Stumped by communications w/ smart plug

[JaimeZX]

Hey guys, hoping you can help me figure this one out.

The only packets I can find going to/from my smart plugs (in both Wireshark and tcpdump from an SSH session in my router) are UDP from the plugs (from plug IP to 255.255.255.0) and an occasional ARP ("Who has other internal IP") which happens to be that of my cell phone. Meanwhile, from my cell I am commanding the plugs on and off and I see no evidence of this either from monitoring my cell IP-or-MAC in Wireshark or from monitoring the plug IPs-or-MACs... So I am confused.

I also tried loading a few web pages and Facebook in the phone and Wireshark seems to have disregarded all of those packets as well, except for a couple of MDNS queries. So I am confus.

Ideas?

 

[dave14305]

Keep in mind that LAN-to-LAN traffic won’t be seen by the router.

 

[JaimeZX]

Yeah, I've seen that somewhere, so the lack of traffic on tcpdump shouldn't be surprising, but I don't know why Wireshark isn't seeing it? :dunno:

 

[ColinTaylor]

This is normal. Wireshark can only see traffic that is sent to its network interface. A switch (like the LAN ports of your router) only forwards traffic through the port that the target device is connected to (as determined by the MAC address table). The exception being when the switch doesn't already have an entry for the target in its MAC address table, or it is broadcast traffic (i.e. ARP). In those cases the switch sends the traffic to all ports as part of the discovery process.

In short, you need to be running Wireshark on the source or target device to see the traffic.

 

[JaimeZX]

Isn't that the point of Promiscuous Mode in Wireshark? I'm away from my home network right now so I can't mess with it, but I (was) pretty sure it was supposed to be seeing "all the things."

Suggestions? Trying to see what the "turn off" packet looks like so I can set up Tasker to turn off lights with certain cues.

 

[ColinTaylor]

Isn't that the point of Promiscuous Mode in Wireshark?

Sort of. Yes, promiscuous mode will allow your PC's NIC to pass all traffic it receives to Wireshark. But the point is that the router isn't sending the traffic you're interested in to the NIC in the first place.

 

[coxhaus]

Cisco switches have a way to do that, it is called port mirror.

 

[ColinTaylor]

Cisco switches have a way to do that, it is called port mirror.

I believe Cisco usually refers to it as SPAN or RSPAN.

 

[coxhaus]

It's the same same.