>Give out addresses on 192.168.50.0/24 and let systemd-resolved handle DNS to the internet.</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>interface<span style="color:#f92672">=</span>wlx00c0cab7ab29
</span></span><span style="display:flex;"><span>bind-interfaces
</span></span><span style="display:flex;"><span>dhcp-range<span style="color:#f92672">=</span>192.168.50.100,192.168.50.240,255.255.255.0,12h
</span></span><span style="display:flex;"><span>dhcp-option<span style="color:#f92672">=</span>3,192.168.50.1
</span></span><span style="display:flex;"><span>dhcp-option<span style="color:#f92672">=</span>6,1.1.1.1,8.8.8.8
</span></span><span style="display:flex;"><span>port<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span>  <span style="color:#75715e"># leave port 53 to systemd-resolved</span>
</span></span><span style="display:flex;"><span>log-dhcp
</span></span></code></pre></div><h3 id="3-routing--nat-nftables">3) Routing + NAT (nftables)</h3>
<p>This makes every downstream device appear as the Pi upstream:</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>table inet filter <span style="color:#f92672">{</span>
</span></span><span style="display:flex;"><span>  chain input <span style="color:#f92672">{</span>
</span></span><span style="display:flex;"><span>    type filter hook input priority filter; policy accept;
</span></span><span style="display:flex;"><span>    ct state established,related accept
</span></span><span style="display:flex;"><span>    iif <span style="color:#e6db74">&#34;lo&#34;</span> accept
</span></span><span style="display:flex;"><span>    iif <span style="color:#e6db74">&#34;wlan0&#34;</span> accept
</span></span><span style="display:flex;"><span>    iif <span style="color:#e6db74">&#34;wlx00c0cab7ab29&#34;</span> accept
</span></span><span style="display:flex;"><span>    udp dport <span style="color:#ae81ff">5353</span> accept  <span style="color:#75715e"># mDNS</span>
</span></span><span style="display:flex;"><span>    counter drop
</span></span><span style="display:flex;"><span>  <span style="color:#f92672">}</span>
</span></span><span style="display:flex;"><span>  chain forward <span style="color:#f92672">{</span>
</span></span><span style="display:flex;"><span>    type filter hook forward priority filter; policy accept;
</span></span><span style="display:flex;"><span>    ct state established,related accept
</span></span><span style="display:flex;"><span>    iif <span style="color:#e6db74">&#34;wlx00c0cab7ab29&#34;</span> oif <span style="color:#e6db74">&#34;wlan0&#34;</span> accept
</span></span><span style="display:flex;"><span>    iif <span style="color:#e6db74">&#34;wlan0&#34;</span> oif <span style="color:#e6db74">&#34;wlx00c0cab7ab29&#34;</span> accept
</span></span><span style="display:flex;"><span>  <span style="color:#f92672">}</span>
</span></span><span style="display:flex;"><span>  chain output <span style="color:#f92672">{</span> type filter hook output priority filter; policy accept; <span style="color:#f92672">}</span>
</span></span><span style="display:flex;"><span><span style="color:#f92672">}</span>
</span></span><span style="display:flex;"><span>table ip nat <span style="color:#f92672">{</span>
</span></span><span style="display:flex;"><span>  chain postrouting <span style="color:#f92672">{</span>
</span></span><span style="display:flex;"><span>    type nat hook postrouting priority srcnat; policy accept;
</span></span><span style="display:flex;"><span>    oif <span style="color:#e6db74">&#34;wlan0&#34;</span> masquerade
</span></span><span style="display:flex;"><span>  <span style="color:#f92672">}</span>
</span></span><span style="display:flex;"><span><span style="color:#f92672">}</span>
</span></span></code></pre></div><h3 id="4-mdns-across-subnets-avahi">4) mDNS across subnets (Avahi)</h3>
<p>The reflector bridges Bonjour so AirPlay/HomeKit can find each other across IoT and ASK4:</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#f92672">[</span>server<span style="color:#f92672">]</span>
</span></span><span style="display:flex;"><span>allow-interfaces<span style="color:#f92672">=</span>wlan0,wlx00c0cab7ab29
</span></span><span style="display:flex;"><span><span style="color:#f92672">[</span>reflector<span style="color:#f92672">]</span>
</span></span><span style="display:flex;"><span>enable-reflector<span style="color:#f92672">=</span>yes
</span></span></code></pre></div><p>I wanted to be able to control my homepod without switching networks, but without setting a custom route on ASK4 WiFi it was not possible, hence the reason I chose Tailscale</p>
<p>Iet up Tailscale, advertise 192.168.50.0/24 from the Pi. Now I can log in with a passkey from my devices and control my homepod without switching networks, well, kinda. Boom! Secure access to IoT without leaving ASK4.</p>
<p>Now some random questions that I looked up in internet:</p>
<ol>
<li>How many devices can this really support?</li>
</ol>
<p>Short answer: a lot—for IoT.
Long answer: the DHCP pool here has 141 IPs (.100 to .240). Wi-Fi airtime is the real limit, not IPs. With a 2.4 GHz AP and mostly low-bandwidth gadgets (sensors, plugs, bulbs, ESPs), 50–70 devices is completely reasonable. The ALFA’s radio and hostapd handle concurrent associations fine; I’ve watched dozens attach, chatter, and renew leases without drama.</p>
<p>If you plan camera-heavy traffic or bulk transfers, either split heavy gear onto 5 GHz or wire those devices. For small, chatty IoT traffic, this Pi/AP combo is very comfortable.</p>
<ol start="2">
<li>What speeds should I expect?</li>
</ol>
<ul>
<li>
<p>LAN (IoT device ↔ Pi) on 2.4 GHz, 20 MHz channel, WPA2:
~20–60 Mbps real throughput per device is typical. IoT stuff barely needs 1 Mbps, so I&rsquo;m golden! ^^</p>
</li>
<li>
<p>Internet (IoT device → upstream via Pi):
If the Pi’s upstream is Wi-Fi, which in my case is, the bottleneck is that link; expect ~30–70 Mbps stable. If upstream is Ethernet, the Pi 4 can NAT hundreds of Mbps, and my AP radio becomes the limit.</p>
</li>
<li>
<p>Latency: Adding one NAT hop adds a little delay (a few ms). For HomePod/AirPlay, mDNS reflection + local Wi-Fi keeps it snappy.</p>
</li>
</ul>
<ol start="3">
<li>Why these choices?</li>
</ol>
<ul>
<li>
<p>2.4 GHz is where tiny IoT radios live (bulbs, plugs, ESP/ESP32). It trades speed for range and compatibility.</p>
</li>
<li>
<p>WPA2-PSK keeps things simple; WPA3 is fine if all your clients support it.</p>
</li>
<li>
<p>20 MHz channel prevents older or power-saving devices from flaking out.</p>
</li>
<li>
<p>Avahi reflector avoids any changes to the building’s router and still lets discovery work.</p>
</li>
<li>
<p>NAT collapses dozens of gadgets into a single upstream “seat,” sidestepping the 8-device limit entirely.</p>
</li>
</ul>
<h2 id="troubleshooting">Troubleshooting</h2>
<ul>
<li>
<p><code>hostapd</code> <strong>masked/disabled</strong> →</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl unmask hostapd <span style="color:#f92672">&amp;&amp;</span> sudo systemctl enable --now hostapd
</span></span></code></pre></div></li>
<li>
<p><code>dnsmasq</code> can’t start because of <strong>port 53</strong> →<br>
set <code>port=0</code> in <code>/etc/dnsmasq.d/*.conf</code> and let systemd-resolved keep DNS.</p>
</li>
<li>
<p><strong>“Station does not support mandatory HT PHY”</strong> in <code>hostapd</code> logs →<br>
add <code>require_ht=0</code> (and keep <code>ieee80211n=1</code>) in your <code>hostapd.conf</code>.</p>
</li>
<li>
<p>AirPlay/HomeKit don’t show up across subnets →<br>
ensure Avahi reflector is enabled and UDP/5353 (mDNS) is allowed:</p>
<ul>
<li><code>/etc/avahi/avahi-daemon.conf</code> has:
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#f92672">[</span>server<span style="color:#f92672">]</span>
</span></span><span style="display:flex;"><span>allow-interfaces<span style="color:#f92672">=</span>wlan0,wlx00c0cab7ab29
</span></span><span style="display:flex;"><span><span style="color:#f92672">[</span>reflector<span style="color:#f92672">]</span>
</span></span><span style="display:flex;"><span>enable-reflector<span style="color:#f92672">=</span>yes
</span></span></code></pre></div></li>
<li>firewall allows:</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>udp dport <span style="color:#ae81ff">5353</span> accept
</span></span></code></pre></div></li>
<li>
<p>Weak signal / flaky joins →<br>
use a short <strong>USB 3 extension</strong> to move the ALFA away from the Pi and cables;<br>
scan and switch to a cleaner <strong>2.4 GHz</strong> channel (1/6/11), keep width at <strong>20 MHz</strong>.</p>
</li>
<li>
<p>Clients connect but no internet →<br>
verify IP forward &amp; NAT:</p>
</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo sysctl net.ipv4.ip_forward
