407 lines
No EOL
125 KiB
HTML
407 lines
No EOL
125 KiB
HTML
<!doctype html><html lang=en dir=auto><head><meta charset=utf-8><meta http-equiv=X-UA-Compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=robots content="noindex, nofollow"><title>I Beat My 8-Device Wi-Fi Limit with a Raspberry Pi (and Made an IoT Village) | AlipourIm journeys</title>
|
||
<meta name=keywords content="raspberry pi,wifi,iot,networking,hostapd,dnsmasq"><meta name=description content="Real-world guide: hardware choices, reasons, setup details, performance, and how many devices you can realistically support."><meta name=author content="Iman Alipour"><link rel=canonical href=https://blog.alipour.eu/posts/house_upgrade/><link crossorigin=anonymous href=/assets/css/stylesheet.31b150d909186c48d6dbbf653acc2489945fa9ac2c8f8cd3fe8448e89e40fccf.css integrity="sha256-MbFQ2QkYbEjW279lOswkiZRfqawsj4zT/oRI6J5A/M8=" rel="preload stylesheet" as=style><link rel=icon href=https://blog.alipour.eu/favicon.ico><link rel=icon type=image/png sizes=16x16 href=https://blog.alipour.eu/favicon-16x16.png><link rel=icon type=image/png sizes=32x32 href=https://blog.alipour.eu/favicon-32x32.png><link rel=apple-touch-icon href=https://blog.alipour.eu/apple-touch-icon.png><link rel=mask-icon href=https://blog.alipour.eu/safari-pinned-tab.svg><meta name=theme-color content="#2e2e33"><meta name=msapplication-TileColor content="#2e2e33"><link rel=alternate hreflang=en href=https://blog.alipour.eu/posts/house_upgrade/><noscript><style>#theme-toggle,.top-link{display:none}</style><style>@media(prefers-color-scheme:dark){:root{--theme:rgb(29, 30, 32);--entry:rgb(46, 46, 51);--primary:rgb(218, 218, 219);--secondary:rgb(155, 156, 157);--tertiary:rgb(65, 66, 68);--content:rgb(196, 196, 197);--code-block-bg:rgb(46, 46, 51);--code-bg:rgb(55, 56, 62);--border:rgb(51, 51, 51)}.list{background:var(--theme)}.list:not(.dark)::-webkit-scrollbar-track{background:0 0}.list:not(.dark)::-webkit-scrollbar-thumb{border-color:var(--theme)}}</style></noscript><script>(function(){window.goatcounter={endpoint:"/count"};const e=document.createElement("script");e.async=!0,e.src="/js/count.js",document.head.appendChild(e)})()</script><script>(function(){const s="",t=new Intl.NumberFormat,o="visit",i="visits";function a(e){document.readyState==="complete"||document.readyState==="interactive"?setTimeout(e,0):document.addEventListener("DOMContentLoaded",e)}function r(){try{return window.goatcounter&&window.goatcounter.get_data?window.goatcounter.get_data().p:location.pathname}catch{return location.pathname}}async function e(e,t){try{const o=new URLSearchParams({t:String(Date.now())});t&&o.set("start",t);const a=`${s}/counter/${encodeURIComponent(e)}.json?${o}`,n=await fetch(a,{credentials:"omit"});if(n.status===404)return 0;if(!n.ok)throw 0;const r=await n.json(),i=Number(String(r.count).replace(/,/g,""));return Number.isFinite(i)?i:0}catch{return null}}const n=e=>e===null?"—":`${t.format(e)} ${e===1?o:i}`;a(async function(){const s=document.querySelector(".post-single");if(s){const t=s.querySelector(".post-header .post-meta, .post-header .entry-meta, .post-meta"),o=await e(r());if(t){let e=t.querySelector(".post-views");e||(e=document.createElement("span"),e.className="post-views",t.appendChild(e)),e.textContent=n(o??0)}}const i=document.querySelectorAll("article.post-entry");await Promise.all(Array.from(i).map(async t=>{const s=t.querySelector(".entry-footer, .post-meta"),o=t.querySelector("a.entry-link, h2 a, .entry-title a");if(!s||!o)return;try{const i=new URL(o.getAttribute("href"),location.origin);if(i.origin!==location.origin)return;let t=s.querySelector(".post-views");t||(t=document.createElement("span"),t.className="post-views",s.appendChild(t)),t.textContent=n(await e(i.pathname)??0)}catch{}}));const o=document.getElementById("gc_site_visitors_week");if(o){const n=await e("TOTAL","week");o.textContent=n===null?"—":t.format(n)}})})()</script></head><body id=top><script>localStorage.getItem("pref-theme")==="dark"?document.body.classList.add("dark"):localStorage.getItem("pref-theme")==="light"?document.body.classList.remove("dark"):window.matchMedia("(prefers-color-scheme: dark)").matches&&document.body.classList.add("dark")</script><header class=header><nav class=nav><div class=logo><a href=https://blog.alipour.eu/ accesskey=h title="AlipourIm journeys (Alt + H)">AlipourIm journeys</a><div class=logo-switches><button id=theme-toggle accesskey=t title="(Alt + T)" aria-label="Toggle theme"><svg id="moon" width="24" height="18" viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1111.21 3 7 7 0 0021 12.79z"/></svg><svg id="sun" width="24" height="18" viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="5"/><line x1="12" y1="1" x2="12" y2="3"/><line x1="12" y1="21" x2="12" y2="23"/><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/><line x1="1" y1="12" x2="3" y2="12"/><line x1="21" y1="12" x2="23" y2="12"/><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/></svg></button></div></div><ul id=menu><li><a href=https://blog.alipour.eu/posts/ title=Posts><span>Posts</span></a></li><li><a href=https://blog.alipour.eu/phd_journey/ title=PhD_journey><span>PhD_journey</span></a></li><li><a href=https://blog.alipour.eu/about/ title=About><span>About</span></a></li></ul></nav></header><main class=main><article class=post-single><header class=post-header><div class=breadcrumbs><a href=https://blog.alipour.eu/>Home</a> » <a href=https://blog.alipour.eu/posts/>Posts</a></div><h1 class="post-title entry-hint-parent">I Beat My 8-Device Wi-Fi Limit with a Raspberry Pi (and Made an IoT Village)</h1><div class=post-description>Real-world guide: hardware choices, reasons, setup details, performance, and how many devices you can realistically support.</div><div class=post-meta><span title='2025-11-23 00:00:00 +0000 UTC'>November 23, 2025</span> · 18 min · Iman Alipour
|
||
<span class=post-meta-item><a href=https://blog.alipour.eu/posts/house_upgrade/#isso-thread class=isso-comments-link>Comments</a></span></div></header><div class=toc><details open><summary accesskey=c title="(Alt + C)"><span class=details>Table of Contents</span></summary><div class=inner><ul><li><a href=#the-day-my-wi-fi-said-eight-is-enough aria-label="The Day My Wi-Fi Said “Eight Is Enough”">The Day My Wi-Fi Said “Eight Is Enough”</a></li><li><a href=#hardware-what-i-picked-and-why aria-label="Hardware: what I picked and why">Hardware: what I picked and why</a></li><li><a href=#what-this-setup-actually-does aria-label="What this setup actually does">What this setup actually does</a></li><li><a href=#setup-details-the-friendly-version aria-label="Setup details (the friendly version)">Setup details (the friendly version)</a><ul><li><a href=#1-access-point-with-hostapd aria-label="1) Access point with hostapd">1) Access point with hostapd</a></li><li><a href=#2-dhcp-on-the-iot-side-dnsmasq aria-label="2) DHCP on the IoT side (dnsmasq)">2) DHCP on the IoT side (dnsmasq)</a></li><li><a href=#3-routing--nat-nftables aria-label="3) Routing + NAT (nftables)">3) Routing + NAT (nftables)</a></li><li><a href=#4-mdns-across-subnets-avahi aria-label="4) mDNS across subnets (Avahi)">4) mDNS across subnets (Avahi)</a></li></ul></li><li><a href=#troubleshooting aria-label=Troubleshooting>Troubleshooting</a></li><li><a href=#quick-service-sanity-checks aria-label="Quick service sanity checks">Quick service sanity checks</a><ul><li><a href=#hostapd-ap aria-label="hostapd (AP)">hostapd (AP)</a></li><li><a href=#dnsmasq-dhcp-on-iot-side aria-label="dnsmasq (DHCP on IoT side)">dnsmasq (DHCP on IoT side)</a></li><li><a href=#avahi-mdns-reflector aria-label="Avahi (mDNS reflector)">Avahi (mDNS reflector)</a></li></ul></li><li><a href=#basic-connectivity-tests-from-a-client-on-iot_hub aria-label="Basic connectivity tests from a client on IoT_hub">Basic connectivity tests from a client on IoT_hub</a><ul><li><a href=#got-dhcp aria-label="got DHCP?">got DHCP?</a></li><li><a href=#can-you-reach-the-pi-and-the-internet aria-label="can you reach the Pi and the internet?">can you reach the Pi and the internet?</a></li><li><a href=#dns-works-end-to-end aria-label="DNS works end-to-end?">DNS works end-to-end?</a></li></ul></li><li><a href=#if-airplayhomekit-discovery-is-flaky-across-subnets aria-label="If AirPlay/HomeKit discovery is flaky across subnets">If AirPlay/HomeKit discovery is flaky across subnets</a><ul><li><a href=#make-sure-mdns-is-allowed-both-directions-on-the-pi aria-label="make sure mDNS is allowed both directions on the Pi">make sure mDNS is allowed both directions on the Pi</a></li><li><a href=#restart-avahi-cleanly-and-re-announce aria-label="restart Avahi cleanly and re-announce">restart Avahi cleanly and re-announce</a></li><li><a href=#from-the-pi-watch-mdns-traffic-on-both-sides-you-should-see-queriesanswers aria-label="from the Pi, watch mDNS traffic on both sides (you should see queries/answers)">from the Pi, watch mDNS traffic on both sides (you should see queries/answers)</a></li></ul></li><li><a href=#throughput--airtime-sanity-optional aria-label="Throughput + airtime sanity (optional)">Throughput + airtime sanity (optional)</a><ul><li><a href=#simple-iperf3-install-on-pi-and-a-client aria-label="simple iperf3 (install on Pi and a client)">simple iperf3 (install on Pi and a client)</a></li><li><a href=#check-channel-utilizationinterference-from-pi aria-label="check channel utilization/interference (from Pi)">check channel utilization/interference (from Pi)</a></li></ul></li><li><a href=#scaling-tips-lots-of-tiny-iot-devices aria-label="Scaling tips (lots of tiny IoT devices)">Scaling tips (lots of tiny IoT devices)</a><ul><li><a href=#hostapd-tweaks-add-to-hostapdconf-then-restart aria-label="hostapd tweaks (add to hostapd.conf, then restart)">hostapd tweaks (add to hostapd.conf, then restart)</a></li><li><a href=#if-some-esplow-power-clients-are-sticky-or-nap-too-hard aria-label="if some ESP/low-power clients are sticky or nap too hard:">if some ESP/low-power clients are sticky or nap too hard:</a></li></ul></li><li><a href=#clients-connect-but-no-internet-quick-checklist aria-label="“Clients connect but no internet” quick checklist">“Clients connect but no internet” quick checklist</a><ul><li><a href=#pi-has-a-default-route-via-upstream aria-label="Pi has a default route via upstream?">Pi has a default route via upstream?</a></li><li><a href=#nat-counters-are-increasing-when-clients-surf aria-label="NAT counters are increasing when clients surf?">NAT counters are increasing when clients surf?</a></li><li><a href=#connections-tracked aria-label="connections tracked?">connections tracked?