# IoT PreTester 4.6 — Network Capture Security Analysis

- **Capture:** `/app/files/uploads/old_init-2d7aed437f3d.pcapng`
- **Packets:** 12383  ·  **Duration:** 331.027 s  ·  **Findings:** 7
- **Device under test:** `34.155.200.196` (MAC 52:54:00:71:bb:02)  ·  device-related findings: 3, other hosts: 4

## Summary

| Severity | Count |
| ----------- | ------ |
| CRITICAL | 0 |
| HIGH | 0 |
| MEDIUM | 1 |
| LOW | 4 |
| INFO | 2 |

## Findings

### 1. Clear-text protocol: HTTP on 142.250.154.94:80

- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
    - Packet #5211 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #5215 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #5219 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #5222 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
- **Affected:** Source 10.12.0.103, Destination 142.250.154.94, http:80
- **Additional evidence:** Packets: 5211, 5215, 5219, 5222 | Streams: 134 | Time: 2026-07-08 08:44:30 UTC – 2026-07-08 08:44:30 UTC | port=80, packets=10, payload_bytes=373, clients=['10.12.0.103'], client_count=1, external_server=True
- **Recommendation:** Require HTTPS for all device and cloud communication.
- **Finding ID:** `d31487f489fcc8f4`

### 2. Many small outbound connections to one target

- **Severity:** LOW · **Confidence:** low · **Category:** exfiltration · **Detector:** ExfiltrationDetector
- **📍 Sources:**
    - Packet #22 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #56 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #92 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #127 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #163 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #200 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #236 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #288 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    - … and 270 more packets
- **Risk:** Many short outbound connections to one target may indicate segmented uploads or polling.
- **Affected:** Device 34.155.200.196, Source 10.12.0.103, Destination 34.155.200.196  ·  **involves device under test**
- **Additional evidence:** Packets: 22, 56, 92, 127, 163, 200, 236, 288 | Streams: 3, 4, 5, 6, 7, 8, 9, 13 | Time: — – — | transfer_count=278, target_names=['api.production.loqed.com', 'mqtt.production.loqed.com'], device_related=True
- **Recommendation:** Investigate the connection pattern and destination.
- **Finding ID:** `fba18730143d6ee7`

### 3. Client offers broken cipher suites

- **Severity:** LOW · **Confidence:** high · **Category:** tls_weakness · **Detector:** TlsWeaknessDetector
- **📍 Sources:**
    - Packet #4086 · 2026-07-08 08:43:36 UTC · 10.12.0.102 → 17.167.200.74 · tls:443 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** The client advertises cipher suites with known weaknesses. A downgrade or a misconfigured server could select one of them.
- **Affected:** Source 10.12.0.102, Destination 17.167.200.74, tls:443, gsp85-ssl.ls.apple.com
- **Additional evidence:** Packets: 4086 | Time: 2026-07-08 08:43:36 UTC – 2026-07-08 08:43:36 UTC | weak_ciphers=['TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))'], offered_total=20, target=gsp85-ssl.ls.apple.com, device_related=False
- **Recommendation:** Remove obsolete cipher suites from the client's TLS configuration.
- **Finding ID:** `9edddf1d281cdabd`

### 4. DNS sent directly to an external resolver (8.8.8.8)

- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **📍 Sources:**
    - Packet #1020 · 2026-07-08 08:41:06 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53
- **Additional evidence:** Packets: 1020 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | queries=12, device_related=False
- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
- **Finding ID:** `b90cea9473b87e9a`

### 5. Randomly-structured DNS name observed

- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **🔎 Observed artifact:** `Domain: intercom.com`
- **📍 Sources:**
    - Packet #1020 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #1021 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #6965 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
    - Packet #6966 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** A DNS name with a random-looking label was queried under intercom.com. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, intercom.com
- **Additional evidence:** Packets: 1020, 1021, 6965, 6966 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | registered_domain=intercom.com, distinct_random_subdomains=1, examples=['n1cez2fg-android.mobile-messenger'], device_related=False
- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
- **Finding ID:** `26d5761b2c0d5e1c`