</span></span></code></pre></div><p>If it&rsquo;s 0, enable it permanently and reload</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>echo <span style="color:#e6db74">&#39;net.ipv4.ip_forward=1&#39;</span> | sudo tee /etc/sysctl.d/99-iot.conf
</span></span><span style="display:flex;"><span>sudo sysctl --system
</span></span></code></pre></div><p>Verify the nftables NAT rule exists (masquerade out via wlan0)</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo nft list ruleset | sed -n <span style="color:#e6db74">&#39;/table ip nat/,$p&#39;</span> | sed -n <span style="color:#e6db74">&#39;1,80p&#39;</span>
</span></span></code></pre></div><p>Add it if missing</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo nft add table ip nat
</span></span><span style="display:flex;"><span>sudo nft <span style="color:#e6db74">&#39;add chain ip nat postrouting { type nat hook postrouting priority srcnat; policy accept; }&#39;</span>
</span></span><span style="display:flex;"><span>sudo nft <span style="color:#e6db74">&#39;add rule ip nat postrouting oif &#34;wlan0&#34; masquerade&#39;</span>
</span></span></code></pre></div><p>Persist nftables (Ubuntu)</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo sh -c <span style="color:#e6db74">&#39;nft list ruleset &gt; /etc/nftables.conf&#39;</span>
</span></span><span style="display:flex;"><span>sudo systemctl enable --now nftables
</span></span></code></pre></div><h2 id="quick-service-sanity-checks">Quick service sanity checks</h2>
<h3 id="hostapd-ap">hostapd (AP)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl status hostapd --no-pager
</span></span><span style="display:flex;"><span>sudo journalctl -u hostapd -n <span style="color:#ae81ff">60</span> --no-pager
</span></span><span style="display:flex;"><span>iw dev wlx00c0cab7ab29 info
</span></span><span style="display:flex;"><span>iw dev wlx00c0cab7ab29 station dump
</span></span></code></pre></div><h3 id="dnsmasq-dhcp-on-iot-side">dnsmasq (DHCP on IoT side)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl status dnsmasq --no-pager
</span></span><span style="display:flex;"><span>sudo journalctl -u dnsmasq -n <span style="color:#ae81ff">80</span> --no-pager
</span></span><span style="display:flex;"><span>grep -E <span style="color:#e6db74">&#39;interface=|dhcp-range&#39;</span> /etc/dnsmasq.d/*.conf <span style="color:#f92672">||</span> true
</span></span><span style="display:flex;"><span>tail -n <span style="color:#ae81ff">50</span> /var/lib/misc/dnsmasq.leases
</span></span></code></pre></div><h3 id="avahi-mdns-reflector">Avahi (mDNS reflector)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>grep -E <span style="color:#e6db74">&#39;enable-reflector|allow-interfaces&#39;</span> /etc/avahi/avahi-daemon.conf
</span></span><span style="display:flex;"><span>sudo systemctl status avahi-daemon --no-pager
</span></span><span style="display:flex;"><span>sudo journalctl -u avahi-daemon -n <span style="color:#ae81ff">60</span> --no-pager
</span></span></code></pre></div><h2 id="basic-connectivity-tests-from-a-client-on-iot_hub">Basic connectivity tests from a client on IoT_hub</h2>
<h3 id="got-dhcp">got DHCP?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>ip addr show
</span></span><span style="display:flex;"><span>ip route
</span></span><span style="display:flex;"><span>cat /etc/resolv.conf
</span></span></code></pre></div><h3 id="can-you-reach-the-pi-and-the-internet">can you reach the Pi and the internet?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>ping -c <span style="color:#ae81ff">3</span> 192.168.50.1
</span></span><span style="display:flex;"><span>ping -c <span style="color:#ae81ff">3</span> 1.1.1.1
</span></span><span style="display:flex;"><span>ping -c <span style="color:#ae81ff">3</span> google.com
</span></span></code></pre></div><h3 id="dns-works-end-to-end">DNS works end-to-end?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>dig +short _airplay._tcp.local @224.0.0.251 -p <span style="color:#ae81ff">5353</span>
</span></span></code></pre></div><p>(Or use a Bonjour browser app to confirm the HomePod is discoverable.)</p>
<h2 id="if-airplayhomekit-discovery-is-flaky-across-subnets">If AirPlay/HomeKit discovery is flaky across subnets</h2>
<h3 id="make-sure-mdns-is-allowed-both-directions-on-the-pi">make sure mDNS is allowed both directions on the Pi</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>sudo nft add rule inet filter input udp dport <span style="color:#ae81ff">5353</span> accept
</span></span><span style="display:flex;"><span>sudo nft add rule inet filter forward udp dport <span style="color:#ae81ff">5353</span> accept
</span></span><span style="display:flex;"><span>sudo sh -c <span style="color:#e6db74">&#39;nft list ruleset &gt; /etc/nftables.conf&#39;</span>
</span></span></code></pre></div><h3 id="restart-avahi-cleanly-and-re-announce">restart Avahi cleanly and re-announce</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl restart avahi-daemon
</span></span><span style="display:flex;"><span>sudo journalctl -u avahi-daemon -n <span style="color:#ae81ff">40</span> --no-pager
</span></span></code></pre></div><h3 id="from-the-pi-watch-mdns-traffic-on-both-sides-you-should-see-queriesanswers">from the Pi, watch mDNS traffic on both sides (you should see queries/answers)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo tcpdump -ni wlx00c0cab7ab29 udp port <span style="color:#ae81ff">5353</span> -vvv
</span></span></code></pre></div><p>(in another terminal:)</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo tcpdump -ni wlan0 udp port <span style="color:#ae81ff">5353</span> -vvv
</span></span></code></pre></div><h2 id="throughput--airtime-sanity-optional">Throughput + airtime sanity (optional)</h2>
<h3 id="simple-iperf3-install-on-pi-and-a-client">simple iperf3 (install on Pi and a client)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo apt-get update <span style="color:#f92672">&amp;&amp;</span> sudo apt-get install -y iperf3
</span></span></code></pre></div><p>(on the Pi:) <code>iperf3 -s</code>
(on a client:) <code>iperf3 -c 192.168.50.1 -P 3 -t 10</code></p>
<h3 id="check-channel-utilizationinterference-from-pi">check channel utilization/interference (from Pi)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo iw dev wlx00c0cab7ab29 survey dump | sed -n <span style="color:#e6db74">&#39;1,200p&#39;</span>
</span></span></code></pre></div><p>(if busy, try channel 1 or 11 in hostapd.conf and restart hostapd)</p>
<h2 id="scaling-tips-lots-of-tiny-iot-devices">Scaling tips (lots of tiny IoT devices)</h2>
<h3 id="hostapd-tweaks-add-to-hostapdconf-then-restart">hostapd tweaks (add to hostapd.conf, then restart)</h3>
<p>(reduce management overhead slightly; keep conservative for compatibility)</p>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>beacon_int<span style="color:#f92672">=</span><span style="color:#ae81ff">100</span>
</span></span><span style="display:flex;"><span>dtim_period<span style="color:#f92672">=</span><span style="color:#ae81ff">2</span>
</span></span><span style="display:flex;"><span>wmm_enabled<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ap_isolate<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span>
</span></span><span style="display:flex;"><span>max_num_sta<span style="color:#f92672">=</span><span style="color:#ae81ff">256</span>      <span style="color:#75715e"># logical cap; real limit is airtime/driver</span>
</span></span></code></pre></div><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl restart hostapd
</span></span></code></pre></div><h3 id="if-some-esplow-power-clients-are-sticky-or-nap-too-hard">if some ESP/low-power clients are sticky or nap too hard:</h3>
<p>(device-side) disable aggressive power saving if supported<br>
(AP-side) keep channel width at 20 MHz and <code>require_ht=0</code> for legacy clients</p>
<h2 id="clients-connect-but-no-internet-quick-checklist">“Clients connect but no internet” quick checklist</h2>
<h3 id="pi-has-a-default-route-via-upstream">Pi has a default route via upstream?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>ip route | grep default
</span></span></code></pre></div><h3 id="nat-counters-are-increasing-when-clients-surf">NAT counters are increasing when clients surf?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo nft list chain ip nat postrouting -a
</span></span></code></pre></div><h3 id="connections-tracked">connections tracked?</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo conntrack -L -o extended | head -n <span style="color:#ae81ff">40</span>
</span></span></code></pre></div><h3 id="last-resort-bounce-the-pieces">last resort: bounce the pieces</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl restart hostapd dnsmasq avahi-daemon