</a></li><li><a href=#last-resort-bounce-the-pieces aria-label="last resort: bounce the pieces">last resort: bounce the pieces</a></li></ul></li><li><a href=#network-traffic-embedded-from-captures aria-label="Network Traffic (embedded from captures)">Network Traffic (embedded from captures)</a><ul><li><a href=#1-dhcp-leases-who-joined-the-iot-network aria-label="1) DHCP leases (who joined the IoT network)">1) DHCP leases (who joined the IoT network)</a></li><li><a href=#2-top-talkers-by-bytes-hosts-table aria-label="2) Top talkers by bytes (hosts table)">2) Top talkers by bytes (hosts table)</a></li><li><a href=#3-heaviest-flows-src-dst-proto-dport-bytes aria-label="3) Heaviest flows (src, dst, proto, dport, bytes)">3) Heaviest flows (src, dst, proto, dport, bytes)</a></li><li><a href=#4-conntrack-snapshot-active-connections-inventory aria-label="4) Conntrack snapshot (active connections inventory)">4) Conntrack snapshot (active connections inventory)</a></li><li><a href=#5-part-of-raw-packet-capture aria-label="5) Part of Raw packet capture">5) Part of Raw packet capture</a></li></ul></li><li><a href=#epilogue aria-label=Epilogue>Epilogue</a></li></ul></div></details></div><div class=post-content><h2 id=the-day-my-wi-fi-said-eight-is-enough>The Day My Wi-Fi Said “Eight Is Enough”<a hidden class=anchor aria-hidden=true href=#the-day-my-wi-fi-said-eight-is-enough>#</a></h2><p>My apartment Wi-Fi (ASK4) has a hard cap of <strong>8 devices</strong>. That’s adorable until you own a phone, a laptop, a tablet, a TV, a smart speaker, and even a couple of smart plugs. My solution: put <strong>all the IoT stuff behind a Raspberry Pi</strong> that shows up as <strong>one</strong> device to the building’s network, but acts like a full-blown Wi-Fi for everything else I own.</p><p>This post is everything I did—no corporate firewall access, no exotic gear—just a Pi, a USB Wi-Fi adapter, and a little patience.</p><hr><h2 id=hardware-what-i-picked-and-why>Hardware: what I picked and why<a hidden class=anchor aria-hidden=true href=#hardware-what-i-picked-and-why>#</a></h2><ul><li><p><strong>Raspberry Pi 4 (4GB)</strong><br>It has enough CPU to route/NAT comfortably, USB 3 for fast Wi-Fi dongles, and solid Linux support. A Pi 3 works in a pinch, but the 4 stays cooler and handles bursts better.</p></li><li><p><strong>ALFA AWUS036ACHM (USB Wi-Fi)</strong><br>Reliable, <strong>AP-mode</strong> friendly on Linux, and happy with <code>hostapd</code>. I used it to <strong>broadcast</strong> my IoT network (2.4 GHz, 20 MHz channel) while the Pi’s built-in Wi-Fi connects upstream. For better range, use a short <strong>USB 3 extension</strong> so the antenna sits away from the Pi (USB 3 noise can hurt 2.4 GHz).</p></li><li><p><strong>Fast USB-C power supply</strong> (official Pi 4 or 5V/3A equivalent)<br>Wi-Fi spikes current draw; brown-outs cause random gremlins.</p></li><li><p><strong>16–32 GB microSD</strong>, <strong>heatsinks</strong>, <strong>ventilated case</strong><br>The Pi 4 appreciates a bit of airflow.</p></li><li><p><strong>(Optional) Ethernet cable</strong><br>If you can wire the Pi to the wall/router for upstream instead of using onboard Wi-Fi, do it. Wired upstream = higher, steadier throughput and frees the onboard radio.</p></li></ul><hr><h2 id=what-this-setup-actually-does>What this setup actually does<a hidden class=anchor aria-hidden=true href=#what-this-setup-actually-does>#</a></h2><ul><li>The Pi connects to the building’s <strong>ASK4 Wi-Fi</strong> as a <strong>client</strong> (<code>wlan0</code>).</li><li>The ALFA dongle creates a new access point called <strong><code>IoT_hub</code></strong> (<code>wlx…</code> interface) with password <code>Iman8118</code>.</li><li>Devices join <code>IoT_hub</code>. The Pi does <strong>NAT</strong>, so upstream sees <strong>one MAC address</strong> (the Pi), not dozens of gadgets. Device limit: defeated.</li><li><strong>Avahi mDNS reflector</strong> lets services like <strong>AirPlay/HomeKit</strong> be discoverable across the two subnets without touching the managed router.</li><li>If I’m on the building Wi-Fi and want to control IoT gear without switching, I can also use an optional overlay (e.g., <strong>Tailscale</strong>) to reach <code>192.168.50.0/24</code> from anywhere.</li></ul><hr><h2 id=setup-details-the-friendly-version>Setup details (the friendly version)<a hidden class=anchor aria-hidden=true href=#setup-details-the-friendly-version>#</a></h2><h3 id=1-access-point-with-hostapd>1) Access point with hostapd<a hidden class=anchor aria-hidden=true href=#1-access-point-with-hostapd>#</a></h3><p>I broadcast a simple WPA2 network on <strong>2.4 GHz</strong> (best compatibility). Channel <strong>1/6/11</strong>—pick the cleanest. 20 MHz channel width keeps legacy and low-power devices happy.</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-ini data-lang=ini><span style=display:flex><span><span style=color:#a6e22e>interface</span><span style=color:#f92672>=</span><span style=color:#e6db74>wlx00c0cab7ab29</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>ssid</span><span style=color:#f92672>=</span><span style=color:#e6db74><A_NICE_SSID></span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>country_code</span><span style=color:#f92672>=</span><span style=color:#e6db74>DE</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>hw_mode</span><span style=color:#f92672>=</span><span style=color:#e6db74>g</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>channel</span><span style=color:#f92672>=</span><span style=color:#e6db74>6</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>ieee80211n</span><span style=color:#f92672>=</span><span style=color:#e6db74>1</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>wmm_enabled</span><span style=color:#f92672>=</span><span style=color:#e6db74>1</span>
|
||
</span></span><span style=display:flex><span><span style=color:#75715e># Don't require HT or you'll reject some tiny IoT clients:</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>require_ht</span><span style=color:#f92672>=</span><span style=color:#e6db74>0</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>wpa</span><span style=color:#f92672>=</span><span style=color:#e6db74>2</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>wpa_key_mgmt</span><span style=color:#f92672>=</span><span style=color:#e6db74>WPA-PSK</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>rsn_pairwise</span><span style=color:#f92672>=</span><span style=color:#e6db74>CCMP</span>
|
||
</span></span><span style=display:flex><span><span style=color:#a6e22e>wpa_passphrase</span><span style=color:#f92672>=</span><span style=color:#e6db74><STRONG_PASSWORD></span>
|
||
</span></span></code></pre></div><h3 id=2-dhcp-on-the-iot-side-dnsmasq>2) DHCP on the IoT side (dnsmasq)<a hidden class=anchor aria-hidden=true href=#2-dhcp-on-the-iot-side-dnsmasq>#</a></h3><p>Give out addresses on 192.168.50.0/24 and let systemd-resolved handle DNS to the internet.</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>interface<span style=color:#f92672>=</span>wlx00c0cab7ab29
|
||
</span></span><span style=display:flex><span>bind-interfaces
|
||
</span></span><span style=display:flex><span>dhcp-range<span style=color:#f92672>=</span>192.168.50.100,192.168.50.240,255.255.255.0,12h
|
||
</span></span><span style=display:flex><span>dhcp-option<span style=color:#f92672>=</span>3,192.168.50.1
|
||
</span></span><span style=display:flex><span>dhcp-option<span style=color:#f92672>=</span>6,1.1.1.1,8.8.8.8
|
||
</span></span><span style=display:flex><span>port<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> <span style=color:#75715e># leave port 53 to systemd-resolved</span>
|
||
</span></span><span style=display:flex><span>log-dhcp
|
||
</span></span></code></pre></div><h3 id=3-routing--nat-nftables>3) Routing + NAT (nftables)<a hidden class=anchor aria-hidden=true href=#3-routing--nat-nftables>#</a></h3><p>This makes every downstream device appear as the Pi upstream:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>table inet filter <span style=color:#f92672>{</span>
|
||
</span></span><span style=display:flex><span> chain input <span style=color:#f92672>{</span>
|
||
</span></span><span style=display:flex><span> type filter hook input priority filter; policy accept;
|
||
</span></span><span style=display:flex><span> ct state established,related accept
|
||
</span></span><span style=display:flex><span> iif <span style=color:#e6db74>"lo"</span> accept
|
||
</span></span><span style=display:flex><span> iif <span style=color:#e6db74>"wlan0"</span> accept
|
||
</span></span><span style=display:flex><span> iif <span style=color:#e6db74>"wlx00c0cab7ab29"</span> accept
|
||
</span></span><span style=display:flex><span> udp dport <span style=color:#ae81ff>5353</span> accept <span style=color:#75715e># mDNS</span>
|
||
</span></span><span style=display:flex><span> counter drop
|
||
</span></span><span style=display:flex><span> <span style=color:#f92672>}</span>
|
||
</span></span><span style=display:flex><span> chain forward <span style=color:#f92672>{</span>
|
||
</span></span><span style=display:flex><span> type filter hook forward priority filter; policy accept;
|
||
</span></span><span style=display:flex><span> ct state established,related accept
|
||
</span></span><span style=display:flex><span> iif <span style=color:#e6db74>"wlx00c0cab7ab29"</span> oif <span style=color:#e6db74>"wlan0"</span> accept
|
||
</span></span><span style=display:flex><span> iif <span style=color:#e6db74>"wlan0"</span> oif <span style=color:#e6db74>"wlx00c0cab7ab29"</span> accept
|
||
</span></span><span style=display:flex><span> <span style=color:#f92672>}</span>
|
||
</span></span><span style=display:flex><span> chain output <span style=color:#f92672>{</span> type filter hook output priority filter; policy accept; <span style=color:#f92672>}</span>
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>}</span>
|
||
</span></span><span style=display:flex><span>table ip nat <span style=color:#f92672>{</span>
|
||
</span></span><span style=display:flex><span> chain postrouting <span style=color:#f92672>{</span>
|
||
</span></span><span style=display:flex><span> type nat hook postrouting priority srcnat; policy accept;
|
||
</span></span><span style=display:flex><span> oif <span style=color:#e6db74>"wlan0"</span> masquerade
|
||
</span></span><span style=display:flex><span> <span style=color:#f92672>}</span>
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>}</span>
|
||
</span></span></code></pre></div><h3 id=4-mdns-across-subnets-avahi>4) mDNS across subnets (Avahi)<a hidden class=anchor aria-hidden=true href=#4-mdns-across-subnets-avahi>#</a></h3><p>The reflector bridges Bonjour so AirPlay/HomeKit can find each other across IoT and ASK4:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span><span style=color:#f92672>[</span>server<span style=color:#f92672>]</span>
|
||
</span></span><span style=display:flex><span>allow-interfaces<span style=color:#f92672>=</span>wlan0,wlx00c0cab7ab29
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>[</span>reflector<span style=color:#f92672>]</span>
|
||
</span></span><span style=display:flex><span>enable-reflector<span style=color:#f92672>=</span>yes
|
||
</span></span></code></pre></div><p>I wanted to be able to control my homepod without switching networks, but without setting a custom route on ASK4 WiFi it was not possible, hence the reason I chose Tailscale</p><p>Iet up Tailscale, advertise 192.168.50.0/24 from the Pi. Now I can log in with a passkey from my devices and control my homepod without switching networks, well, kinda. Boom! Secure access to IoT without leaving ASK4.</p><p>Now some random questions that I looked up in internet:</p><ol><li>How many devices can this really support?</li></ol><p>Short answer: a lot—for IoT.