### 6. Device offers a network service on port 443

- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
    - ? → 34.155.200.196 · tls:443 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:443  ·  **involves device under test**
- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
- **Finding ID:** `9080003b793ca322`

### 7. Device offers a network service on port 8883

- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
    - ? → 34.155.200.196 · tls:8883 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:8883  ·  **involves device under test**
- **Additional evidence:** Time: — – — | port=8883, protocols=['tls'], device_related=True
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
- **Finding ID:** `e033c2ed522bde4e`


## Observation Inventory

- Capture: 12383 packets, 331.027 s, 10 internal and 37 external hosts, 410 flows, VLANs 1, 200 · extractor tshark 4.4.19

### Device under test
- `34.155.200.196` · MAC 52:54:00:71:bb:02 · names —
- 9968 packets · sent 1.4 MB · received 736.6 kB · first seen 2026-07-08 08:40:37 UTC · last seen 2026-07-08 08:46:01 UTC
- Services offered: 443, 8883 · ports contacted: —
- Protocols: tls · TLS sessions: 0 · clear-text flows: 0
- Peers (2):
    - `10.12.0.103` · internal · ports 33854, 33856, 33870, 33876, 33880, 33896, 33912, 33922, 33926, 33940, 33956, 33960, 33970, 33982, 33996, 34002, 34016, 34020, 34032, 34038 · tls · to peer 1.4 MB / from peer 732.2 kB
    - `10.12.0.104` (loqed-8c4b146a1acc._http._tcp.local) · internal · ports 50167 · tls · to peer 6.7 kB / from peer 4.5 kB

### Internal hosts (10)
- `10.12.0.103` · MAC 6e:bd:64:d7:9a:69 · 11149 packets · offers 33054, 53758, 53770, 53772, 53778, 53794, 53808, 55340 · 19 external endpoints
- `10.12.0.102` (iphone) · MAC d6:cd:eb:e5:d1:75 · 697 packets · offers — · 14 external endpoints
- `10.12.0.104` (loqed-8c4b146a1acc) · MAC 8c:4b:14:6a:1a:cc · 275 packets · offers — · 3 external endpoints
- `10.12.0.250` · MAC 52:54:00:71:bb:02 · 106 packets · offers 53 · 0 external endpoints
- `fe80::10f6:c22e:fe1c:d27a` (iphone) · MAC d6:cd:eb:e5:d1:75 · 63 packets · offers — · 0 external endpoints
- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 42 packets · offers — · 1 external endpoints
- `fe80::6cbd:64ff:fed7:9a69` · MAC 6e:bd:64:d7:9a:69 · 39 packets · offers — · 0 external endpoints
- `fe80::ca7f:54ff:fede:c038` · MAC c8:7f:54:de:c0:38 · 4 packets · offers — · 0 external endpoints
- `192.168.42.75` · MAC — · 4 packets · offers — · 0 external endpoints
- `10.12.0.101` · MAC — · 2 packets · offers — · 1 external endpoints