</span></span><span style="display:flex;"><span>sudo systemctl restart NetworkManager <span style="color:#f92672">||</span> true
</span></span><span style="display:flex;"><span>sudo systemctl restart nftables
</span></span></code></pre></div><h2 id="network-traffic-embedded-from-captures">Network Traffic (embedded from captures)</h2>
<p>For fun, and curiousity!</p>
<h3 id="1-dhcp-leases-who-joined-the-iot-network">1) DHCP leases (who joined the IoT network)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#ae81ff">1763936213</span> 6a:12:f6:62:40:88 192.168.50.216 * 01:6a:12:f6:62:40:88
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935691</span> 72:00:a6:33:e5:7a 192.168.50.222 * 01:72:00:a6:33:e5:7a
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935629</span> e8:06:90:69:66:7c 192.168.50.189 Aidot 01:e8:06:90:69:66:7c
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763936452</span> ac:bc:b5:e5:38:29 192.168.50.202 Main-Bedroom-2 01:ac:bc:b5:e5:38:29
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935618</span> e8:06:90:68:06:2c 192.168.50.196 * 01:e8:06:90:68:06:2c
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935618</span> 48:e1:e9:bc:f6:91 192.168.50.131 * *
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935618</span> 48:e1:e9:bd:08:0d 192.168.50.118 * *
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935615</span> 48:e1:e9:bd:0b:a7 192.168.50.233 * *
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935618</span> 7c:f1:7e:ff:e1:b0 192.168.50.104 KH100 *
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">1763935607</span> cc:b5:d1:31:a4:cc 192.168.50.134 espressif 01:cc:b5:d1:31:a4:cc
</span></span></code></pre></div><h3 id="2-top-talkers-by-bytes-hosts-table">2) Top talkers by bytes (hosts table)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>192.168.50.233,7346
</span></span><span style="display:flex;"><span>192.168.50.118,7216
</span></span><span style="display:flex;"><span>192.168.50.131,7216
</span></span><span style="display:flex;"><span>17.253.53.203,7040
</span></span><span style="display:flex;"><span>54.217.122.41,6271
</span></span><span style="display:flex;"><span>192.168.50.216,5392
</span></span><span style="display:flex;"><span>192.168.50.104,3058
</span></span><span style="display:flex;"><span>192.168.50.189,2278
</span></span><span style="display:flex;"><span>17.242.218.132,1802
</span></span><span style="display:flex;"><span>192.168.50.134,1750
</span></span><span style="display:flex;"><span>192.168.50.196,1653
</span></span><span style="display:flex;"><span>3.122.71.119,639
</span></span><span style="display:flex;"><span>18.196.19.65,570
</span></span><span style="display:flex;"><span>161.117.178.131,391
</span></span><span style="display:flex;"><span>17.253.53.201,148
</span></span><span style="display:flex;"><span>17.57.146.25,90
</span></span><span style="display:flex;"><span>10.172.72.196,66
</span></span><span style="display:flex;"><span>224.0.0.251,0
</span></span><span style="display:flex;"><span>224.0.0.2,0
</span></span><span style="display:flex;"><span>255.255.255.255,0
</span></span></code></pre></div><h3 id="3-heaviest-flows-src-dst-proto-dport-bytes">3) Heaviest flows (src, dst, proto, dport, bytes)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>192.168.50.202,192.168.50.131,TCP,59903,402
</span></span><span style="display:flex;"><span>192.168.50.202,192.168.50.118,TCP,59807,402
</span></span><span style="display:flex;"><span>161.117.178.131,192.168.50.134,TCP,58246,391
</span></span><span style="display:flex;"><span>192.168.50.216,192.168.50.202,UDP,5353,336
</span></span><span style="display:flex;"><span>192.168.50.202,192.168.50.189,UDP,5353,312
</span></span><span style="display:flex;"><span>192.168.50.202,192.168.50.196,UDP,5353,234
</span></span><span style="display:flex;"><span>17.253.53.203,192.168.50.202,TCP,64726,222
</span></span><span style="display:flex;"><span>192.168.50.216,17.57.146.25,TCP,5223,172
</span></span><span style="display:flex;"><span>192.168.50.216,192.168.50.233,UDP,5353,162
</span></span><span style="display:flex;"><span>192.168.50.202,192.168.50.104,UDP,5353,156
</span></span><span style="display:flex;"><span>17.253.53.201,192.168.50.202,TCP,64727,148
</span></span><span style="display:flex;"><span>192.168.50.202,17.253.53.201,TCP,443,132
</span></span><span style="display:flex;"><span>192.168.50.216,224.0.0.251,IP,0,92
</span></span><span style="display:flex;"><span>192.168.50.216,224.0.0.2,IP,0,92
</span></span><span style="display:flex;"><span>17.57.146.25,192.168.50.216,TCP,64544,90
</span></span><span style="display:flex;"><span>192.168.50.216,192.168.50.118,UDP,5353,75
</span></span><span style="display:flex;"><span>192.168.50.216,192.168.50.131,UDP,5353,75
</span></span><span style="display:flex;"><span>192.168.50.216,192.168.50.134,UDP,5353,75
</span></span><span style="display:flex;"><span>192.168.50.216,10.172.72.196,TCP,59593,70
</span></span><span style="display:flex;"><span>10.172.72.196,192.168.50.216,TCP,51638,66
</span></span></code></pre></div><h3 id="4-conntrack-snapshot-active-connections-inventory">4) Conntrack snapshot (active connections inventory)</h3>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">48</span> TIME_WAIT src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>185.125.190.39 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">55012</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">80</span> src<span style="color:#f92672">=</span>185.125.190.39 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">80</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">55012</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">100</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>185.40.234.113 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">3478</span> src<span style="color:#f92672">=</span>185.40.234.113 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">3478</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431665</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.216 dst<span style="color:#f92672">=</span>17.57.146.25 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">64544</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5223</span> src<span style="color:#f92672">=</span>17.57.146.25 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5223</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">64544</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">27</span> src<span style="color:#f92672">=</span>10.172.72.205 dst<span style="color:#f92672">=</span>224.0.0.251 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>10.172.72.205 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">17</span> src<span style="color:#f92672">=</span>10.172.72.196 dst<span style="color:#f92672">=</span>10.172.79.255 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">137</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">137</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>10.172.79.255 dst<span style="color:#f92672">=</span>10.172.72.196 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">137</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">137</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431999</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.196 dst<span style="color:#f92672">=</span>18.196.19.65 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">55164</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">8883</span> src<span style="color:#f92672">=</span>18.196.19.65 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">8883</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">55164</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">16</span> src<span style="color:#f92672">=</span>127.0.0.1 dst<span style="color:#f92672">=</span>127.0.0.53 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41796</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> src<span style="color:#f92672">=</span>127.0.0.53 dst<span style="color:#f92672">=</span>127.0.0.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41796</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> unknown  <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">265</span> src<span style="color:#f92672">=</span>192.168.50.216 dst<span style="color:#f92672">=</span>224.0.0.251 <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>192.168.50.216 mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">5</span> src<span style="color:#f92672">=</span>192.168.50.104 dst<span style="color:#f92672">=</span>1.1.1.