|
||
Long answer: the DHCP pool here has 141 IPs (.100 to .240). Wi-Fi airtime is the real limit, not IPs. With a 2.4 GHz AP and mostly low-bandwidth gadgets (sensors, plugs, bulbs, ESPs), 50–70 devices is completely reasonable. The ALFA’s radio and hostapd handle concurrent associations fine; I’ve watched dozens attach, chatter, and renew leases without drama.</p><p>If you plan camera-heavy traffic or bulk transfers, either split heavy gear onto 5 GHz or wire those devices. For small, chatty IoT traffic, this Pi/AP combo is very comfortable.</p><ol start=2><li>What speeds should I expect?</li></ol><ul><li><p>LAN (IoT device ↔ Pi) on 2.4 GHz, 20 MHz channel, WPA2:
|
||
~20–60 Mbps real throughput per device is typical. IoT stuff barely needs 1 Mbps, so I’m golden! ^^</p></li><li><p>Internet (IoT device → upstream via Pi):
|
||
If the Pi’s upstream is Wi-Fi, which in my case is, the bottleneck is that link; expect ~30–70 Mbps stable. If upstream is Ethernet, the Pi 4 can NAT hundreds of Mbps, and my AP radio becomes the limit.</p></li><li><p>Latency: Adding one NAT hop adds a little delay (a few ms). For HomePod/AirPlay, mDNS reflection + local Wi-Fi keeps it snappy.</p></li></ul><ol start=3><li>Why these choices?</li></ol><ul><li><p>2.4 GHz is where tiny IoT radios live (bulbs, plugs, ESP/ESP32). It trades speed for range and compatibility.</p></li><li><p>WPA2-PSK keeps things simple; WPA3 is fine if all your clients support it.</p></li><li><p>20 MHz channel prevents older or power-saving devices from flaking out.</p></li><li><p>Avahi reflector avoids any changes to the building’s router and still lets discovery work.</p></li><li><p>NAT collapses dozens of gadgets into a single upstream “seat,” sidestepping the 8-device limit entirely.</p></li></ul><h2 id=troubleshooting>Troubleshooting<a hidden class=anchor aria-hidden=true href=#troubleshooting>#</a></h2><ul><li><p><code>hostapd</code> <strong>masked/disabled</strong> →</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo systemctl unmask hostapd <span style=color:#f92672>&&</span> sudo systemctl enable --now hostapd
|
||
</span></span></code></pre></div></li><li><p><code>dnsmasq</code> can’t start because of <strong>port 53</strong> →<br>set <code>port=0</code> in <code>/etc/dnsmasq.d/*.conf</code> and let systemd-resolved keep DNS.</p></li><li><p><strong>“Station does not support mandatory HT PHY”</strong> in <code>hostapd</code> logs →<br>add <code>require_ht=0</code> (and keep <code>ieee80211n=1</code>) in your <code>hostapd.conf</code>.</p></li><li><p>AirPlay/HomeKit don’t show up across subnets →<br>ensure Avahi reflector is enabled and UDP/5353 (mDNS) is allowed:</p><ul><li><code>/etc/avahi/avahi-daemon.conf</code> has:<div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span><span style=color:#f92672>[</span>server<span style=color:#f92672>]</span>
|
||
</span></span><span style=display:flex><span>allow-interfaces<span style=color:#f92672>=</span>wlan0,wlx00c0cab7ab29
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>[</span>reflector<span style=color:#f92672>]</span>
|
||
</span></span><span style=display:flex><span>enable-reflector<span style=color:#f92672>=</span>yes
|
||
</span></span></code></pre></div></li><li>firewall allows:</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>udp dport <span style=color:#ae81ff>5353</span> accept
|
||
</span></span></code></pre></div></li><li><p>Weak signal / flaky joins →<br>use a short <strong>USB 3 extension</strong> to move the ALFA away from the Pi and cables;<br>scan and switch to a cleaner <strong>2.4 GHz</strong> channel (1/6/11), keep width at <strong>20 MHz</strong>.</p></li><li><p>Clients connect but no internet →<br>verify IP forward & NAT:</p></li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo sysctl net.ipv4.ip_forward
|
||
</span></span></code></pre></div><p>If it’s 0, enable it permanently and reload</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>echo <span style=color:#e6db74>'net.ipv4.ip_forward=1'</span> | sudo tee /etc/sysctl.d/99-iot.conf
|
||
</span></span><span style=display:flex><span>sudo sysctl --system
|
||
</span></span></code></pre></div><p>Verify the nftables NAT rule exists (masquerade out via wlan0)</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo nft list ruleset | sed -n <span style=color:#e6db74>'/table ip nat/,$p'</span> | sed -n <span style=color:#e6db74>'1,80p'</span>
|
||
</span></span></code></pre></div><p>Add it if missing</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo nft add table ip nat
|
||
</span></span><span style=display:flex><span>sudo nft <span style=color:#e6db74>'add chain ip nat postrouting { type nat hook postrouting priority srcnat; policy accept; }'</span>
|
||
</span></span><span style=display:flex><span>sudo nft <span style=color:#e6db74>'add rule ip nat postrouting oif "wlan0" masquerade'</span>
|
||
</span></span></code></pre></div><p>Persist nftables (Ubuntu)</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo sh -c <span style=color:#e6db74>'nft list ruleset > /etc/nftables.conf'</span>
|
||
</span></span><span style=display:flex><span>sudo systemctl enable --now nftables
|
||
</span></span></code></pre></div><h2 id=quick-service-sanity-checks>Quick service sanity checks<a hidden class=anchor aria-hidden=true href=#quick-service-sanity-checks>#</a></h2><h3 id=hostapd-ap>hostapd (AP)<a hidden class=anchor aria-hidden=true href=#hostapd-ap>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo systemctl status hostapd --no-pager
|
||
</span></span><span style=display:flex><span>sudo journalctl -u hostapd -n <span style=color:#ae81ff>60</span> --no-pager
|
||
</span></span><span style=display:flex><span>iw dev wlx00c0cab7ab29 info
|
||
</span></span><span style=display:flex><span>iw dev wlx00c0cab7ab29 station dump
|
||
</span></span></code></pre></div><h3 id=dnsmasq-dhcp-on-iot-side>dnsmasq (DHCP on IoT side)<a hidden class=anchor aria-hidden=true href=#dnsmasq-dhcp-on-iot-side>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo systemctl status dnsmasq --no-pager
|
||
</span></span><span style=display:flex><span>sudo journalctl -u dnsmasq -n <span style=color:#ae81ff>80</span> --no-pager
|
||
</span></span><span style=display:flex><span>grep -E <span style=color:#e6db74>'interface=|dhcp-range'</span> /etc/dnsmasq.d/*.conf <span style=color:#f92672>||</span> true
|
||
</span></span><span style=display:flex><span>tail -n <span style=color:#ae81ff>50</span> /var/lib/misc/dnsmasq.leases
|
||
</span></span></code></pre></div><h3 id=avahi-mdns-reflector>Avahi (mDNS reflector)<a hidden class=anchor aria-hidden=true href=#avahi-mdns-reflector>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>grep -E <span style=color:#e6db74>'enable-reflector|allow-interfaces'</span> /etc/avahi/avahi-daemon.conf
|
||
</span></span><span style=display:flex><span>sudo systemctl status avahi-daemon --no-pager
|
||
</span></span><span style=display:flex><span>sudo journalctl -u avahi-daemon -n <span style=color:#ae81ff>60</span> --no-pager
|
||
</span></span></code></pre></div><h2 id=basic-connectivity-tests-from-a-client-on-iot_hub>Basic connectivity tests from a client on IoT_hub<a hidden class=anchor aria-hidden=true href=#basic-connectivity-tests-from-a-client-on-iot_hub>#</a></h2><h3 id=got-dhcp>got DHCP?<a hidden class=anchor aria-hidden=true href=#got-dhcp>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>ip addr show
|
||
</span></span><span style=display:flex><span>ip route
|
||
</span></span><span style=display:flex><span>cat /etc/resolv.conf
|
||
</span></span></code></pre></div><h3 id=can-you-reach-the-pi-and-the-internet>can you reach the Pi and the internet?<a hidden class=anchor aria-hidden=true href=#can-you-reach-the-pi-and-the-internet>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>ping -c <span style=color:#ae81ff>3</span> 192.168.50.1
|
||
</span></span><span style=display:flex><span>ping -c <span style=color:#ae81ff>3</span> 1.1.1.1
|
||
</span></span><span style=display:flex><span>ping -c <span style=color:#ae81ff>3</span> google.com
|
||
</span></span></code></pre></div><h3 id=dns-works-end-to-end>DNS works end-to-end?<a hidden class=anchor aria-hidden=true href=#dns-works-end-to-end>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span>dig +short _airplay._tcp.local @224.0.0.251 -p <span style=color:#ae81ff>5353</span>
|
||
</span></span></code></pre></div><p>(Or use a Bonjour browser app to confirm the HomePod is discoverable.)</p><h2 id=if-airplayhomekit-discovery-is-flaky-across-subnets>If AirPlay/HomeKit discovery is flaky across subnets<a hidden class=anchor aria-hidden=true href=#if-airplayhomekit-discovery-is-flaky-across-subnets>#</a></h2><h3 id=make-sure-mdns-is-allowed-both-directions-on-the-pi>make sure mDNS is allowed both directions on the Pi<a hidden class=anchor aria-hidden=true href=#make-sure-mdns-is-allowed-both-directions-on-the-pi>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span>sudo nft add rule inet filter input udp dport <span style=color:#ae81ff>5353</span> accept
|
||
</span></span><span style=display:flex><span>sudo nft add rule inet filter forward udp dport <span style=color:#ae81ff>5353</span> accept
|
||
</span></span><span style=display:flex><span>sudo sh -c <span style=color:#e6db74>'nft list ruleset > /etc/nftables.conf'</span>
|
||
</span></span></code></pre></div><h3 id=restart-avahi-cleanly-and-re-announce>restart Avahi cleanly and re-announce<a hidden class=anchor aria-hidden=true href=#restart-avahi-cleanly-and-re-announce>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo systemctl restart avahi-daemon
|
||
</span></span><span style=display:flex><span>sudo journalctl -u avahi-daemon -n <span style=color:#ae81ff>40</span> --no-pager
|
||
</span></span></code></pre></div><h3 id=from-the-pi-watch-mdns-traffic-on-both-sides-you-should-see-queriesanswers>from the Pi, watch mDNS traffic on both sides (you should see queries/answers)<a hidden class=anchor aria-hidden=true href=#from-the-pi-watch-mdns-traffic-on-both-sides-you-should-see-queriesanswers>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo tcpdump -ni wlx00c0cab7ab29 udp port <span style=color:#ae81ff>5353</span> -vvv
|
||
</span></span></code></pre></div><p>(in another terminal:)</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo tcpdump -ni wlan0 udp port <span style=color:#ae81ff>5353</span> -vvv
|
||
</span></span></code></pre></div><h2 id=throughput--airtime-sanity-optional>Throughput + airtime sanity (optional)<a hidden class=anchor aria-hidden=true href=#throughput--airtime-sanity-optional>#</a></h2><h3 id=simple-iperf3-install-on-pi-and-a-client>simple iperf3 (install on Pi and a client)<a hidden class=anchor aria-hidden=true href=#simple-iperf3-install-on-pi-and-a-client>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo apt-get update <span style=color:#f92672>&&</span> sudo apt-get install -y iperf3
|
||
</span></span></code></pre></div><p>(on the Pi:) <code>iperf3 -s</code>
|
||
(on a client:) <code>iperf3 -c 192.168.50.1 -P 3 -t 10</code></p><h3 id=check-channel-utilizationinterference-from-pi>check channel utilization/interference (from Pi)<a hidden class=anchor aria-hidden=true href=#check-channel-utilizationinterference-from-pi>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo iw dev wlx00c0cab7ab29 survey dump | sed -n <span style=color:#e6db74>'1,200p'</span>
|
||
</span></span></code></pre></div><p>(if busy, try channel 1 or 11 in hostapd.conf and restart hostapd)</p><h2 id=scaling-tips-lots-of-tiny-iot-devices>Scaling tips (lots of tiny IoT devices)<a hidden class=anchor aria-hidden=true href=#scaling-tips-lots-of-tiny-iot-devices>#</a></h2><h3 id=hostapd-tweaks-add-to-hostapdconf-then-restart>hostapd tweaks (add to hostapd.conf, then restart)<a hidden class=anchor aria-hidden=true href=#hostapd-tweaks-add-to-hostapdconf-then-restart>#</a></h3><p>(reduce management overhead slightly; keep conservative for compatibility)</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>beacon_int<span style=color:#f92672>=</span><span style=color:#ae81ff>100</span>