### External endpoints (37)
- `34.155.200.196` (api.production.loqed.com, mqtt.production.loqed.com) · ports 443, 8883 · tls · encrypted · out 736.6 kB / in 1.4 MB
- `17.253.57.197` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 8.6 kB / in 251.1 kB
- `216.239.36.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 54.2 kB / in 179.6 kB
- `142.251.127.101` (encrypted-tbn0.gstatic.com) · ports 443 · tls · encrypted · out 16.0 kB / in 207.8 kB
- `142.251.152.119` (www.google.com) · ports 443 · tls · encrypted · out 5.4 kB / in 95.1 kB
- `142.251.110.95` (www.googleapis.com) · ports 443 · quic, tls · encrypted · out 10.8 kB / in 88.9 kB
- `142.251.13.113` (encrypted-tbn1.gstatic.com) · ports 443 · tls · encrypted · out 7.1 kB / in 33.2 kB
- `142.250.154.139` (encrypted-tbn3.gstatic.com) · ports 443 · tls · encrypted · out 6.4 kB / in 16.7 kB
- `17.57.146.56` (25-courier.push.apple.com, courier.push.apple.com) · ports 5223 · tls · encrypted · out 16.8 kB / in 6.1 kB
- `199.232.191.6` (bag.itunes.apple.com) · ports 443 · quic, tls · encrypted · out 6.0 kB / in 16.5 kB
- `216.239.38.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 11.7 kB / in 10.1 kB
- `40.104.206.18` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 7.1 kB / in 14.1 kB
- `98.90.70.94` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 4.8 kB / in 15.6 kB
- `17.248.209.81` (gateway.icloud.com) · ports 443, 61000 · icmp, quic, tls · encrypted · out 11.4 kB / in 8.6 kB
- `216.239.34.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · tls · encrypted · out 5.6 kB / in 10.6 kB
- `172.224.55.5` (mask.icloud.com) · ports 443 · quic, tls · encrypted · out 8.3 kB / in 7.8 kB
- `54.144.197.43` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 3.7 kB / in 9.2 kB
- `17.188.143.125` (init.push.apple.com) · ports 443 · tls · encrypted · out 2.5 kB / in 8.1 kB
- `17.253.57.195` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 2.4 kB / in 7.5 kB
- `17.253.15.139` (configuration.ls.apple.com) · ports 443 · tls · encrypted · out 2.8 kB / in 6.7 kB
- `17.167.200.74` (gsp85-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.0 kB / in 5.8 kB
- `18.97.36.75` (nexus-websocket-a.intercom.io) · ports 443 · tls · encrypted · out 2.2 kB / in 6.5 kB
- `2.16.16.110` (gspe1-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.8 kB / in 4.9 kB
- `63.181.149.124` (hooks.nabu.casa) · ports 443 · tls · encrypted · out 1.9 kB / in 5.6 kB
- `142.250.154.94` (connectivitycheck.gstatic.com) · ports 80, 443 · http, tls · encrypted · out 2.1 kB / in 4.6 kB
- `142.251.20.113` · ports 443 · tls · encrypted · out 3.4 kB / in 2.4 kB
- `40.101.70.194` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
- `52.97.105.162` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
- `40.101.69.226` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
- `8.8.8.8` · ports 53, 59560 · dns, icmp · clear-text or unknown · out 1.2 kB / in 1.9 kB
- `142.251.157.119` (www.google.com) · ports 443 · tls · encrypted · out 1.5 kB / in 1.6 kB
- `18.97.36.19` · ports 443 · tls · encrypted · out 350 B / in 446 B
- `142.251.127.188` · ports 5228 · tls · encrypted · out 166 B / in 164 B
- `31.13.84.49` · ports 5222 · undecoded · clear-text or unknown · out 0 B / in 236 B
- `3.91.171.254` · ports 443 · tls · encrypted · out 164 B / in 58 B
- `91.206.8.34` (pool.ntp.org) · ports 123 · ntp · clear-text or unknown · out 94 B / in 94 B
- `142.251.156.119` (www.google.com) · ports 443 · undecoded · clear-text or unknown · out 70 B / in 58 B