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">23791</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> src<span style="color:#f92672">=</span>1.1.1.1 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">23791</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">119</span> src<span style="color:#f92672">=</span>10.172.72.205 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.72.205 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">27</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>224.0.0.251 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431946</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.202 dst<span style="color:#f92672">=</span>17.242.218.132 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">64686</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5223</span> src<span style="color:#f92672">=</span>17.242.218.132 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5223</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">64686</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">10</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>239.255.255.250 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">40234</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">1900</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>239.255.255.250 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">1900</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">40234</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">96</span> TIME_WAIT src<span style="color:#f92672">=</span>192.168.50.104 dst<span style="color:#f92672">=</span>3.217.113.91 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">49707</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> src<span style="color:#f92672">=</span>3.217.113.91 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">49707</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">10</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.64.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">40234</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">1900</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>10.172.64.1 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">1900</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">40234</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431812</span> ESTABLISHED src<span style="color:#f92672">=</span>100.69.238.103 dst<span style="color:#f92672">=</span>192.168.50.202 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">55514</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">49395</span> src<span style="color:#f92672">=</span>192.168.50.202 dst<span style="color:#f92672">=</span>192.168.50.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">49395</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">55514</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431666</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.216 dst<span style="color:#f92672">=</span>10.172.72.196 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">51638</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">59593</span> src<span style="color:#f92672">=</span>10.172.72.196 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">59593</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">51638</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431998</span> ESTABLISHED src<span style="color:#f92672">=</span>100.69.238.103 dst<span style="color:#f92672">=</span>192.168.50.202 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">55510</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">7000</span> src<span style="color:#f92672">=</span>192.168.50.202 dst<span style="color:#f92672">=</span>192.168.50.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">7000</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">55510</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">14</span> src<span style="color:#f92672">=</span>192.168.50.131 dst<span style="color:#f92672">=</span>224.0.0.251 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>192.168.50.131 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> unknown  <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">596</span> src<span style="color:#f92672">=</span>10.172.72.205 dst<span style="color:#f92672">=</span>224.0.0.251 <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>10.172.72.205 mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">27</span> src<span style="color:#f92672">=</span>192.168.50.1 dst<span style="color:#f92672">=</span>224.0.0.251 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>192.168.50.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">8</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">27</span> src<span style="color:#f92672">=</span>10.172.72.205 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.72.205 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">15</span> src<span style="color:#f92672">=</span>192.168.50.118 dst<span style="color:#f92672">=</span>224.0.0.251 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>224.0.0.251 dst<span style="color:#f92672">=</span>192.168.50.118 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">88</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>109.43.114.250 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> src<span style="color:#f92672">=</span>109.43.114.250 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431997</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.104 dst<span style="color:#f92672">=</span>18.234.9.109 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">49700</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> src<span style="color:#f92672">=</span>18.234.9.109 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">49700</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431998</span> ESTABLISHED src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>199.165.136.101 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">45248</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> src<span style="color:#f92672">=</span>199.165.136.101 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">45248</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431992</span> ESTABLISHED src<span style="color:#f92672">=</span>10.172.72.196 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">63953</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">22</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.72.196 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">22</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">63953</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431995</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.189 dst<span style="color:#f92672">=</span>3.122.71.119 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">50422</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">8883</span> src<span style="color:#f92672">=</span>3.122.71.119 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">8883</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">50422</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">100</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>176.58.90.104 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">3478</span> src<span style="color:#f92672">=</span>176.58.90.104 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">3478</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">107</span> TIME_WAIT src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>185.125.190.36 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">50914</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">80</span> src<span style="color:#f92672">=</span>185.125.190.36 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">80</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">50914</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">26</span> src<span style="color:#f92672">=</span>192.168.50.202 dst<span style="color:#f92672">=</span>192.168.50.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>192.168.50.1 dst<span style="color:#f92672">=</span>192.168.50.202 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5353</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">16</span> src<span style="color:#f92672">=</span>127.0.0.1 dst<span style="color:#f92672">=</span>127.0.0.53 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">33321</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> src<span style="color:#f92672">=</span>127.0.0.53 dst<span style="color:#f92672">=</span>127.0.0.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">33321</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431975</span> ESTABLISHED src<span style="color:#f92672">=</span>192.168.50.134 dst<span style="color:#f92672">=</span>161.117.178.131 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">58246</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">11883</span> src<span style="color:#f92672">=</span>161.117.178.131 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">11883</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">58246</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">16</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.64.