|
||
</span></span><span style=display:flex><span>dtim_period<span style=color:#f92672>=</span><span style=color:#ae81ff>2</span>
|
||
</span></span><span style=display:flex><span>wmm_enabled<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ap_isolate<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span>
|
||
</span></span><span style=display:flex><span>max_num_sta<span style=color:#f92672>=</span><span style=color:#ae81ff>256</span> <span style=color:#75715e># logical cap; real limit is airtime/driver</span>
|
||
</span></span></code></pre></div><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo systemctl restart hostapd
|
||
</span></span></code></pre></div><h3 id=if-some-esplow-power-clients-are-sticky-or-nap-too-hard>if some ESP/low-power clients are sticky or nap too hard:<a hidden class=anchor aria-hidden=true href=#if-some-esplow-power-clients-are-sticky-or-nap-too-hard>#</a></h3><p>(device-side) disable aggressive power saving if supported<br>(AP-side) keep channel width at 20 MHz and <code>require_ht=0</code> for legacy clients</p><h2 id=clients-connect-but-no-internet-quick-checklist>“Clients connect but no internet” quick checklist<a hidden class=anchor aria-hidden=true href=#clients-connect-but-no-internet-quick-checklist>#</a></h2><h3 id=pi-has-a-default-route-via-upstream>Pi has a default route via upstream?<a hidden class=anchor aria-hidden=true href=#pi-has-a-default-route-via-upstream>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>ip route | grep default
|
||
</span></span></code></pre></div><h3 id=nat-counters-are-increasing-when-clients-surf>NAT counters are increasing when clients surf?<a hidden class=anchor aria-hidden=true href=#nat-counters-are-increasing-when-clients-surf>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo nft list chain ip nat postrouting -a
|
||
</span></span></code></pre></div><h3 id=connections-tracked>connections tracked?<a hidden class=anchor aria-hidden=true href=#connections-tracked>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo conntrack -L -o extended | head -n <span style=color:#ae81ff>40</span>
|
||
</span></span></code></pre></div><h3 id=last-resort-bounce-the-pieces>last resort: bounce the pieces<a hidden class=anchor aria-hidden=true href=#last-resort-bounce-the-pieces>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>sudo systemctl restart hostapd dnsmasq avahi-daemon
|
||
</span></span><span style=display:flex><span>sudo systemctl restart NetworkManager <span style=color:#f92672>||</span> true
|
||
</span></span><span style=display:flex><span>sudo systemctl restart nftables
|
||
</span></span></code></pre></div><h2 id=network-traffic-embedded-from-captures>Network Traffic (embedded from captures)<a hidden class=anchor aria-hidden=true href=#network-traffic-embedded-from-captures>#</a></h2><p>For fun, and curiousity!</p><h3 id=1-dhcp-leases-who-joined-the-iot-network>1) DHCP leases (who joined the IoT network)<a hidden class=anchor aria-hidden=true href=#1-dhcp-leases-who-joined-the-iot-network>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span><span style=color:#ae81ff>1763936213</span> 6a:12:f6:62:40:88 192.168.50.216 * 01:6a:12:f6:62:40:88
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935691</span> 72:00:a6:33:e5:7a 192.168.50.222 * 01:72:00:a6:33:e5:7a
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935629</span> e8:06:90:69:66:7c 192.168.50.189 Aidot 01:e8:06:90:69:66:7c
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763936452</span> ac:bc:b5:e5:38:29 192.168.50.202 Main-Bedroom-2 01:ac:bc:b5:e5:38:29
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935618</span> e8:06:90:68:06:2c 192.168.50.196 * 01:e8:06:90:68:06:2c
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935618</span> 48:e1:e9:bc:f6:91 192.168.50.131 * *
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935618</span> 48:e1:e9:bd:08:0d 192.168.50.118 * *
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935615</span> 48:e1:e9:bd:0b:a7 192.168.50.233 * *
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935618</span> 7c:f1:7e:ff:e1:b0 192.168.50.104 KH100 *
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>1763935607</span> cc:b5:d1:31:a4:cc 192.168.50.134 espressif 01:cc:b5:d1:31:a4:cc
|
||
</span></span></code></pre></div><h3 id=2-top-talkers-by-bytes-hosts-table>2) Top talkers by bytes (hosts table)<a hidden class=anchor aria-hidden=true href=#2-top-talkers-by-bytes-hosts-table>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>192.168.50.233,7346
|
||
</span></span><span style=display:flex><span>192.168.50.118,7216
|
||
</span></span><span style=display:flex><span>192.168.50.131,7216
|
||
</span></span><span style=display:flex><span>17.253.53.203,7040
|
||
</span></span><span style=display:flex><span>54.217.122.41,6271
|
||
</span></span><span style=display:flex><span>192.168.50.216,5392
|
||
</span></span><span style=display:flex><span>192.168.50.104,3058
|
||
</span></span><span style=display:flex><span>192.168.50.189,2278
|
||
</span></span><span style=display:flex><span>17.242.218.132,1802
|
||
</span></span><span style=display:flex><span>192.168.50.134,1750
|
||
</span></span><span style=display:flex><span>192.168.50.196,1653
|
||
</span></span><span style=display:flex><span>3.122.71.119,639
|
||
</span></span><span style=display:flex><span>18.196.19.65,570
|
||
</span></span><span style=display:flex><span>161.117.178.131,391
|
||
</span></span><span style=display:flex><span>17.253.53.201,148
|
||
</span></span><span style=display:flex><span>17.57.146.25,90
|
||
</span></span><span style=display:flex><span>10.172.72.196,66
|
||
</span></span><span style=display:flex><span>224.0.0.251,0
|
||
</span></span><span style=display:flex><span>224.0.0.2,0
|
||
</span></span><span style=display:flex><span>255.255.255.255,0
|
||
</span></span></code></pre></div><h3 id=3-heaviest-flows-src-dst-proto-dport-bytes>3) Heaviest flows (src, dst, proto, dport, bytes)<a hidden class=anchor aria-hidden=true href=#3-heaviest-flows-src-dst-proto-dport-bytes>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>192.168.50.202,192.168.50.131,TCP,59903,402
|
||
</span></span><span style=display:flex><span>192.168.50.202,192.168.50.118,TCP,59807,402
|
||
</span></span><span style=display:flex><span>161.117.178.131,192.168.50.134,TCP,58246,391
|
||
</span></span><span style=display:flex><span>192.168.50.216,192.168.50.202,UDP,5353,336
|
||
</span></span><span style=display:flex><span>192.168.50.202,192.168.50.189,UDP,5353,312
|
||
</span></span><span style=display:flex><span>192.168.50.202,192.168.50.196,UDP,5353,234
|
||
</span></span><span style=display:flex><span>17.253.53.203,192.168.50.202,TCP,64726,222
|
||
</span></span><span style=display:flex><span>192.168.50.216,17.57.146.25,TCP,5223,172
|
||
</span></span><span style=display:flex><span>192.168.50.216,192.168.50.233,UDP,5353,162
|
||
</span></span><span style=display:flex><span>192.168.50.202,192.168.50.104,UDP,5353,156
|
||
</span></span><span style=display:flex><span>17.253.53.201,192.168.50.202,TCP,64727,148
|
||
</span></span><span style=display:flex><span>192.168.50.202,17.253.53.201,TCP,443,132
|
||
</span></span><span style=display:flex><span>192.168.50.216,224.0.0.251,IP,0,92
|
||
</span></span><span style=display:flex><span>192.168.50.216,224.0.0.2,IP,0,92
|
||
</span></span><span style=display:flex><span>17.57.146.25,192.168.50.216,TCP,64544,90
|
||
</span></span><span style=display:flex><span>192.168.50.216,192.168.50.118,UDP,5353,75
|
||
</span></span><span style=display:flex><span>192.168.50.216,192.168.50.131,UDP,5353,75
|
||
</span></span><span style=display:flex><span>192.168.50.216,192.168.50.134,UDP,5353,75
|
||
</span></span><span style=display:flex><span>192.168.50.216,10.172.72.196,TCP,59593,70
|
||
</span></span><span style=display:flex><span>10.172.72.196,192.168.50.216,TCP,51638,66
|
||
</span></span></code></pre></div><h3 id=4-conntrack-snapshot-active-connections-inventory>4) Conntrack snapshot (active connections inventory)<a hidden class=anchor aria-hidden=true href=#4-conntrack-snapshot-active-connections-inventory>#</a></h3><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>48</span> TIME_WAIT src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>185.125.190.39 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>55012</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>80</span> src<span style=color:#f92672>=</span>185.125.190.39 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>80</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>55012</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>100</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>185.40.234.113 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>3478</span> src<span style=color:#f92672>=</span>185.40.234.113 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>3478</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431665</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.216 dst<span style=color:#f92672>=</span>17.57.146.25 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>64544</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5223</span> src<span style=color:#f92672>=</span>17.57.146.25 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5223</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>64544</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>27</span> src<span style=color:#f92672>=</span>10.172.72.205 dst<span style=color:#f92672>=</span>224.0.0.251 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>10.172.72.205 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>17</span> src<span style=color:#f92672>=</span>10.172.72.196 dst<span style=color:#f92672>=</span>10.172.79.255 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>137</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>137</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>10.172.79.255 dst<span style=color:#f92672>=</span>10.172.72.196 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>137</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>137</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431999</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.196 dst<span style=color:#f92672>=</span>18.196.19.65 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>55164</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>8883</span> src<span style=color:#f92672>=</span>18.196.19.65 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>8883</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>55164</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>16</span> src<span style=color:#f92672>=</span>127.0.0.1 dst<span style=color:#f92672>=</span>127.0.0.53 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41796</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> src<span style=color:#f92672>=</span>127.0.0.53 dst<span style=color:#f92672>=</span>127.0.0.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41796</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> unknown <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>265</span> src<span style=color:#f92672>=</span>192.168.50.216 dst<span style=color:#f92672>=</span>224.0.0.251 <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>192.168.50.216 mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>5</span> src<span style=color:#f92672>=</span>192.168.50.104 dst<span style=color:#f92672>=</span>1.1.1.