a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
20dfd8ba2bd2824bef033f820df720bf60e00e81
Shelly-Loqed-Touch/network/pretester_reports/old_init_report.md
T

35 KiB
Raw Blame History

IoT PreTester 4.6 — Network Capture Security Analysis

  • Capture: /app/files/uploads/old_init-2d7aed437f3d.pcapng
  • Packets: 12383 · Duration: 331.027 s · Findings: 7
  • Device under test: 34.155.200.196 (MAC 52:54:00:71:bb:02) · device-related findings: 3, other hosts: 4

Summary

Severity Count
CRITICAL 0
HIGH 0
MEDIUM 1
LOW 4
INFO 2

Findings

1. Clear-text protocol: HTTP on 142.250.154.94:80

  • Severity: MEDIUM · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • Packet #5211 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #5215 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #5219 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #5222 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
  • Risk: HTTP content is unencrypted and can be read or modified on the path.
  • Affected: Source 10.12.0.103, Destination 142.250.154.94, http:80
  • Additional evidence: Packets: 5211, 5215, 5219, 5222 | Streams: 134 | Time: 2026-07-08 08:44:30 UTC – 2026-07-08 08:44:30 UTC | port=80, packets=10, payload_bytes=373, clients=['10.12.0.103'], client_count=1, external_server=True
  • Recommendation: Require HTTPS for all device and cloud communication.
  • Finding ID: d31487f489fcc8f4

2. Many small outbound connections to one target

  • Severity: LOW · Confidence: low · Category: exfiltration · Detector: ExfiltrationDetector
  • 📍 Sources:
    • Packet #22 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #56 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #92 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #127 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #163 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #200 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #236 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #288 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
    • … and 270 more packets
  • Risk: Many short outbound connections to one target may indicate segmented uploads or polling.
  • Affected: Device 34.155.200.196, Source 10.12.0.103, Destination 34.155.200.196 · involves device under test
  • Additional evidence: Packets: 22, 56, 92, 127, 163, 200, 236, 288 | Streams: 3, 4, 5, 6, 7, 8, 9, 13 | Time: — – — | transfer_count=278, target_names=['api.production.loqed.com', 'mqtt.production.loqed.com'], device_related=True
  • Recommendation: Investigate the connection pattern and destination.
  • Finding ID: fba18730143d6ee7

3. Client offers broken cipher suites

  • Severity: LOW · Confidence: high · Category: tls_weakness · Detector: TlsWeaknessDetector
  • 📍 Sources:
    • Packet #4086 · 2026-07-08 08:43:36 UTC · 10.12.0.102 → 17.167.200.74 · tls:443 · Capture old_init-2d7aed437f3d.pcapng
  • Risk: The client advertises cipher suites with known weaknesses. A downgrade or a misconfigured server could select one of them.
  • Affected: Source 10.12.0.102, Destination 17.167.200.74, tls:443, gsp85-ssl.ls.apple.com
  • Additional evidence: Packets: 4086 | Time: 2026-07-08 08:43:36 UTC – 2026-07-08 08:43:36 UTC | weak_ciphers=['TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))'], offered_total=20, target=gsp85-ssl.ls.apple.com, device_related=False
  • Recommendation: Remove obsolete cipher suites from the client's TLS configuration.
  • Finding ID: 9edddf1d281cdabd

4. DNS sent directly to an external resolver (8.8.8.8)

  • Severity: LOW · Confidence: high · Category: dns_anomaly · Detector: DnsAnomalyDetector
  • 📍 Sources:
    • Packet #1020 · 2026-07-08 08:41:06 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
  • Risk: The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
  • Affected: Source 10.12.0.200, Destination 8.8.8.8, dns:53
  • Additional evidence: Packets: 1020 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | queries=12, device_related=False
  • Recommendation: Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
  • Finding ID: b90cea9473b87e9a

5. Randomly-structured DNS name observed

  • Severity: LOW · Confidence: low · Category: dns_anomaly · Detector: DnsAnomalyDetector
  • 🔎 Observed artifact: Domain: intercom.com
  • 📍 Sources:
    • Packet #1020 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #1021 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #6965 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
    • Packet #6966 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
  • Risk: A DNS name with a random-looking label was queried under intercom.com. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
  • Affected: Source 10.12.0.200, Destination 8.8.8.8, dns:53, intercom.com
  • Additional evidence: Packets: 1020, 1021, 6965, 6966 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | registered_domain=intercom.com, distinct_random_subdomains=1, examples=['n1cez2fg-android.mobile-messenger'], device_related=False
  • Recommendation: Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
  • Finding ID: 26d5761b2c0d5e1c