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">35510</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> src<span style="color:#f92672">=</span>10.172.64.1 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">53</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">35510</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">100</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>176.58.93.154 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">3478</span> src<span style="color:#f92672">=</span>176.58.93.154 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">3478</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">41641</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431652</span> ESTABLISHED src<span style="color:#f92672">=</span>100.69.238.103 dst<span style="color:#f92672">=</span>192.168.50.202 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">55513</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">49394</span> src<span style="color:#f92672">=</span>192.168.50.202 dst<span style="color:#f92672">=</span>192.168.50.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">49394</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">55513</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">23</span> src<span style="color:#f92672">=</span>192.168.50.104 dst<span style="color:#f92672">=</span>255.255.255.255 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">21112</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">20002</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>255.255.255.255 dst<span style="color:#f92672">=</span>192.168.50.104 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">20002</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">21112</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">10</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.64.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">40234</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5351</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>10.172.64.1 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5351</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">40234</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> udp      <span style="color:#ae81ff">17</span> <span style="color:#ae81ff">10</span> src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>10.172.64.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">34331</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">5351</span> <span style="color:#f92672">[</span>UNREPLIED<span style="color:#f92672">]</span> src<span style="color:#f92672">=</span>10.172.64.1 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">5351</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">34331</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431975</span> ESTABLISHED src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>192.200.0.115 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">48100</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> src<span style="color:#f92672">=</span>192.200.0.115 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">48100</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431999</span> ESTABLISHED src<span style="color:#f92672">=</span>10.172.71.98 dst<span style="color:#f92672">=</span>176.58.93.154 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">58128</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> src<span style="color:#f92672">=</span>176.58.93.154 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">58128</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">431997</span> ESTABLISHED src<span style="color:#f92672">=</span>100.69.238.103 dst<span style="color:#f92672">=</span>192.168.50.202 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">55515</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">49154</span> src<span style="color:#f92672">=</span>192.168.50.202 dst<span style="color:#f92672">=</span>192.168.50.1 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">49154</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">55515</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span><span style="display:flex;"><span>ipv4     <span style="color:#ae81ff">2</span> tcp      <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">118</span> TIME_WAIT src<span style="color:#f92672">=</span>192.168.50.104 dst<span style="color:#f92672">=</span>3.217.113.91 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">49708</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> src<span style="color:#f92672">=</span>3.217.113.91 dst<span style="color:#f92672">=</span>10.172.71.98 sport<span style="color:#f92672">=</span><span style="color:#ae81ff">443</span> dport<span style="color:#f92672">=</span><span style="color:#ae81ff">49708</span> <span style="color:#f92672">[</span>ASSURED<span style="color:#f92672">]</span> mark<span style="color:#f92672">=</span><span style="color:#ae81ff">0</span> use<span style="color:#f92672">=</span><span style="color:#ae81ff">1</span>
</span></span></code></pre></div><h3 id="5-part-of-raw-packet-capture">5) Part of Raw packet capture</h3>
<ul>
<li>What’s inside?</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>tshark -r iot_ap_120s.pcap -q -z io,stat,60
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span><span style="color:#f92672">==================================</span>
</span></span><span style="display:flex;"><span>| IO Statistics                  |
</span></span><span style="display:flex;"><span>|                                |
</span></span><span style="display:flex;"><span>| Duration: 119.773534 secs      |
</span></span><span style="display:flex;"><span>| Interval:  <span style="color:#ae81ff">60</span> secs             |
</span></span><span style="display:flex;"><span>|                                |
</span></span><span style="display:flex;"><span>| Col 1: Frames and bytes        |
</span></span><span style="display:flex;"><span>|--------------------------------|
</span></span><span style="display:flex;"><span>|            |<span style="color:#ae81ff">1</span>                  |
</span></span><span style="display:flex;"><span>| Interval   | Frames |   Bytes  |
</span></span><span style="display:flex;"><span>|--------------------------------|
</span></span><span style="display:flex;"><span>|   <span style="color:#ae81ff">0</span> &lt;&gt;  <span style="color:#ae81ff">60</span> |    <span style="color:#ae81ff">400</span> |    <span style="color:#ae81ff">60449</span> |
</span></span><span style="display:flex;"><span>|  <span style="color:#ae81ff">60</span> &lt;&gt; Dur |  <span style="color:#ae81ff">24672</span> | <span style="color:#ae81ff">30179911</span> |
</span></span><span style="display:flex;"><span><span style="color:#f92672">==================================</span>
</span></span></code></pre></div><ul>
<li>Protocol hierarchy (what kinds of traffic?)</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap -q -z io,phs
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span><span style="color:#f92672">===================================================================</span>
</span></span><span style="display:flex;"><span>Protocol Hierarchy Statistics
</span></span><span style="display:flex;"><span>Filter: 
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span>eth                                      frames:25072 bytes:30240360
</span></span><span style="display:flex;"><span>  ip                                     frames:24706 bytes:30195993
</span></span><span style="display:flex;"><span>    udp                                  frames:349 bytes:94583
</span></span><span style="display:flex;"><span>      mdns                               frames:241 bytes:60693
</span></span><span style="display:flex;"><span>      data                               frames:32 bytes:2240
</span></span><span style="display:flex;"><span>      quic                               frames:76 bytes:31650
</span></span><span style="display:flex;"><span>        quic                             frames:2 bytes:2484
</span></span><span style="display:flex;"><span>    tcp                                  frames:24353 bytes:30101226
</span></span><span style="display:flex;"><span>      tls                                frames:2413 bytes:3493680
</span></span><span style="display:flex;"><span>        tcp.segments                     frames:2256 bytes:3378795
</span></span><span style="display:flex;"><span>          tls                            frames:2222 bytes:3353799