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>23791</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> src<span style=color:#f92672>=</span>1.1.1.1 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>23791</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>119</span> src<span style=color:#f92672>=</span>10.172.72.205 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.72.205 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>27</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>224.0.0.251 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431946</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.202 dst<span style=color:#f92672>=</span>17.242.218.132 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>64686</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5223</span> src<span style=color:#f92672>=</span>17.242.218.132 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5223</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>64686</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>10</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>239.255.255.250 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>40234</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>1900</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>239.255.255.250 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>1900</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>40234</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>96</span> TIME_WAIT src<span style=color:#f92672>=</span>192.168.50.104 dst<span style=color:#f92672>=</span>3.217.113.91 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>49707</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> src<span style=color:#f92672>=</span>3.217.113.91 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>49707</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>10</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.64.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>40234</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>1900</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>10.172.64.1 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>1900</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>40234</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431812</span> ESTABLISHED src<span style=color:#f92672>=</span>100.69.238.103 dst<span style=color:#f92672>=</span>192.168.50.202 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>55514</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>49395</span> src<span style=color:#f92672>=</span>192.168.50.202 dst<span style=color:#f92672>=</span>192.168.50.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>49395</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>55514</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431666</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.216 dst<span style=color:#f92672>=</span>10.172.72.196 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>51638</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>59593</span> src<span style=color:#f92672>=</span>10.172.72.196 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>59593</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>51638</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431998</span> ESTABLISHED src<span style=color:#f92672>=</span>100.69.238.103 dst<span style=color:#f92672>=</span>192.168.50.202 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>55510</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>7000</span> src<span style=color:#f92672>=</span>192.168.50.202 dst<span style=color:#f92672>=</span>192.168.50.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>7000</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>55510</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>14</span> src<span style=color:#f92672>=</span>192.168.50.131 dst<span style=color:#f92672>=</span>224.0.0.251 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>192.168.50.131 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> unknown <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>596</span> src<span style=color:#f92672>=</span>10.172.72.205 dst<span style=color:#f92672>=</span>224.0.0.251 <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>10.172.72.205 mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>27</span> src<span style=color:#f92672>=</span>192.168.50.1 dst<span style=color:#f92672>=</span>224.0.0.251 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>192.168.50.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>8</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>27</span> src<span style=color:#f92672>=</span>10.172.72.205 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.72.205 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>15</span> src<span style=color:#f92672>=</span>192.168.50.118 dst<span style=color:#f92672>=</span>224.0.0.251 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>224.0.0.251 dst<span style=color:#f92672>=</span>192.168.50.118 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>88</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>109.43.114.250 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> src<span style=color:#f92672>=</span>109.43.114.250 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431997</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.104 dst<span style=color:#f92672>=</span>18.234.9.109 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>49700</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> src<span style=color:#f92672>=</span>18.234.9.109 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>49700</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431998</span> ESTABLISHED src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>199.165.136.101 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>45248</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> src<span style=color:#f92672>=</span>199.165.136.101 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>45248</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431992</span> ESTABLISHED src<span style=color:#f92672>=</span>10.172.72.196 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>63953</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>22</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.72.196 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>22</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>63953</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431995</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.189 dst<span style=color:#f92672>=</span>3.122.71.119 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>50422</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>8883</span> src<span style=color:#f92672>=</span>3.122.71.119 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>8883</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>50422</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>100</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>176.58.90.104 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>3478</span> src<span style=color:#f92672>=</span>176.58.90.104 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>3478</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>107</span> TIME_WAIT src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>185.125.190.36 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>50914</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>80</span> src<span style=color:#f92672>=</span>185.125.190.36 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>80</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>50914</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>26</span> src<span style=color:#f92672>=</span>192.168.50.202 dst<span style=color:#f92672>=</span>192.168.50.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>192.168.50.1 dst<span style=color:#f92672>=</span>192.168.50.202 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5353</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>16</span> src<span style=color:#f92672>=</span>127.0.0.1 dst<span style=color:#f92672>=</span>127.0.0.53 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>33321</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> src<span style=color:#f92672>=</span>127.0.0.53 dst<span style=color:#f92672>=</span>127.0.0.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>33321</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431975</span> ESTABLISHED src<span style=color:#f92672>=</span>192.168.50.134 dst<span style=color:#f92672>=</span>161.117.178.131 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>58246</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>11883</span> src<span style=color:#f92672>=</span>161.117.178.131 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>11883</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>58246</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>16</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.64.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>35510</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> src<span style=color:#f92672>=</span>10.172.64.1 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>53</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>35510</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>100</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>176.58.93.154 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>3478</span> src<span style=color:#f92672>=</span>176.58.93.154 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>3478</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>41641</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431652</span> ESTABLISHED src<span style=color:#f92672>=</span>100.69.238.103 dst<span style=color:#f92672>=</span>192.168.50.202 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>55513</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>49394</span> src<span style=color:#f92672>=</span>192.168.50.202 dst<span style=color:#f92672>=</span>192.168.50.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>49394</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>55513</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>23</span> src<span style=color:#f92672>=</span>192.168.50.104 dst<span style=color:#f92672>=</span>255.255.255.255 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>21112</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>20002</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>255.255.255.255 dst<span style=color:#f92672>=</span>192.168.50.104 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>20002</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>21112</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>10</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.64.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>40234</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5351</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>10.172.64.1 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5351</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>40234</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> udp <span style=color:#ae81ff>17</span> <span style=color:#ae81ff>10</span> src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>10.172.64.