### Services observed (45)
- `34.155.200.196:443` https (tcp) ← device · encrypted · 277 flows from 1 clients
- `34.155.200.196:8883` mqtts (tcp) ← device · encrypted · 1 flows from 1 clients
- `10.12.0.102:443` https (udp) · unknown · 1 flows from 1 clients
- `10.12.0.200:53` dns (udp) · unknown · 6 flows from 2 clients
- `10.12.0.250:53` dns (udp) · unknown · 48 flows from 4 clients
- `142.250.154.139:443` https (tcp) · encrypted · 2 flows from 1 clients
- `142.250.154.94:80` http (tcp) · clear-text · 1 flows from 1 clients
- `142.250.154.94:443` https (tcp) · encrypted · 1 flows from 1 clients
- `142.251.110.95:443` quic (udp) · encrypted · 1 flows from 1 clients
- `142.251.127.101:443` https (tcp) · encrypted · 4 flows from 1 clients
- `142.251.127.188:5228` gcm (tcp) · encrypted · 1 flows from 1 clients
- `142.251.13.113:443` https (tcp) · encrypted · 2 flows from 1 clients
- `142.251.152.119:443` https (tcp) · encrypted · 1 flows from 1 clients
- `142.251.156.119:443` https (tcp) · unknown · 1 flows from 1 clients
- `142.251.157.119:443` https (tcp) · encrypted · 1 flows from 1 clients
- `142.251.20.113:443` https (tcp) · encrypted · 5 flows from 1 clients
- `17.167.200.74:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.188.143.125:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.248.209.81:443` quic (udp) · encrypted · 1 flows from 1 clients
- `17.253.15.139:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.253.57.195:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.253.57.197:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.57.146.56:5223` apns (tcp) · encrypted · 1 flows from 1 clients
- `172.224.55.5:443` quic (udp) · encrypted · 1 flows from 1 clients
- `172.224.55.5:443` https (tcp) · encrypted · 1 flows from 1 clients
- `18.97.36.19:443` https (tcp) · encrypted · 1 flows from 1 clients
- `18.97.36.75:443` https (tcp) · encrypted · 1 flows from 1 clients
- `199.232.191.6:443` quic (udp) · encrypted · 1 flows from 1 clients
- `2.16.16.110:443` https (tcp) · encrypted · 1 flows from 1 clients
- `216.239.34.223:443` https (tcp) · encrypted · 7 flows from 1 clients
- `216.239.36.223:443` quic (udp) · encrypted · 2 flows from 1 clients
- `216.239.38.223:443` https (tcp) · encrypted · 2 flows from 1 clients
- `216.239.38.223:443` quic (udp) · encrypted · 1 flows from 1 clients
- `3.91.171.254:443` https (tcp) · encrypted · 1 flows from 1 clients
- `31.13.84.49:5222` xmpp (tcp) · unknown · 1 flows from 1 clients
- `40.101.69.226:443` quic (udp) · encrypted · 1 flows from 1 clients
- `40.101.70.194:443` quic (udp) · encrypted · 1 flows from 1 clients
- `40.104.206.18:443` quic (udp) · encrypted · 1 flows from 1 clients
- `40.104.206.18:443` https (tcp) · encrypted · 1 flows from 1 clients
- `52.97.105.162:443` quic (udp) · encrypted · 1 flows from 1 clients
- `54.144.197.43:443` https (tcp) · encrypted · 1 flows from 1 clients
- `63.181.149.124:443` https (tcp) · encrypted · 1 flows from 1 clients
- `8.8.8.8:53` dns (udp) · unknown · 12 flows from 1 clients
- `91.206.8.34:123` ntp (udp) · unknown · 1 flows from 1 clients
- `98.90.70.94:443` https (tcp) · encrypted · 1 flows from 1 clients

### Protocols (packets)
- ip 12180, tcp 11373, tls 5469, udp 879, quic 541, mdns 189, dns 126, ipv6 115, arp 79, icmpv6 28, dhcp 20, igmp 15, icmp 7, ipv6.hopopts 6, http 2, ntp 2
- ICMP: router_advertisement 3, unreachable 7, router_solicitation 12, neighbor_solicitation 6, icmpv6_type_143 6, neighbor_advertisement 1

### TLS posture (320 handshakes)
- Versions: TLS 1.2 ×285, TLS 1.3 ×30
- Cipher suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×284, TLS_AES_128_GCM_SHA256 ×12, TLS_AES_256_GCM_SHA384 ×18, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×1
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC

### DNS (129 queries, 66 responses, 46 names)
- Response codes: NOERROR 60, NXDOMAIN 6 · resolvers: 8.8.8.8 (12), 10.12.0.250 (48), 10.12.0.200 (6)
- `_rdlink._tcp.local` · 21× · PTR · no answer seen
- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` · 18× · ANY · no answer seen
- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` · 18× · ANY · no answer seen
- `loqed-8c4b146a1acc._http._tcp.local` · 12× · ANY · no answer seen
- `n1cez2fg-android.mobile-messenger.intercom.com` · 4× · A · 100.60.6.237, 107.20.239.244, 52.70.57.139, 54.144.197.43, 54.210.239.62, 98.90.70.94
- `www.google.com` · 3× · A · 142.251.150.119, 142.251.151.119, 142.251.152.119, 142.251.153.119, 142.251.154.119, 142.251.155.119
- `25-courier.push.apple.com` · 2× · A, HTTPS · 17.57.146.54, 17.57.146.55, 17.57.146.56, 17.57.146.57, 17.57.146.58, 17.57.146.59
- `bag.itunes.apple.com` · 2× · A, HTTPS · 199.232.191.6
- `captive.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
- `cl2.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
- `configuration.ls.apple.com` · 2× · A, HTTPS · 17.253.15.139, 17.253.15.147
- `connectivitycheck.gstatic.com` · 2× · A · 142.250.154.94, 142.251.20.94
- `gsp85-ssl.ls.apple.com` · 2× · A, HTTPS · 17.167.200.74
- `gspe1-ssl.ls.apple.com` · 2× · A, HTTPS · 2.16.16.100, 2.16.16.110
- `init.push.apple.com` · 2× · A, HTTPS · 17.188.143.125, 17.188.143.126, 17.188.143.189, 17.188.178.226, 17.188.178.34, 17.188.179.2
- `m.hotmail.com` · 2× · A, HTTPS · 40.101.69.226, 40.101.70.194, 40.104.206.18, 52.97.105.162
- `mask.icloud.com` · 2× · A, HTTPS · 172.224.55.10, 172.224.55.11, 172.224.55.13, 172.224.55.4, 172.224.55.5, 172.224.55.7
- `nexus-websocket-a.intercom.io` · 2× · A · 18.97.36.13, 18.97.36.14, 18.97.36.18, 18.97.36.2, 18.97.36.47, 18.97.36.49
- `www.googleapis.com` · 2× · A · 142.250.154.95, 142.251.110.95, 142.251.127.95, 142.251.13.95, 142.251.14.95, 142.251.20.95
- `_dns.resolver.arpa` · 1× · SVCB · no answer seen
- `a1366.dscapi6.akamai.net` · 1× · HTTPS · no answer seen
- `api.production.loqed.com` · 1× · A · 34.155.200.196
- `captive.g.aaplimg.com` · 1× · HTTPS · no answer seen
- `cl2.g.aaplimg.com` · 1× · HTTPS · no answer seen
- `configuration.ls.v.aaplimg.com` · 1× · HTTPS · no answer seen
- `discover-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `encrypted-tbn0.gstatic.com` · 1× · A · 142.251.127.100, 142.251.127.101, 142.251.127.102, 142.251.127.113, 142.251.127.138, 142.251.127.139
- `encrypted-tbn1.gstatic.com` · 1× · A · 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139
- `encrypted-tbn3.gstatic.com` · 1× · A · 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139
- `eu-central-courier-4.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen
- `gsp85-ssl.ls2-apple.com.akadns.net` · 1× · HTTPS · no answer seen
- `hooks.nabu.casa` · 1× · A · 3.73.212.91, 63.181.149.124
- `init.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen
- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.jrz-iot.mci.edu` · 1× · PTR · no answer seen
- `mask.apple-dns.net` · 1× · HTTPS · no answer seen
- `mqtt.production.loqed.com` · 1× · A · 34.155.200.196
- `play.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `pool.ntp.org` · 1× · A · 152.53.100.131, 152.53.119.76, 46.102.157.67, 91.206.8.34
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `remoteprovisioning.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `spot-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `vie-efz.ms-acdc.office.com` · 1× · HTTPS · no answer seen