</span></span><span style="display:flex;"><span>      data                               frames:147 bytes:71717
</span></span><span style="display:flex;"><span>      tcp.segments                       frames:5 bytes:7550
</span></span><span style="display:flex;"><span>    igmp                                 frames:4 bytes:184
</span></span><span style="display:flex;"><span>  arp                                    frames:150 bytes:6300
</span></span><span style="display:flex;"><span>  ipv6                                   frames:216 bytes:38067
</span></span><span style="display:flex;"><span>    icmpv6                               frames:124 bytes:10704
</span></span><span style="display:flex;"><span>    udp                                  frames:79 bytes:25415
</span></span><span style="display:flex;"><span>      data                               frames:2 bytes:132
</span></span><span style="display:flex;"><span>      mdns                               frames:77 bytes:25283
</span></span><span style="display:flex;"><span>    tcp                                  frames:13 bytes:1948
</span></span><span style="display:flex;"><span>      data                               frames:1 bytes:90
</span></span><span style="display:flex;"><span><span style="color:#f92672">===================================================================</span>
</span></span></code></pre></div><ul>
<li>Top IP conversations (who talked to whom?)</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap  -q -z conv,ip
</span></span><span style="display:flex;"><span><span style="color:#f92672">================================================================================</span>
</span></span><span style="display:flex;"><span>IPv4 Conversations
</span></span><span style="display:flex;"><span>Filter:&lt;No Filter&gt;
</span></span><span style="display:flex;"><span>                                               |       &lt;-      | |       -&gt;      | |     Total     |    Relative    |   Duration   |
</span></span><span style="display:flex;"><span>                                               | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |      Start     |              |
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 17.253.37.195          <span style="color:#ae81ff">19588</span> <span style="color:#ae81ff">29</span> MB        <span style="color:#ae81ff">3912</span> <span style="color:#ae81ff">286</span> kB      <span style="color:#ae81ff">23500</span> <span style="color:#ae81ff">29</span> MB        72.555738000        21.8560
</span></span><span style="display:flex;"><span>192.168.50.1         &lt;-&gt; 192.168.50.202           <span style="color:#ae81ff">239</span> <span style="color:#ae81ff">74</span> kB         <span style="color:#ae81ff">238</span> <span style="color:#ae81ff">46</span> kB         <span style="color:#ae81ff">477</span> <span style="color:#ae81ff">120</span> kB        0.293866000       119.4797
</span></span><span style="display:flex;"><span>192.168.50.1         &lt;-&gt; 224.0.0.251                <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes       <span style="color:#ae81ff">118</span> <span style="color:#ae81ff">28</span> kB         <span style="color:#ae81ff">118</span> <span style="color:#ae81ff">28</span> kB         0.000000000       119.7310
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 1.1.1.1                   <span style="color:#ae81ff">40</span> <span style="color:#ae81ff">20</span> kB          <span style="color:#ae81ff">36</span> <span style="color:#ae81ff">10</span> kB          <span style="color:#ae81ff">76</span> <span style="color:#ae81ff">31</span> kB        72.033321000        30.3367
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 2.19.120.151              <span style="color:#ae81ff">47</span> <span style="color:#ae81ff">44</span> kB          <span style="color:#ae81ff">29</span> 8,460 bytes      <span style="color:#ae81ff">76</span> <span style="color:#ae81ff">53</span> kB        72.062807000        14.8525
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 17.56.138.35              <span style="color:#ae81ff">27</span> 7,602 bytes      <span style="color:#ae81ff">33</span> <span style="color:#ae81ff">13</span> kB          <span style="color:#ae81ff">60</span> <span style="color:#ae81ff">20</span> kB        72.107270000        15.0196
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 17.253.53.203             <span style="color:#ae81ff">17</span> 7,040 bytes      <span style="color:#ae81ff">23</span> 9,256 bytes      <span style="color:#ae81ff">40</span> <span style="color:#ae81ff">16</span> kB        72.326823000        10.5130
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 54.217.122.41             <span style="color:#ae81ff">19</span> 6,271 bytes      <span style="color:#ae81ff">18</span> 6,122 bytes      <span style="color:#ae81ff">37</span> <span style="color:#ae81ff">12</span> kB       102.352119000         0.3678
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 17.253.53.202             <span style="color:#ae81ff">19</span> <span style="color:#ae81ff">22</span> kB          <span style="color:#ae81ff">17</span> 3,099 bytes      <span style="color:#ae81ff">36</span> <span style="color:#ae81ff">25</span> kB        81.940717000         0.3208
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 23.58.105.122             <span style="color:#ae81ff">19</span> 9,936 bytes      <span style="color:#ae81ff">16</span> 5,759 bytes      <span style="color:#ae81ff">35</span> <span style="color:#ae81ff">15</span> kB        72.225431000         9.6434
</span></span><span style="display:flex;"><span>192.168.50.104       &lt;-&gt; 255.255.255.255            <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes        <span style="color:#ae81ff">32</span> 2,240 bytes      <span style="color:#ae81ff">32</span> 2,240 bytes    50.628126000        65.2664
</span></span><span style="display:flex;"><span>17.242.218.132       &lt;-&gt; 192.168.50.202            <span style="color:#ae81ff">12</span> 1,701 bytes      <span style="color:#ae81ff">13</span> 1,802 bytes      <span style="color:#ae81ff">25</span> 3,503 bytes    20.967857000        62.0463
</span></span><span style="display:flex;"><span>192.168.50.189       &lt;-&gt; 3.122.71.119               <span style="color:#ae81ff">8</span> <span style="color:#ae81ff">639</span> bytes      <span style="color:#ae81ff">13</span> <span style="color:#ae81ff">978</span> bytes      <span style="color:#ae81ff">21</span> 1,617 bytes     1.112174000       108.8174
</span></span><span style="display:flex;"><span>192.168.50.131       &lt;-&gt; 224.0.0.251                <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes        <span style="color:#ae81ff">20</span> 6,092 bytes      <span style="color:#ae81ff">20</span> 6,092 bytes    19.033978000        79.6932
</span></span><span style="display:flex;"><span>192.168.50.118       &lt;-&gt; 224.0.0.251                <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes        <span style="color:#ae81ff">20</span> 6,092 bytes      <span style="color:#ae81ff">20</span> 6,092 bytes    79.030835000        19.7664
</span></span><span style="display:flex;"><span>192.168.50.233       &lt;-&gt; 224.0.0.251                <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes        <span style="color:#ae81ff">20</span> 6,052 bytes      <span style="color:#ae81ff">20</span> 6,052 bytes    79.031250000        19.7814
</span></span><span style="display:flex;"><span>192.168.50.196       &lt;-&gt; 18.196.19.65               <span style="color:#ae81ff">8</span> <span style="color:#ae81ff">570</span> bytes      <span style="color:#ae81ff">10</span> <span style="color:#ae81ff">678</span> bytes      <span style="color:#ae81ff">18</span> 1,248 bytes     4.963201000       107.5242
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 224.0.0.251                <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes        <span style="color:#ae81ff">12</span> 3,880 bytes      <span style="color:#ae81ff">12</span> 3,880 bytes    98.049857000         4.2949
</span></span><span style="display:flex;"><span>192.168.50.134       &lt;-&gt; 161.117.178.131            <span style="color:#ae81ff">5</span> <span style="color:#ae81ff">391</span> bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">960</span> bytes       <span style="color:#ae81ff">9</span> 1,351 bytes    15.392290000        60.5936
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 192.168.50.189             <span style="color:#ae81ff">4</span> 1,300 bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">312</span> bytes       <span style="color:#ae81ff">8</span> 1,612 bytes    26.274469000        93.2919