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>34331</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>5351</span> <span style=color:#f92672>[</span>UNREPLIED<span style=color:#f92672>]</span> src<span style=color:#f92672>=</span>10.172.64.1 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>5351</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>34331</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431975</span> ESTABLISHED src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>192.200.0.115 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>48100</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> src<span style=color:#f92672>=</span>192.200.0.115 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>48100</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431999</span> ESTABLISHED src<span style=color:#f92672>=</span>10.172.71.98 dst<span style=color:#f92672>=</span>176.58.93.154 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>58128</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> src<span style=color:#f92672>=</span>176.58.93.154 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>58128</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>431997</span> ESTABLISHED src<span style=color:#f92672>=</span>100.69.238.103 dst<span style=color:#f92672>=</span>192.168.50.202 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>55515</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>49154</span> src<span style=color:#f92672>=</span>192.168.50.202 dst<span style=color:#f92672>=</span>192.168.50.1 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>49154</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>55515</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span><span style=display:flex><span>ipv4 <span style=color:#ae81ff>2</span> tcp <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>118</span> TIME_WAIT src<span style=color:#f92672>=</span>192.168.50.104 dst<span style=color:#f92672>=</span>3.217.113.91 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>49708</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> src<span style=color:#f92672>=</span>3.217.113.91 dst<span style=color:#f92672>=</span>10.172.71.98 sport<span style=color:#f92672>=</span><span style=color:#ae81ff>443</span> dport<span style=color:#f92672>=</span><span style=color:#ae81ff>49708</span> <span style=color:#f92672>[</span>ASSURED<span style=color:#f92672>]</span> mark<span style=color:#f92672>=</span><span style=color:#ae81ff>0</span> use<span style=color:#f92672>=</span><span style=color:#ae81ff>1</span>
|
||
</span></span></code></pre></div><h3 id=5-part-of-raw-packet-capture>5) Part of Raw packet capture<a hidden class=anchor aria-hidden=true href=#5-part-of-raw-packet-capture>#</a></h3><ul><li>What’s inside?</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>tshark -r iot_ap_120s.pcap -q -z io,stat,60
|
||
</span></span><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>==================================</span>
|
||
</span></span><span style=display:flex><span>| IO Statistics |
|
||
</span></span><span style=display:flex><span>| |
|
||
</span></span><span style=display:flex><span>| Duration: 119.773534 secs |
|
||
</span></span><span style=display:flex><span>| Interval: <span style=color:#ae81ff>60</span> secs |
|
||
</span></span><span style=display:flex><span>| |
|
||
</span></span><span style=display:flex><span>| Col 1: Frames and bytes |
|
||
</span></span><span style=display:flex><span>|--------------------------------|
|
||
</span></span><span style=display:flex><span>| |<span style=color:#ae81ff>1</span> |
|
||
</span></span><span style=display:flex><span>| Interval | Frames | Bytes |
|
||
</span></span><span style=display:flex><span>|--------------------------------|
|
||
</span></span><span style=display:flex><span>| <span style=color:#ae81ff>0</span> <> <span style=color:#ae81ff>60</span> | <span style=color:#ae81ff>400</span> | <span style=color:#ae81ff>60449</span> |
|
||
</span></span><span style=display:flex><span>| <span style=color:#ae81ff>60</span> <> Dur | <span style=color:#ae81ff>24672</span> | <span style=color:#ae81ff>30179911</span> |
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>==================================</span>
|
||
</span></span></code></pre></div><ul><li>Protocol hierarchy (what kinds of traffic?)</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -q -z io,phs
|
||
</span></span><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>===================================================================</span>
|
||
</span></span><span style=display:flex><span>Protocol Hierarchy Statistics
|
||
</span></span><span style=display:flex><span>Filter:
|
||
</span></span><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span>eth frames:25072 bytes:30240360
|
||
</span></span><span style=display:flex><span> ip frames:24706 bytes:30195993
|
||
</span></span><span style=display:flex><span> udp frames:349 bytes:94583
|
||
</span></span><span style=display:flex><span> mdns frames:241 bytes:60693
|
||
</span></span><span style=display:flex><span> data frames:32 bytes:2240
|
||
</span></span><span style=display:flex><span> quic frames:76 bytes:31650
|
||
</span></span><span style=display:flex><span> quic frames:2 bytes:2484
|
||
</span></span><span style=display:flex><span> tcp frames:24353 bytes:30101226
|
||
</span></span><span style=display:flex><span> tls frames:2413 bytes:3493680
|
||
</span></span><span style=display:flex><span> tcp.segments frames:2256 bytes:3378795
|
||
</span></span><span style=display:flex><span> tls frames:2222 bytes:3353799
|
||
</span></span><span style=display:flex><span> data frames:147 bytes:71717
|
||
</span></span><span style=display:flex><span> tcp.segments frames:5 bytes:7550
|
||
</span></span><span style=display:flex><span> igmp frames:4 bytes:184
|
||
</span></span><span style=display:flex><span> arp frames:150 bytes:6300
|
||
</span></span><span style=display:flex><span> ipv6 frames:216 bytes:38067
|
||
</span></span><span style=display:flex><span> icmpv6 frames:124 bytes:10704
|
||
</span></span><span style=display:flex><span> udp frames:79 bytes:25415
|
||
</span></span><span style=display:flex><span> data frames:2 bytes:132
|
||
</span></span><span style=display:flex><span> mdns frames:77 bytes:25283
|
||
</span></span><span style=display:flex><span> tcp frames:13 bytes:1948
|
||
</span></span><span style=display:flex><span> data frames:1 bytes:90
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>===================================================================</span>
|
||
</span></span></code></pre></div><ul><li>Top IP conversations (who talked to whom?)</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -q -z conv,ip
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>================================================================================</span>
|
||
</span></span><span style=display:flex><span>IPv4 Conversations
|
||
</span></span><span style=display:flex><span>Filter:<No Filter>
|
||
</span></span><span style=display:flex><span> | <- | | -> | | Total | Relative | Duration |
|
||
</span></span><span style=display:flex><span> | Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 17.253.37.195 <span style=color:#ae81ff>19588</span> <span style=color:#ae81ff>29</span> MB <span style=color:#ae81ff>3912</span> <span style=color:#ae81ff>286</span> kB <span style=color:#ae81ff>23500</span> <span style=color:#ae81ff>29</span> MB 72.555738000 21.8560
|
||
</span></span><span style=display:flex><span>192.168.50.1 <-> 192.168.50.202 <span style=color:#ae81ff>239</span> <span style=color:#ae81ff>74</span> kB <span style=color:#ae81ff>238</span> <span style=color:#ae81ff>46</span> kB <span style=color:#ae81ff>477</span> <span style=color:#ae81ff>120</span> kB 0.293866000 119.4797
|
||
</span></span><span style=display:flex><span>192.168.50.1 <-> 224.0.0.251 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>118</span> <span style=color:#ae81ff>28</span> kB <span style=color:#ae81ff>118</span> <span style=color:#ae81ff>28</span> kB 0.000000000 119.7310
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 1.1.1.1 <span style=color:#ae81ff>40</span> <span style=color:#ae81ff>20</span> kB <span style=color:#ae81ff>36</span> <span style=color:#ae81ff>10</span> kB <span style=color:#ae81ff>76</span> <span style=color:#ae81ff>31</span> kB 72.033321000 30.3367
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 2.19.120.151 <span style=color:#ae81ff>47</span> <span style=color:#ae81ff>44</span> kB <span style=color:#ae81ff>29</span> 8,460 bytes <span style=color:#ae81ff>76</span> <span style=color:#ae81ff>53</span> kB 72.062807000 14.8525
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 17.56.138.35 <span style=color:#ae81ff>27</span> 7,602 bytes <span style=color:#ae81ff>33</span> <span style=color:#ae81ff>13</span> kB <span style=color:#ae81ff>60</span> <span style=color:#ae81ff>20</span> kB 72.107270000 15.0196
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 17.253.53.203 <span style=color:#ae81ff>17</span> 7,040 bytes <span style=color:#ae81ff>23</span> 9,256 bytes <span style=color:#ae81ff>40</span> <span style=color:#ae81ff>16</span> kB 72.326823000 10.5130
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 54.217.122.41 <span style=color:#ae81ff>19</span> 6,271 bytes <span style=color:#ae81ff>18</span> 6,122 bytes <span style=color:#ae81ff>37</span> <span style=color:#ae81ff>12</span> kB 102.352119000 0.3678
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 17.253.53.202 <span style=color:#ae81ff>19</span> <span style=color:#ae81ff>22</span> kB <span style=color:#ae81ff>17</span> 3,099 bytes <span style=color:#ae81ff>36</span> <span style=color:#ae81ff>25</span> kB 81.940717000 0.3208
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 23.58.105.122 <span style=color:#ae81ff>19</span> 9,936 bytes <span style=color:#ae81ff>16</span> 5,759 bytes <span style=color:#ae81ff>35</span> <span style=color:#ae81ff>15</span> kB 72.225431000 9.6434
|
||
</span></span><span style=display:flex><span>192.168.50.104 <-> 255.255.255.255 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>32</span> 2,240 bytes <span style=color:#ae81ff>32</span> 2,240 bytes 50.628126000 65.2664
|
||
</span></span><span style=display:flex><span>17.242.218.132 <-> 192.168.50.202 <span style=color:#ae81ff>12</span> 1,701 bytes <span style=color:#ae81ff>13</span> 1,802 bytes <span style=color:#ae81ff>25</span> 3,503 bytes 20.967857000 62.0463
|
||
</span></span><span style=display:flex><span>192.168.50.189 <-> 3.122.71.119 <span style=color:#ae81ff>8</span> <span style=color:#ae81ff>639</span> bytes <span style=color:#ae81ff>13</span> <span style=color:#ae81ff>978</span> bytes <span style=color:#ae81ff>21</span> 1,617 bytes 1.112174000 108.8174
|
||
</span></span><span style=display:flex><span>192.168.50.131 <-> 224.0.0.251 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>20</span> 6,092 bytes <span style=color:#ae81ff>20</span> 6,092 bytes 19.033978000 79.6932
|
||
</span></span><span style=display:flex><span>192.168.50.118 <-> 224.0.0.251 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>20</span> 6,092 bytes <span style=color:#ae81ff>20</span> 6,092 bytes 79.030835000 19.7664
|
||
</span></span><span style=display:flex><span>192.168.50.233 <-> 224.0.0.251 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>20</span> 6,052 bytes <span style=color:#ae81ff>20</span> 6,052 bytes 79.031250000 19.7814
|
||
</span></span><span style=display:flex><span>192.168.50.196 <-> 18.196.19.65 <span style=color:#ae81ff>8</span> <span style=color:#ae81ff>570</span> bytes <span style=color:#ae81ff>10</span> <span style=color:#ae81ff>678</span> bytes <span style=color:#ae81ff>18</span> 1,248 bytes 4.963201000 107.5242
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 224.0.0.251 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>12</span> 3,880 bytes <span style=color:#ae81ff>12</span> 3,880 bytes 98.049857000 4.2949
|
||
</span></span><span style=display:flex><span>192.168.50.134 <-> 161.117.178.131 <span style=color:#ae81ff>5</span> <span style=color:#ae81ff>391</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>960</span> bytes <span style=color:#ae81ff>9</span> 1,351 bytes 15.392290000 60.5936
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 192.168.50.189 <span style=color:#ae81ff>4</span> 1,300 bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>312</span> bytes <span style=color:#ae81ff>8</span> 1,612 bytes 26.274469000 93.2919