### HTTP (2 requests)
- `connectivitycheck.gstatic.com` · 1 requests · GET · /generate_204
- `10.12.0.103` · 1 requests ·  · /generate_204

### Clear-text protocols and service events
- http: 1 flows, 373 B · 10.12.0.103 -> 142.250.154.94:80
- xmpp: 1 flows, 96 B · 10.12.0.101 -> 31.13.84.49:5222
- https: 1 flows, 21 B · 17.248.209.81 -> 10.12.0.102:443
- icmpv6 router_advertisement:   (fe80::ca7f:54ff:fede:c038 → ff02::1)
- icmpv6 router_advertisement:   (fe80::ca7f:54ff:fede:c038 → ff02::1)
- icmpv6 router_advertisement:   (fe80::ca7f:54ff:fede:c038 → ff02::1)
- DHCP request: d6:cd:eb:e5:d1:75 iPhone  → 10.12.0.102 (server —)
- DHCP request: d6:cd:eb:e5:d1:75 iPhone  → 10.12.0.102 (server —)
- DHCP request: d6:cd:eb:e5:d1:75 iPhone  → 10.12.0.102 (server —)
- DHCP ack: d6:cd:eb:e5:d1:75 iphone  → 10.12.0.102 (server 10.12.0.250)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  →  (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  →  (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  →  (server —)
- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  →  (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  →  (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  →  (server —)
- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)
- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc  → 10.12.0.104 (server 10.12.0.250)

### Coverage
- Complete extraction · 410 flows, 330 encrypted, 1 with undecoded payload · 4 clear-text payloads scanned
- Undecoded ports (flows): 5222: 1
- Flows with application data that tshark did not decode (port: flows): 5222: 1
- 30 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.

## Cloud URLs and Endpoints (54)

- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `142.251.127.188` — Ports: 443, 5228; TLS: N/A; Cipher: N/A
- `142.251.20.113` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `18.97.36.19` — Ports: —; TLS: N/A; Cipher: N/A
- `25-courier.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A
- `3.91.171.254` — Ports: 443; TLS: N/A; Cipher: N/A
- `31.13.84.49` — Ports: 80, 443, 5222; TLS: N/A; Cipher: N/A
- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `_dns.resolver.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `_rdlink._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `a1366.dscapi6.akamai.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `api.production.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `bag.itunes.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `captive.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `captive.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `cl2.apple.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `cl2.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `configuration.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `configuration.ls.v.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `courier.push.apple.com` — Ports: 443, 5223; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `discover-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `encrypted-tbn0.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `encrypted-tbn1.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `encrypted-tbn3.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `eu-central-courier-4.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A
- `gateway.icloud.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `gsp85-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `gsp85-ssl.ls2-apple.com.akadns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `gspe1-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `hooks.nabu.casa` — Ports: 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES128-GCM-SHA256
- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `init.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A
- `init.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.jrz-iot.mci.edu` — Ports: —; TLS: N/A; Cipher: N/A
- `loqed-8c4b146a1acc._http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `m.hotmail.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `mask.apple-dns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `mask.icloud.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `mqtt.production.loqed.com` — Ports: 80, 443, 8080, 8883; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `n1cez2fg-android.mobile-messenger.intercom.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `nexus-websocket-a.intercom.io` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `pool.ntp.org` — Ports: 22; TLS: N/A; Cipher: N/A
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `spot-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `vie-efz.ms-acdc.office.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `www.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `www.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384

---
_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_