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 192.168.50.118             <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">406</span> bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">402</span> bytes       <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">808</span> bytes    17.999757000        60.1593
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 192.168.50.131             <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">406</span> bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">402</span> bytes       <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">808</span> bytes    17.999812000        60.1593
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 192.168.50.233             <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">406</span> bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">402</span> bytes       <span style="color:#ae81ff">6</span> <span style="color:#ae81ff">808</span> bytes    17.999825000        60.1592
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 192.168.50.196             <span style="color:#ae81ff">3</span> <span style="color:#ae81ff">975</span> bytes       <span style="color:#ae81ff">3</span> <span style="color:#ae81ff">234</span> bytes       <span style="color:#ae81ff">6</span> 1,209 bytes    30.223646000        89.3442
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 192.168.50.233             <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">888</span> bytes       <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">162</span> bytes       <span style="color:#ae81ff">6</span> 1,050 bytes    98.322145000         0.1456
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 192.168.50.202             <span style="color:#ae81ff">1</span> 1,092 bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">336</span> bytes       <span style="color:#ae81ff">5</span> 1,428 bytes    98.319211000         0.2939
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 192.168.50.1               <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes         <span style="color:#ae81ff">5</span> <span style="color:#ae81ff">455</span> bytes       <span style="color:#ae81ff">5</span> <span style="color:#ae81ff">455</span> bytes    98.319329000         0.2505
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 17.253.53.201              <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">148</span> bytes       <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">132</span> bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">280</span> bytes    81.716483000         1.0465
</span></span><span style="display:flex;"><span>192.168.50.202       &lt;-&gt; 192.168.50.104             <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">818</span> bytes       <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">156</span> bytes       <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">974</span> bytes    87.030561000         0.0107
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 192.168.50.131             <span style="color:#ae81ff">3</span> <span style="color:#ae81ff">718</span> bytes       <span style="color:#ae81ff">1</span> <span style="color:#ae81ff">75</span> bytes        <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">793</span> bytes    98.321918000         0.1421
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 192.168.50.118             <span style="color:#ae81ff">3</span> <span style="color:#ae81ff">718</span> bytes       <span style="color:#ae81ff">1</span> <span style="color:#ae81ff">75</span> bytes        <span style="color:#ae81ff">4</span> <span style="color:#ae81ff">793</span> bytes    98.322266000         0.1420
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 17.57.146.25               <span style="color:#ae81ff">1</span> <span style="color:#ae81ff">90</span> bytes        <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">172</span> bytes       <span style="color:#ae81ff">3</span> <span style="color:#ae81ff">262</span> bytes    98.048979000         0.0384
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 192.168.50.134             <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">790</span> bytes       <span style="color:#ae81ff">1</span> <span style="color:#ae81ff">75</span> bytes        <span style="color:#ae81ff">3</span> <span style="color:#ae81ff">865</span> bytes    98.321779000         0.2550
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 224.0.0.2                  <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span> bytes         <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">92</span> bytes        <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">92</span> bytes     98.049757000         0.0001
</span></span><span style="display:flex;"><span>192.168.50.216       &lt;-&gt; 10.172.72.196              <span style="color:#ae81ff">1</span> <span style="color:#ae81ff">66</span> bytes        <span style="color:#ae81ff">1</span> <span style="color:#ae81ff">70</span> bytes        <span style="color:#ae81ff">2</span> <span style="color:#ae81ff">136</span> bytes    98.664295000         0.0060
</span></span><span style="display:flex;"><span><span style="color:#f92672">================================================================================</span>
</span></span></code></pre></div><ul>
<li>Fast “top talkers” table (by source IP)</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap  -T fields -e ip.src -e frame.len <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  | awk <span style="color:#e6db74">&#39;NF==2{b[$1]+=$2} END{for (h in b) printf &#34;%-16s %12d\n&#34;, h, b[h]}&#39;</span> <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  | sort -k2,2nr | head -n <span style="color:#ae81ff">20</span>
</span></span><span style="display:flex;"><span>17.253.37.195        <span style="color:#ae81ff">29540349</span>
</span></span><span style="display:flex;"><span>192.168.50.202         <span style="color:#ae81ff">422414</span>
</span></span><span style="display:flex;"><span>192.168.50.1            <span style="color:#ae81ff">75521</span>
</span></span><span style="display:flex;"><span>2.19.120.151            <span style="color:#ae81ff">44554</span>
</span></span><span style="display:flex;"><span>17.253.53.202           <span style="color:#ae81ff">22016</span>
</span></span><span style="display:flex;"><span>1.1.1.1                 <span style="color:#ae81ff">20675</span>
</span></span><span style="display:flex;"><span>23.58.105.122            <span style="color:#ae81ff">9936</span>
</span></span><span style="display:flex;"><span>17.56.138.35             <span style="color:#ae81ff">7602</span>
</span></span><span style="display:flex;"><span>192.168.50.233           <span style="color:#ae81ff">7346</span>
</span></span><span style="display:flex;"><span>192.168.50.118           <span style="color:#ae81ff">7216</span>
</span></span><span style="display:flex;"><span>192.168.50.131           <span style="color:#ae81ff">7216</span>
</span></span><span style="display:flex;"><span>17.253.53.203            <span style="color:#ae81ff">7040</span>
</span></span><span style="display:flex;"><span>54.217.122.41            <span style="color:#ae81ff">6271</span>
</span></span><span style="display:flex;"><span>192.168.50.216           <span style="color:#ae81ff">5392</span>
</span></span><span style="display:flex;"><span>192.168.50.104           <span style="color:#ae81ff">3058</span>
</span></span><span style="display:flex;"><span>192.168.50.189           <span style="color:#ae81ff">2278</span>
</span></span><span style="display:flex;"><span>17.242.218.132           <span style="color:#ae81ff">1802</span>
</span></span><span style="display:flex;"><span>192.168.50.134           <span style="color:#ae81ff">1750</span>
</span></span><span style="display:flex;"><span>192.168.50.196           <span style="color:#ae81ff">1653</span>
</span></span><span style="display:flex;"><span>3.122.71.119              <span style="color:#ae81ff">639</span>
</span></span></code></pre></div><ul>
<li>DNS &amp; mDNS highlights (what names show up?)</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># DNS queries (unicast)</span>
</span></span><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap -Y <span style="color:#e6db74">&#34;dns.flags.response==0&#34;</span> <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  -T fields -e frame.time -e ip.src -e dns.qry.name | head -n <span style="color:#ae81ff">20</span>