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 192.168.50.118 <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>406</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>402</span> bytes <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>808</span> bytes 17.999757000 60.1593
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 192.168.50.131 <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>406</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>402</span> bytes <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>808</span> bytes 17.999812000 60.1593
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 192.168.50.233 <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>406</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>402</span> bytes <span style=color:#ae81ff>6</span> <span style=color:#ae81ff>808</span> bytes 17.999825000 60.1592
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 192.168.50.196 <span style=color:#ae81ff>3</span> <span style=color:#ae81ff>975</span> bytes <span style=color:#ae81ff>3</span> <span style=color:#ae81ff>234</span> bytes <span style=color:#ae81ff>6</span> 1,209 bytes 30.223646000 89.3442
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 192.168.50.233 <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>888</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>162</span> bytes <span style=color:#ae81ff>6</span> 1,050 bytes 98.322145000 0.1456
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 192.168.50.202 <span style=color:#ae81ff>1</span> 1,092 bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>336</span> bytes <span style=color:#ae81ff>5</span> 1,428 bytes 98.319211000 0.2939
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 192.168.50.1 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>5</span> <span style=color:#ae81ff>455</span> bytes <span style=color:#ae81ff>5</span> <span style=color:#ae81ff>455</span> bytes 98.319329000 0.2505
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 17.253.53.201 <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>148</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>132</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>280</span> bytes 81.716483000 1.0465
|
||
</span></span><span style=display:flex><span>192.168.50.202 <-> 192.168.50.104 <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>818</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>156</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>974</span> bytes 87.030561000 0.0107
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 192.168.50.131 <span style=color:#ae81ff>3</span> <span style=color:#ae81ff>718</span> bytes <span style=color:#ae81ff>1</span> <span style=color:#ae81ff>75</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>793</span> bytes 98.321918000 0.1421
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 192.168.50.118 <span style=color:#ae81ff>3</span> <span style=color:#ae81ff>718</span> bytes <span style=color:#ae81ff>1</span> <span style=color:#ae81ff>75</span> bytes <span style=color:#ae81ff>4</span> <span style=color:#ae81ff>793</span> bytes 98.322266000 0.1420
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 17.57.146.25 <span style=color:#ae81ff>1</span> <span style=color:#ae81ff>90</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>172</span> bytes <span style=color:#ae81ff>3</span> <span style=color:#ae81ff>262</span> bytes 98.048979000 0.0384
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 192.168.50.134 <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>790</span> bytes <span style=color:#ae81ff>1</span> <span style=color:#ae81ff>75</span> bytes <span style=color:#ae81ff>3</span> <span style=color:#ae81ff>865</span> bytes 98.321779000 0.2550
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 224.0.0.2 <span style=color:#ae81ff>0</span> <span style=color:#ae81ff>0</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>92</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>92</span> bytes 98.049757000 0.0001
|
||
</span></span><span style=display:flex><span>192.168.50.216 <-> 10.172.72.196 <span style=color:#ae81ff>1</span> <span style=color:#ae81ff>66</span> bytes <span style=color:#ae81ff>1</span> <span style=color:#ae81ff>70</span> bytes <span style=color:#ae81ff>2</span> <span style=color:#ae81ff>136</span> bytes 98.664295000 0.0060
|
||
</span></span><span style=display:flex><span><span style=color:#f92672>================================================================================</span>
|
||
</span></span></code></pre></div><ul><li>Fast “top talkers” table (by source IP)</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -T fields -e ip.src -e frame.len <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> | awk <span style=color:#e6db74>'NF==2{b[$1]+=$2} END{for (h in b) printf "%-16s %12d\n", h, b[h]}'</span> <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> | sort -k2,2nr | head -n <span style=color:#ae81ff>20</span>
|
||
</span></span><span style=display:flex><span>17.253.37.195 <span style=color:#ae81ff>29540349</span>
|
||
</span></span><span style=display:flex><span>192.168.50.202 <span style=color:#ae81ff>422414</span>
|
||
</span></span><span style=display:flex><span>192.168.50.1 <span style=color:#ae81ff>75521</span>
|
||
</span></span><span style=display:flex><span>2.19.120.151 <span style=color:#ae81ff>44554</span>
|
||
</span></span><span style=display:flex><span>17.253.53.202 <span style=color:#ae81ff>22016</span>
|
||
</span></span><span style=display:flex><span>1.1.1.1 <span style=color:#ae81ff>20675</span>
|
||
</span></span><span style=display:flex><span>23.58.105.122 <span style=color:#ae81ff>9936</span>
|
||
</span></span><span style=display:flex><span>17.56.138.35 <span style=color:#ae81ff>7602</span>
|
||
</span></span><span style=display:flex><span>192.168.50.233 <span style=color:#ae81ff>7346</span>
|
||
</span></span><span style=display:flex><span>192.168.50.118 <span style=color:#ae81ff>7216</span>
|
||
</span></span><span style=display:flex><span>192.168.50.131 <span style=color:#ae81ff>7216</span>
|
||
</span></span><span style=display:flex><span>17.253.53.203 <span style=color:#ae81ff>7040</span>
|
||
</span></span><span style=display:flex><span>54.217.122.41 <span style=color:#ae81ff>6271</span>
|
||
</span></span><span style=display:flex><span>192.168.50.216 <span style=color:#ae81ff>5392</span>
|
||
</span></span><span style=display:flex><span>192.168.50.104 <span style=color:#ae81ff>3058</span>
|
||
</span></span><span style=display:flex><span>192.168.50.189 <span style=color:#ae81ff>2278</span>
|
||
</span></span><span style=display:flex><span>17.242.218.132 <span style=color:#ae81ff>1802</span>
|
||
</span></span><span style=display:flex><span>192.168.50.134 <span style=color:#ae81ff>1750</span>
|
||
</span></span><span style=display:flex><span>192.168.50.196 <span style=color:#ae81ff>1653</span>
|
||
</span></span><span style=display:flex><span>3.122.71.119 <span style=color:#ae81ff>639</span>
|
||
</span></span></code></pre></div><ul><li>DNS & mDNS highlights (what names show up?)</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span><span style=color:#75715e># DNS queries (unicast)</span>
|
||
</span></span><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -Y <span style=color:#e6db74>"dns.flags.response==0"</span> <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> -T fields -e frame.time -e ip.src -e dns.qry.name | head -n <span style=color:#ae81ff>20</span>
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:38.131162000 CET 192.168.50.1 _hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:42.961690000 CET 192.168.50.1 _hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:42.962245000 CET 192.168.50.1 _companion-link._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:42.962911000 CET 192.168.50.1 _hap._udp.local,_rdlink._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:43.098378000 CET 192.168.50.1 MSS110-f691._hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:43.158641000 CET 192.168.50.1 Qingping Air Monitor Lite._hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:43.201440000 CET 192.168.50.202 _companion-link._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:43.532623000 CET 192.168.50.1 MSS110-080d._hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:43.962673000 CET 192.168.50.1 _hap._tcp.local,MSS110-0ba7._hap._tcp.local,Main Bedroom <span style=color:#f92672>(</span>3<span style=color:#f92672>)</span>._companion-link._tcp.local,HomePodSensor 185277._hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:49.110167000 CET 192.168.50.1 _hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:49.110760000 CET 192.168.50.1 _companion-link._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:49.111395000 CET 192.168.50.1 _hap._udp.local,_rdlink._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:49.272920000 CET 192.168.50.1 Qingping Air Monitor Lite._hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:49.311002000 CET 192.168.50.1 MSS110-0ba7._hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:49.619376000 CET 192.168.50.1 Main Bedroom <span style=color:#f92672>(</span>3<span style=color:#f92672>)</span>._companion-link._tcp.local,MSS110-f691._hap._tcp.local,MSS110-080d._hap._tcp.local,HomePodSensor 185277._hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:50.115506000 CET 192.168.50.1 _hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:55.037844000 CET 192.168.50.1 _hap._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:55.038380000 CET 192.168.50.1 _companion-link._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:55.038926000 CET 192.168.50.1 _hap._udp.local,_rdlink._tcp.local
|
||
</span></span><span style=display:flex><span>Nov 23, <span style=color:#ae81ff>2025</span> 11:48:55.060503000 CET 192.168.50.202 _companion-link._tcp.local
|
||
</span></span><span style=display:flex><span>
|
||
</span></span><span style=display:flex><span><span style=color:#75715e># mDNS service announcements (AirPlay/HomeKit live here)</span>
|
||
</span></span><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -Y <span style=color:#e6db74>"udp.port==5353 && dns"</span> <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> -T fields -e frame.time -e ip.src -e dns.qry.name -e dns.ptr.domain_name <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> | head -n <span style=color:#ae81ff>30</span>
|
||
</span></span></code></pre></div><p>The latter had no output as I wasn’t able to make that work with a static route and relied on Tailscale. (?)</p><ul><li>TLS SNI (which cloud endpoints?)</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -Y <span style=color:#e6db74>"tls.handshake.extensions_server_name"</span> <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> -T fields -e ip.dst -e tls.handshake.extensions_server_name <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> | sort | uniq -c | sort -k1,1nr | head -n <span style=color:#ae81ff>20</span>
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 1.1.1.1 one.one.one.one
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 17.253.37.195 streamingaudio.itunes.apple.com
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 17.253.53.202 pancake.apple.com
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 17.253.53.203 radio-activity.itunes.apple.com
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 17.56.138.35 cma.itunes.apple.com
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 2.19.120.151 play.itunes.apple.com
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 23.58.105.122 librarydaap.itunes.apple.com
|
||
</span></span><span style=display:flex><span> <span style=color:#ae81ff>1</span> 54.217.122.41 guzzoni.apple.com
