Packet sniffing a ViP 722

[sigmtr]

Oh boy, what insomnia will lead you to do... Last night I dragged out my old dual-speed hub and spliced it between my switch and the 722's Ethernet port. The laptop went on another of the hub's ports and Wireshark was fired up. I made a filter to only log things to/from the 722's MAC (hardware) address.

As with all devices on a LAN segment, there is a bit of overhead traffic. Address Resolution Protocol (ARP) requests occur when the router asks who has a certain IP address and the device responds with its MAC address. This is similar to a DNS lookup at a hardware level; it is needed to route packets to the proper device.

DNS requests are also regularly made by the 722, and just for two names:

refractor02.managed.contegix.com
DISH Network -- Home

The first request gets a "No Such Name" response.
The second resolves to 205.172.147.51

Then the receiver then goes through a series of TCP SYN/ACK/FIN exchanges with the Dish Network web server, ending in a http TCP packet that is only one frame and contains no meaningful (to me) data.

I also saw a few attempts by the receiver to SYN with an IP address that didn't result from a DNS lookup. It was 63.246.23.135, and that resolves to 63-246-23-135.contegix.com.

Interesting. And before anyone objects, it's my LAN in my house, and I can look at what's going over it if I want!

sigmtr

 

[navychop]

Thank you.

Wish I'd thought to do that.

 

[Cyclone]

Bah! I did that two months ago!

http://www.satelliteguys.us/dish-ne.../103982-homeplug-built-into-622-how-cool.html

On the HomePlug power cord to boot!

 

[RandallA]

I was gonna say, someone already did that and came up with the two same sites.

 

[Pepper]

pls post the content of that http TCP packet you found so we can try to interpret what it is doing.

yes, i could do the same thing at home but i feel lazy today.