6. Device offers a network service on port 443

  • Severity: INFO · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • ? → 34.155.200.196 · tls:443 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
  • Risk: The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
  • Affected: Device 34.155.200.196, Destination 34.155.200.196, tls:443 · involves device under test
  • Additional evidence: Time: — – — | port=443, protocols=['tls'], device_related=True
  • Recommendation: Confirm the service is required, authenticated and encrypted; disable it otherwise.
  • Finding ID: 9080003b793ca322

7. Device offers a network service on port 8883

  • Severity: INFO · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • ? → 34.155.200.196 · tls:8883 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
  • Risk: The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
  • Affected: Device 34.155.200.196, Destination 34.155.200.196, tls:8883 · involves device under test
  • Additional evidence: Time: — – — | port=8883, protocols=['tls'], device_related=True
  • Recommendation: Confirm the service is required, authenticated and encrypted; disable it otherwise.
  • Finding ID: e033c2ed522bde4e

Observation Inventory

  • Capture: 12383 packets, 331.027 s, 10 internal and 37 external hosts, 410 flows, VLANs 1, 200 · extractor tshark 4.4.19

Device under test

  • 34.155.200.196 · MAC 52:54:00:71:bb:02 · names —
  • 9968 packets · sent 1.4 MB · received 736.6 kB · first seen 2026-07-08 08:40:37 UTC · last seen 2026-07-08 08:46:01 UTC
  • Services offered: 443, 8883 · ports contacted: —
  • Protocols: tls · TLS sessions: 0 · clear-text flows: 0
  • Peers (2):
    • 10.12.0.103 · internal · ports 33854, 33856, 33870, 33876, 33880, 33896, 33912, 33922, 33926, 33940, 33956, 33960, 33970, 33982, 33996, 34002, 34016, 34020, 34032, 34038 · tls · to peer 1.4 MB / from peer 732.2 kB
    • 10.12.0.104 (loqed-8c4b146a1acc._http._tcp.local) · internal · ports 50167 · tls · to peer 6.7 kB / from peer 4.5 kB

Internal hosts (10)

  • 10.12.0.103 · MAC 6e:bd:64:d7:9a:69 · 11149 packets · offers 33054, 53758, 53770, 53772, 53778, 53794, 53808, 55340 · 19 external endpoints
  • 10.12.0.102 (iphone) · MAC d6:cd:eb:e5:d1:75 · 697 packets · offers — · 14 external endpoints
  • 10.12.0.104 (loqed-8c4b146a1acc) · MAC 8c:4b:14:6a:1a:cc · 275 packets · offers — · 3 external endpoints
  • 10.12.0.250 · MAC 52:54:00:71:bb:02 · 106 packets · offers 53 · 0 external endpoints
  • fe80::10f6:c22e:fe1c:d27a (iphone) · MAC d6:cd:eb:e5:d1:75 · 63 packets · offers — · 0 external endpoints
  • 10.12.0.200 · MAC c8:7f:54:de:c0:38 · 42 packets · offers — · 1 external endpoints
  • fe80::6cbd:64ff:fed7:9a69 · MAC 6e:bd:64:d7:9a:69 · 39 packets · offers — · 0 external endpoints
  • fe80::ca7f:54ff:fede:c038 · MAC c8:7f:54:de:c0:38 · 4 packets · offers — · 0 external endpoints
  • 192.168.42.75 · MAC — · 4 packets · offers — · 0 external endpoints
  • 10.12.0.101 · MAC — · 2 packets · offers — · 1 external endpoints

External endpoints (37)