|
||
</span></span></code></pre></div><ul><li>Ports in use (quick heat check)</li></ul><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>❯ tshark -r iot_ap_120s.pcap -T fields -e _ws.col.Protocol -e tcp.dstport -e udp.dstport <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> | awk <span style=color:#e6db74>'{for(i=1;i<=NF;i++) if($i~/^[0-9]+$/) p[$i]++} END{for(k in p) printf "%-8s %8d\n", k, p[k]}'</span> <span style=color:#ae81ff>\
|
||
</span></span></span><span style=display:flex><span><span style=color:#ae81ff></span> | sort -k2,2nr | head -n <span style=color:#ae81ff>20</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64725</span> <span style=color:#ae81ff>19588</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>443</span> <span style=color:#ae81ff>4086</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>5353</span> <span style=color:#ae81ff>318</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>49395</span> <span style=color:#ae81ff>109</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>7000</span> <span style=color:#ae81ff>109</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>55514</span> <span style=color:#ae81ff>102</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>55510</span> <span style=color:#ae81ff>101</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64721</span> <span style=color:#ae81ff>47</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>54806</span> <span style=color:#ae81ff>40</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>20002</span> <span style=color:#ae81ff>32</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64722</span> <span style=color:#ae81ff>27</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>8883</span> <span style=color:#ae81ff>23</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>49154</span> <span style=color:#ae81ff>21</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>55515</span> <span style=color:#ae81ff>21</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64723</span> <span style=color:#ae81ff>19</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64728</span> <span style=color:#ae81ff>19</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64729</span> <span style=color:#ae81ff>19</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>5223</span> <span style=color:#ae81ff>14</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64724</span> <span style=color:#ae81ff>14</span>
|
||
</span></span><span style=display:flex><span><span style=color:#ae81ff>64686</span> <span style=color:#ae81ff>13</span>
|
||
</span></span></code></pre></div><hr><h2 id=epilogue>Epilogue<a hidden class=anchor aria-hidden=true href=#epilogue>#</a></h2><p>I’ve been having so so much trouble with setting up a iot-hub for my house where I can connect all my IoT devices to, and without putting a phone on hotspot. Now I finally did it, and I even treated myself by allowing mDNS routing! Let’s cross our fingers and hope this setup finally works nicely.</p><hr><div class=signature-block style=margin-top:1rem><p><strong>Downloads:</strong>
|
||
<a href=/sources/posts/house_upgrade.md>Markdown</a> ·
|
||
<a href=/sources/posts/house_upgrade.md.asc>Signature (.asc)</a></p><details class=signature><summary>View OpenPGP signature</summary><pre style=font-size:.85em;overflow-x:auto;padding:.75rem>-----BEGIN PGP SIGNATURE-----
|
||
|
||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuUACgkQtYgoUOBM
|
||
jSr4mxAAr6wizjfSiJPTCywZaFD7DpF1QqVL5N2r7+W6iPkxjXU5ju4yaRyJ3LGP
|
||
ob51GUAPqSstrTZUJRIQs54MQMqL0WNBiesVSDXlT+cqAgRVN4SaYrRg+dV+kRCA
|
||
dnFuXXJBvo9y/QYk+SR4F2I9SeqsOQ2V0H2SxndLQAVI318VRbJLwaZF5XHLU8Ax
|
||
a/+sOpjI2bGgTCW6P2r97PaXyde9Itkdp0LBN2JfkXfmzdY1JdjPdaNmUZuY3N6J
|
||
HO4MfBUYX33RLmq/CSDm5wzOQRi1O9wt63CWJzzsZuZACbmuJ0gZHYM5JIBHXtnZ
|
||
wgdtfu31ulnFPVfoIVjCCcN80kWlh671ONKQTZOysknFonm5pIUJnOcCQ4S3HfIm
|
||
Of5kojUQegInp84ju4yYKCMh115yB05XTyrhf62NouGQVGSBmNBwgFZe4kbfqZ4w
|
||
xsAfFOpk6niLqZTX1NmgaXeBcalFU2yOzIEH4dXu7OSZmN3UUznAxw4SciD0+HW+
|
||
T7RjrniAIgX3fFlqIexoDbCa6T2g8Gd00zBzHG65pO4mwAuFL4KB0xLU8KIz6L7M
|
||
aMFcFVAuq8GdqBbn6mRQ3UwFkOIjq+WbAgvxDJprxI9jBafm6IVXrISyHx0mYfnP
|
||
OAFDAL768GiHQz7LIB/lLa0qAT6Hs28JZ3/czfGPwVNthFp8tA0=
|
||
=bk46
|
||
-----END PGP SIGNATURE-----
|
||
</pre></details><p><em>Verify locally:</em></p><pre style=font-size:.85em;overflow-x:auto;padding:.75rem>curl -fSLO https://blog.alipour.eu/sources/posts/house_upgrade.md
|
||
curl -fSLO https://blog.alipour.eu/sources/posts/house_upgrade.md.asc
|
||
gpg --verify house_upgrade.md.asc house_upgrade.md
|
||
</pre></div></div><footer class=post-footer><ul class=post-tags><li><a href=https://blog.alipour.eu/tags/raspberry-pi/>Raspberry Pi</a></li><li><a href=https://blog.alipour.eu/tags/wifi/>Wifi</a></li><li><a href=https://blog.alipour.eu/tags/iot/>Iot</a></li><li><a href=https://blog.alipour.eu/tags/networking/>Networking</a></li><li><a href=https://blog.alipour.eu/tags/hostapd/>Hostapd</a></li><li><a href=https://blog.alipour.eu/tags/dnsmasq/>Dnsmasq</a></li></ul><nav class=paginav><a class=prev href=https://blog.alipour.eu/phd_journey/november_2025/><span class=title>« Prev</span><br><span>November '25</span>
|
||
</a><a class=next href=https://blog.alipour.eu/posts/loop_of_doom/><span class=title>Next »</span><br><span>The Loop of Doom</span></a></nav></footer><div class=comments-switch style="display:flex;gap:.5rem;margin:.5rem 0 1rem"><button id=btn-isso type=button aria-pressed=true>Anonymous (Isso)</button>
|
||
<button id=btn-giscus type=button aria-pressed=false>GitHub (Giscus)</button>
|
||
<a href=https://github.com/AlipourIm/blog-comments/discussions/categories/comments target=_blank rel=noopener>Open on GitHub ↗</a></div><div id=panel-giscus style=display:none><section id=giscus-thread></section></div><div id=panel-isso><section id=isso-thread data-isso-id=/posts/house_upgrade/ data-title="I Beat My 8-Device Wi-Fi Limit with a Raspberry Pi (and Made an IoT Village)"><noscript>Javascript needs to be activated to view comments.</noscript></section><script src=/isso/js/embed.min.js data-isso=/isso/ data-isso-css=false data-isso-lang=en data-isso-max-comments-nested=5 data-isso-sorting=newest async></script><small class=isso-powered style="display:block;margin:.5rem 0;color:var(--secondary,#888)">Comments powered by <a href=https://isso-comments.de target=_blank rel=noopener>Isso</a></small></div><script>(function(){var i=document.getElementById("panel-isso"),a=document.getElementById("panel-giscus"),e=document.getElementById("btn-isso"),t=document.getElementById("btn-giscus"),s=!1;function r(){if(n=localStorage.getItem("pref-theme"),n==="dark")return!0;if(n==="light")return!1;var n,e=document.documentElement,t=document.body;return!!(e.classList&&e.classList.contains("dark")||t.classList&&t.classList.contains("dark")||e.getAttribute("data-theme")==="dark"||t.getAttribute("data-theme")==="dark"||e.classList&&e.classList.contains("theme-dark")||t.classList&&t.classList.contains("theme-dark"))||window.matchMedia&&window.matchMedia("(prefers-color-scheme: dark)").matches}function o(){return r()?"dark_dimmed":"noborder_light"}function c(){if(s)return;var t,n,e=document.createElement("script");e.src="https://giscus.app/client.js",e.async=!0,e.crossOrigin="anonymous",e.setAttribute("data-repo","AlipourIm/blog-comments"),e.setAttribute("data-repo-id","R_kgDOQGARyA"),e.setAttribute("data-category","Comments"),e.setAttribute("data-category-id","DIC_kwDOQGARyM4Cw3x-"),e.setAttribute("data-mapping","pathname"),e.setAttribute("data-strict","0"),e.setAttribute("data-reactions-enabled","1"),e.setAttribute("data-emit-metadata","0"),e.setAttribute("data-input-position","bottom"),e.setAttribute("data-lang","en"),e.setAttribute("data-theme",o()),document.getElementById("giscus-thread").appendChild(e);function i(){var e=document.querySelector("iframe.giscus-frame");e&&e.contentWindow&&e.contentWindow.postMessage({giscus:{setConfig:{theme:o()}}},"https://giscus.app")}t=document.getElementById("theme-toggle"),t&&t.addEventListener("click",function(){setTimeout(i,0)}),n=new MutationObserver(function(){i()}),n.observe(document.documentElement,{attributes:!0,attributeFilter:["class","data-theme"]}),n.observe(document.body,{attributes:!0,attributeFilter:["class","data-theme"]}),s=!0}function n(n){var s=n==="isso";i.style.display=s?"block":"none",a.style.display=s?"none":"block",e&&e.setAttribute("aria-pressed",s?"true":"false"),t&&t.setAttribute("aria-pressed",s?"false":"true"),s||c()}e&&e.addEventListener("click",function(e){e.preventDefault(),n("isso")}),t&&t.addEventListener("click",function(e){e.preventDefault(),n("giscus")}),n("isso")})()</script></article></main><footer class=footer><span>© 2026 <a href=https://blog.alipour.eu/>AlipourIm journeys</a></span> ·
|
||
<span>Powered by
|
||
<a href=https://gohugo.io/ rel="noopener noreferrer" target=_blank>Hugo</a> &
|
||
<a href=https://github.com/adityatelange/hugo-PaperMod/ rel=noopener target=_blank>PaperMod</a></span></footer><a href=#top aria-label="go to top" title="Go to Top (Alt + G)" class=top-link id=top-link accesskey=g><svg viewBox="0 0 12 6" fill="currentcolor"><path d="M12 6H0l6-6z"/></svg></a><div class=site-meta-row style=display:flex;align-items:center;gap:.75rem;flex-wrap:wrap><a href=/index.xml rel=alternate type=application/rss+xml title=RSS class=rss-link style=display:inline-flex;align-items:center;gap:.35rem><svg viewBox="0 0 24 24" fill="none" stroke="currentcolor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 11a9 9 0 019 9"/><path d="M4 4a16 16 0 0116 16"/><circle cx="5" cy="19" r="1"/></svg>
|
||
<span>RSS</span>
|
||
</a><span aria-hidden=true>·</span>
|
||
<span>Visitors this week: <span id=gc_site_visitors_week>—</span></span></div><script>let menu=document.getElementById("menu");menu&&(menu.scrollLeft=localStorage.getItem("menu-scroll-position"),menu.onscroll=function(){localStorage.setItem("menu-scroll-position",menu.scrollLeft)}),document.querySelectorAll('a[href^="#"]').forEach(e=>{e.addEventListener("click",function(e){e.preventDefault();var t=this.getAttribute("href").substr(1);window.matchMedia("(prefers-reduced-motion: reduce)").matches?document.querySelector(`[id='${decodeURIComponent(t)}']`).scrollIntoView():document.querySelector(`[id='${decodeURIComponent(t)}']`).scrollIntoView({behavior:"smooth"}),t==="top"?history.replaceState(null,null," "):history.pushState(null,null,`#${t}`)})})</script><script>var mybutton=document.getElementById("top-link");window.onscroll=function(){document.body.scrollTop>800||document.documentElement.scrollTop>800?(mybutton.style.visibility="visible",mybutton.style.opacity="1"):(mybutton.style.visibility="hidden",mybutton.style.opacity="0")}</script><script>document.getElementById("theme-toggle").addEventListener("click",()=>{document.body.className.includes("dark")?(document.body.classList.remove("dark"),localStorage.setItem("pref-theme","light")):(document.body.classList.add("dark"),localStorage.setItem("pref-theme","dark"))})</script><script>document.querySelectorAll("pre > code").forEach(e=>{const n=e.parentNode.parentNode,t=document.createElement("button");t.classList.add("copy-code"),t.innerHTML="copy";function s(){t.innerHTML="copied!",setTimeout(()=>{t.innerHTML="copy"},2e3)}t.addEventListener("click",t=>{if("clipboard"in navigator){navigator.clipboard.writeText(e.textContent),s();return}const n=document.createRange();n.selectNodeContents(e);const o=window.getSelection();o.removeAllRanges(),o.addRange(n);try{document.execCommand("copy"),s()}catch{}o.removeRange(n)}),n.classList.contains("highlight")?n.appendChild(t):n.parentNode.firstChild==n||(e.parentNode.parentNode.parentNode.parentNode.parentNode.nodeName=="TABLE"?e.parentNode.parentNode.parentNode.parentNode.parentNode.appendChild(t):e.parentNode.appendChild(t))})</script></body></html> |