« first day (2062 days earlier)      last day (3251 days later) » 

23:01
0
Q: can my employer track my wife

r.austinthe question i have is more if a request for clarification from another question, "can my employer track my home network usage on another computer if i connect using vpn?". i work on a company owned desktop that uses a vpn to connect to work from my home, using my private internet connection. my ...

Bob
Bob
@Valamas-AUS Something weird to try, if you have a spare machine.
Windows laptop?
Bob
Bob
Set a different computer to that IP address (192.168.0.7) and spoof the camera's MAC address.
Try pinging that.
Also, have you tried putting the camera on a different IP as I suggested above?
@kerbalspacebecky did mention filtering on the switch being a possible cause
@bob, yes, to a successfuil IP (my laptop) and an unused ever IP.
Bob
Bob
:\
23:04
@bob ip 27. will do. turning off camera, applying IP to laptop which is connected to the switch and will ping from router web interface
Bob
Bob
Try the MAC spoofing if you can, just out of curiosity and a lack of other ideas :P
Put the camera on a separate VLAN, problem solved.
Actually yeah, listen to Bob, not me. Bob knows more words than me.
Bob
Bob
^ or do that
the VLAN thing. not the listen to me thing.
don't listen to me.
@bob test complete. laptop with IP 27 connected to switch pings successfully
Bob
Bob
@Valamas-AUS ...with the MAC spoof?
23:08
Dammit, Galaxy S7 active has just been unofficially confirmed. I knew I should have waited.
Bob
Bob
o.O
that was fast
i do have a spare router (is disconnected) but am clueless on how to set it up to be on a different vlan and associated static route entries.
MAC spoof, wiresharking now
Bob
Bob
@kerbalspacebecky Have you rooted yet/are you still going to?
@Valamas-AUS That looks even weirder. Why is the laptop replying with a Clevo MAC address?
@bob wait. ill change ports (port mirroring :S)
Bob
Bob
@Valamas-AUS Also, do you have tcpdump on the router (as KSB suggested)?
23:19
@bob
# tcpdump
tcpdump: not found
Bob
Bob
:\
@Valamas-AUS Run sh. Then run tcpdump from there.
@bob here is the new wireshark (port changed to one not configured for mirror)
https://drive.google.com/file/d/0B8bf6WxGc9PoZVIxWVNNSjEyTHM/view?usp=sharing
so i got distracted and i have forgotten to go to bed
@bob sorry, I dont understand "Run sh. Then run tcpdump from there." I am looking it up on google
i got a message saying my graphics drivers are out of date. and the radeon software has given me 2 optional downloads, the standard update and the beta update. the build number of the beta build is lower than that of the standard one!
ah well... i'll just go for the standard drivers...
i mean, what could possibly go wrong with AMD drivers.... right? ;)
Bob
Bob
23:31
@Valamas-AUS Run the command sh. That should open up ash or some other shell. Then run tcpdump inside the shell that was opened.
Dunno how dlink does it but my experience with billion says the default interface is a very cheap shell that doesn't run all commands actually present on the system
@Valamas-AUS I wonder if the weirdness I'm seeing is because you're tracing on the same machine you're trying to spoof from.
A shell did not open. I see sh in the bin folder. Here are my commands (shortened)
BusyBox v1.14.1 (2014-05-28 10:32:16 CST) built-in shell (msh)
# cd bin
#
# sh

BusyBox v1.14.1 (2014-05-28 10:32:16 CST) built-in shell (msh)

#
# tcpdump
tcpdump: not found
Bob
Bob
Ah, you're already in a proper shell.
@Bob if i'm lucky
Bob
Bob
@Valamas-AUS Any chance you can spoof on a machine different from the one you're tracing on?
Though... gimme a sec
Hmmmmmmmm
The IP camera adds padding to the ethernet frame
So it's 60 bytes instead of 42
That shouldn't make a difference :\
Otherwise identical apart from the MAC address, afaict
> Those padding bytes will not show up on packets sent by the machine running Wireshark; the padding is added by the Ethernet hardware, and packets being sent by the machine capturing the traffic are given to the program before being handed to the hardware, so they haven't been padded.
Ah.
So it's probably identical.
@Valamas-AUS I take it that pinging the machine pretending to be the camera works?
Bob
Bob
23:40
@Valamas-AUS I don't see any in that last packet capture?
There's a single ICMP req/rep but that was from .0.6, not .0.1
thats my PC connected to the router. where i did the "netsh interface ip delete arpcache" and then a ping
Bob
Bob
@Valamas-AUS Have you tried pinging the computer that's pretending to be the camera, from the router?
Try that.
yes, successful
Bob
Bob
...
So, it sends identical ARP replies as the camera. But it works where the camera does not.
Well, I'm assuming they're identical... can't actually see that unless you do the port mirroring and capture using a different machine.
doing that now
that would mean my PC is then connected to the switch..... I do not have anymore computers to do the record
Bob
Bob
23:48
The router has a very weird pattern
in your second packet cap... two broadcasts followed by one unicast to the camera
camera responds twice, presumably to the broadcasts
the unicast has nonzero padding
Hm. Might be because the camera takes an order of magnitude longer to respond.
No... it sends two broadcasts at once.
Perhaps an artefact of the port mirroring?
Camera responds when connected directly to the router
Bob
Bob
Hm. Yea, sounds like it.
So, pattern not so weird.
would ssh access help?
I have just been restarted! This happens daily automatically, or when my owner restarts me. Ready for commands.

« first day (2062 days earlier)      last day (3251 days later) »