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:38.131162000 CET	192.168.50.1	_hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:42.961690000 CET	192.168.50.1	_hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:42.962245000 CET	192.168.50.1	_companion-link._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:42.962911000 CET	192.168.50.1	_hap._udp.local,_rdlink._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:43.098378000 CET	192.168.50.1	MSS110-f691._hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:43.158641000 CET	192.168.50.1	Qingping Air Monitor Lite._hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:43.201440000 CET	192.168.50.202	_companion-link._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:43.532623000 CET	192.168.50.1	MSS110-080d._hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:43.962673000 CET	192.168.50.1	_hap._tcp.local,MSS110-0ba7._hap._tcp.local,Main Bedroom <span style="color:#f92672">(</span>3<span style="color:#f92672">)</span>._companion-link._tcp.local,HomePodSensor 185277._hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:49.110167000 CET	192.168.50.1	_hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:49.110760000 CET	192.168.50.1	_companion-link._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:49.111395000 CET	192.168.50.1	_hap._udp.local,_rdlink._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:49.272920000 CET	192.168.50.1	Qingping Air Monitor Lite._hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:49.311002000 CET	192.168.50.1	MSS110-0ba7._hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:49.619376000 CET	192.168.50.1	Main Bedroom <span style="color:#f92672">(</span>3<span style="color:#f92672">)</span>._companion-link._tcp.local,MSS110-f691._hap._tcp.local,MSS110-080d._hap._tcp.local,HomePodSensor 185277._hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:50.115506000 CET	192.168.50.1	_hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:55.037844000 CET	192.168.50.1	_hap._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:55.038380000 CET	192.168.50.1	_companion-link._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:55.038926000 CET	192.168.50.1	_hap._udp.local,_rdlink._tcp.local
</span></span><span style="display:flex;"><span>Nov 23, <span style="color:#ae81ff">2025</span> 11:48:55.060503000 CET	192.168.50.202	_companion-link._tcp.local
</span></span><span style="display:flex;"><span>
</span></span><span style="display:flex;"><span><span style="color:#75715e"># mDNS service announcements (AirPlay/HomeKit live here)</span>
</span></span><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap  -Y <span style="color:#e6db74">&#34;udp.port==5353 &amp;&amp; dns&#34;</span> <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  -T fields -e frame.time -e ip.src -e dns.qry.name -e dns.ptr.domain_name <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  | head -n <span style="color:#ae81ff">30</span>
</span></span></code></pre></div><p>The latter had no output as I wasn&rsquo;t able to make that work with a static route and relied on Tailscale. (?)</p>
<ul>
<li>TLS SNI (which cloud endpoints?)</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap -Y <span style="color:#e6db74">&#34;tls.handshake.extensions_server_name&#34;</span> <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  -T fields -e ip.dst -e tls.handshake.extensions_server_name <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  | sort | uniq -c | sort -k1,1nr | head -n <span style="color:#ae81ff">20</span>
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 1.1.1.1	one.one.one.one
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 17.253.37.195	streamingaudio.itunes.apple.com
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 17.253.53.202	pancake.apple.com
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 17.253.53.203	radio-activity.itunes.apple.com
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 17.56.138.35	cma.itunes.apple.com
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 2.19.120.151	play.itunes.apple.com
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 23.58.105.122	librarydaap.itunes.apple.com
</span></span><span style="display:flex;"><span>   <span style="color:#ae81ff">1</span> 54.217.122.41	guzzoni.apple.com
</span></span></code></pre></div><ul>
<li>Ports in use (quick heat check)</li>
</ul>
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>❯ tshark -r iot_ap_120s.pcap -T fields -e _ws.col.Protocol -e tcp.dstport -e udp.dstport <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  | awk <span style="color:#e6db74">&#39;{for(i=1;i&lt;=NF;i++) if($i~/^[0-9]+$/) p[$i]++} END{for(k in p) printf &#34;%-8s %8d\n&#34;, k, p[k]}&#39;</span> <span style="color:#ae81ff">\
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span>  | sort -k2,2nr | head -n <span style="color:#ae81ff">20</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64725</span>       <span style="color:#ae81ff">19588</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">443</span>          <span style="color:#ae81ff">4086</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">5353</span>          <span style="color:#ae81ff">318</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">49395</span>         <span style="color:#ae81ff">109</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">7000</span>          <span style="color:#ae81ff">109</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">55514</span>         <span style="color:#ae81ff">102</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">55510</span>         <span style="color:#ae81ff">101</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64721</span>          <span style="color:#ae81ff">47</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">54806</span>          <span style="color:#ae81ff">40</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">20002</span>          <span style="color:#ae81ff">32</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64722</span>          <span style="color:#ae81ff">27</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">8883</span>           <span style="color:#ae81ff">23</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">49154</span>          <span style="color:#ae81ff">21</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">55515</span>          <span style="color:#ae81ff">21</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64723</span>          <span style="color:#ae81ff">19</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64728</span>          <span style="color:#ae81ff">19</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64729</span>          <span style="color:#ae81ff">19</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">5223</span>           <span style="color:#ae81ff">14</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64724</span>          <span style="color:#ae81ff">14</span>
</span></span><span style="display:flex;"><span><span style="color:#ae81ff">64686</span>          <span style="color:#ae81ff">13</span>
</span></span></code></pre></div><hr>
<h2 id="epilogue">Epilogue</h2>
<p>I&rsquo;ve been having so so much trouble with setting up a iot-hub for my house where I can connect all my IoT devices to, and without putting a phone on hotspot. Now I finally did it, and I even treated myself by allowing mDNS routing! Let&rsquo;s cross our fingers and hope this setup finally works nicely.</p>
<hr>
<div class="signature-block" style="margin-top:1rem">
  <p><strong>Downloads:</strong>
    <a href="/sources/posts/house_upgrade.md">Markdown</a> ·
    <a href="/sources/posts/house_upgrade.md.asc">Signature (.asc)</a>
  </p><details class="signature">
    <summary>View OpenPGP signature</summary>
    <pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuUACgkQtYgoUOBM
jSr4mxAAr6wizjfSiJPTCywZaFD7DpF1QqVL5N2r7&#43;W6iPkxjXU5ju4yaRyJ3LGP
ob51GUAPqSstrTZUJRIQs54MQMqL0WNBiesVSDXlT&#43;cqAgRVN4SaYrRg&#43;dV&#43;kRCA
dnFuXXJBvo9y/QYk&#43;SR4F2I9SeqsOQ2V0H2SxndLQAVI318VRbJLwaZF5XHLU8Ax
a/&#43;sOpjI2bGgTCW6P2r97PaXyde9Itkdp0LBN2JfkXfmzdY1JdjPdaNmUZuY3N6J
HO4MfBUYX33RLmq/CSDm5wzOQRi1O9wt63CWJzzsZuZACbmuJ0gZHYM5JIBHXtnZ
wgdtfu31ulnFPVfoIVjCCcN80kWlh671ONKQTZOysknFonm5pIUJnOcCQ4S3HfIm
Of5kojUQegInp84ju4yYKCMh115yB05XTyrhf62NouGQVGSBmNBwgFZe4kbfqZ4w
xsAfFOpk6niLqZTX1NmgaXeBcalFU2yOzIEH4dXu7OSZmN3UUznAxw4SciD0&#43;HW&#43;
T7RjrniAIgX3fFlqIexoDbCa6T2g8Gd00zBzHG65pO4mwAuFL4KB0xLU8KIz6L7M
aMFcFVAuq8GdqBbn6mRQ3UwFkOIjq&#43;WbAgvxDJprxI9jBafm6IVXrISyHx0mYfnP
OAFDAL768GiHQz7LIB/lLa0qAT6Hs28JZ3/czfGPwVNthFp8tA0=
=bk46
-----END PGP SIGNATURE-----
</pre>
  </details><p><em>Verify locally:</em></p>
  <pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">torsocks curl -fSLO http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/sources/posts/house_upgrade.md
torsocks curl -fSLO http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/sources/posts/house_upgrade.md.asc
gpg --verify house_upgrade.md.asc house_upgrade.md
  </pre>
</div>


]]></content:encoded>
    </item>
  </channel>
</rss>