  • 34.155.200.196 (api.production.loqed.com, mqtt.production.loqed.com) · ports 443, 8883 · tls · encrypted · out 736.6 kB / in 1.4 MB
  • 17.253.57.197 (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 8.6 kB / in 251.1 kB
  • 216.239.36.223 (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 54.2 kB / in 179.6 kB
  • 142.251.127.101 (encrypted-tbn0.gstatic.com) · ports 443 · tls · encrypted · out 16.0 kB / in 207.8 kB
  • 142.251.152.119 (www.google.com) · ports 443 · tls · encrypted · out 5.4 kB / in 95.1 kB
  • 142.251.110.95 (www.googleapis.com) · ports 443 · quic, tls · encrypted · out 10.8 kB / in 88.9 kB
  • 142.251.13.113 (encrypted-tbn1.gstatic.com) · ports 443 · tls · encrypted · out 7.1 kB / in 33.2 kB
  • 142.250.154.139 (encrypted-tbn3.gstatic.com) · ports 443 · tls · encrypted · out 6.4 kB / in 16.7 kB
  • 17.57.146.56 (25-courier.push.apple.com, courier.push.apple.com) · ports 5223 · tls · encrypted · out 16.8 kB / in 6.1 kB
  • 199.232.191.6 (bag.itunes.apple.com) · ports 443 · quic, tls · encrypted · out 6.0 kB / in 16.5 kB
  • 216.239.38.223 (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 11.7 kB / in 10.1 kB
  • 40.104.206.18 (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 7.1 kB / in 14.1 kB
  • 98.90.70.94 (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 4.8 kB / in 15.6 kB
  • 17.248.209.81 (gateway.icloud.com) · ports 443, 61000 · icmp, quic, tls · encrypted · out 11.4 kB / in 8.6 kB
  • 216.239.34.223 (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · tls · encrypted · out 5.6 kB / in 10.6 kB
  • 172.224.55.5 (mask.icloud.com) · ports 443 · quic, tls · encrypted · out 8.3 kB / in 7.8 kB
  • 54.144.197.43 (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 3.7 kB / in 9.2 kB
  • 17.188.143.125 (init.push.apple.com) · ports 443 · tls · encrypted · out 2.5 kB / in 8.1 kB
  • 17.253.57.195 (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 2.4 kB / in 7.5 kB
  • 17.253.15.139 (configuration.ls.apple.com) · ports 443 · tls · encrypted · out 2.8 kB / in 6.7 kB
  • 17.167.200.74 (gsp85-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.0 kB / in 5.8 kB
  • 18.97.36.75 (nexus-websocket-a.intercom.io) · ports 443 · tls · encrypted · out 2.2 kB / in 6.5 kB
  • 2.16.16.110 (gspe1-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.8 kB / in 4.9 kB
  • 63.181.149.124 (hooks.nabu.casa) · ports 443 · tls · encrypted · out 1.9 kB / in 5.6 kB
  • 142.250.154.94 (connectivitycheck.gstatic.com) · ports 80, 443 · http, tls · encrypted · out 2.1 kB / in 4.6 kB
  • 142.251.20.113 · ports 443 · tls · encrypted · out 3.4 kB / in 2.4 kB
  • 40.101.70.194 (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
  • 52.97.105.162 (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
  • 40.101.69.226 (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
  • 8.8.8.8 · ports 53, 59560 · dns, icmp · clear-text or unknown · out 1.2 kB / in 1.9 kB
  • 142.251.157.119 (www.google.com) · ports 443 · tls · encrypted · out 1.5 kB / in 1.6 kB
  • 18.97.36.19 · ports 443 · tls · encrypted · out 350 B / in 446 B
  • 142.251.127.188 · ports 5228 · tls · encrypted · out 166 B / in 164 B
  • 31.13.84.49 · ports 5222 · undecoded · clear-text or unknown · out 0 B / in 236 B
  • 3.91.171.254 · ports 443 · tls · encrypted · out 164 B / in 58 B
  • 91.206.8.34 (pool.ntp.org) · ports 123 · ntp · clear-text or unknown · out 94 B / in 94 B
  • 142.251.156.119 (www.google.com) · ports 443 · undecoded · clear-text or unknown · out 70 B / in 58 B

Services observed (45)

  • 34.155.200.196:443 https (tcp) ← device · encrypted · 277 flows from 1 clients
  • 34.155.200.196:8883 mqtts (tcp) ← device · encrypted · 1 flows from 1 clients
  • 10.12.0.102:443 https (udp) · unknown · 1 flows from 1 clients
  • 10.12.0.200:53 dns (udp) · unknown · 6 flows from 2 clients
  • 10.12.0.250:53 dns (udp) · unknown · 48 flows from 4 clients
  • 142.250.154.139:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 142.250.154.94:80 http (tcp) · clear-text · 1 flows from 1 clients
  • 142.250.154.94:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 142.251.110.95:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 142.251.127.101:443 https (tcp) · encrypted · 4 flows from 1 clients
  • 142.251.127.188:5228 gcm (tcp) · encrypted · 1 flows from 1 clients
  • 142.251.13.113:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 142.251.152.119:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 142.251.156.119:443 https (tcp) · unknown · 1 flows from 1 clients
  • 142.251.157.119:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 142.251.20.113:443 https (tcp) · encrypted · 5 flows from 1 clients
  • 17.167.200.74:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 17.188.143.125:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 17.248.209.81:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 17.253.15.139:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 17.253.57.195:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 17.253.57.197:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 17.57.146.56:5223 apns (tcp) · encrypted · 1 flows from 1 clients
  • 172.224.55.5:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 172.224.55.5:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 18.97.36.19:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 18.97.36.75:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 199.232.191.6:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 2.16.16.110:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 216.239.34.223:443 https (tcp) · encrypted · 7 flows from 1 clients
  • 216.239.36.223:443 quic (udp) · encrypted · 2 flows from 1 clients
  • 216.239.38.223:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 216.239.38.223:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 3.91.171.254:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 31.13.84.49:5222 xmpp (tcp) · unknown · 1 flows from 1 clients
  • 40.101.69.226:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 40.101.70.194:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 40.104.206.18:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 40.104.206.18:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 52.97.105.162:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 54.144.197.43:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 63.181.149.124:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 8.8.8.8:53 dns (udp) · unknown · 12 flows from 1 clients
  • 91.206.8.34:123 ntp (udp) · unknown · 1 flows from 1 clients
  • 98.90.70.94:443 https (tcp) · encrypted · 1 flows from 1 clients

Protocols (packets)

  • ip 12180, tcp 11373, tls 5469, udp 879, quic 541, mdns 189, dns 126, ipv6 115, arp 79, icmpv6 28, dhcp 20, igmp 15, icmp 7, ipv6.hopopts 6, http 2, ntp 2
  • ICMP: router_advertisement 3, unreachable 7, router_solicitation 12, neighbor_solicitation 6, icmpv6_type_143 6, neighbor_advertisement 1

TLS posture (320 handshakes)

  • Versions: TLS 1.2 ×285, TLS 1.3 ×30
  • Cipher suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×284, TLS_AES_128_GCM_SHA256 ×12, TLS_AES_256_GCM_SHA384 ×18, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×1
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.0.103 → 34.155.200.196:443 (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC

DNS (129 queries, 66 responses, 46 names)

  • Response codes: NOERROR 60, NXDOMAIN 6 · resolvers: 8.8.8.8 (12), 10.12.0.250 (48), 10.12.0.200 (6)
  • _rdlink._tcp.local · 21× · PTR · no answer seen
  • 1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local · 18× · ANY · no answer seen
  • i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local · 18× · ANY · no answer seen
  • loqed-8c4b146a1acc._http._tcp.local · 12× · ANY · no answer seen
  • n1cez2fg-android.mobile-messenger.intercom.com · 4× · A · 100.60.6.237, 107.20.239.244, 52.70.57.139, 54.144.197.43, 54.210.239.62, 98.90.70.94
  • www.google.com · 3× · A · 142.251.150.119, 142.251.151.119, 142.251.152.119, 142.251.153.119, 142.251.154.119, 142.251.155.119
  • 25-courier.push.apple.com · 2× · A, HTTPS · 17.57.146.54, 17.57.146.55, 17.57.146.56, 17.57.146.57, 17.57.146.58, 17.57.146.59
  • bag.itunes.apple.com · 2× · A, HTTPS · 199.232.191.6
  • captive.apple.com · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
  • cl2.apple.com · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
  • configuration.ls.apple.com · 2× · A, HTTPS · 17.253.15.139, 17.253.15.147
  • connectivitycheck.gstatic.com · 2× · A · 142.250.154.94, 142.251.20.94
  • gsp85-ssl.ls.apple.com · 2× · A, HTTPS · 17.167.200.74
  • gspe1-ssl.ls.apple.com · 2× · A, HTTPS · 2.16.16.100, 2.16.16.110
  • init.push.apple.com · 2× · A, HTTPS · 17.188.143.125, 17.188.143.126, 17.188.143.189, 17.188.178.226, 17.188.178.34, 17.188.179.2
  • m.hotmail.com · 2× · A, HTTPS · 40.101.69.226, 40.101.70.194, 40.104.206.18, 52.97.105.162
  • mask.icloud.com · 2× · A, HTTPS · 172.224.55.10, 172.224.55.11, 172.224.55.13, 172.224.55.4, 172.224.55.5, 172.224.55.7
  • nexus-websocket-a.intercom.io · 2× · A · 18.97.36.13, 18.97.36.14, 18.97.36.18, 18.97.36.2, 18.97.36.47, 18.97.36.49
  • www.googleapis.com · 2× · A · 142.250.154.95, 142.251.110.95, 142.251.127.95, 142.251.13.95, 142.251.14.95, 142.251.20.95
  • _dns.resolver.arpa · 1× · SVCB · no answer seen
  • a1366.dscapi6.akamai.net · 1× · HTTPS · no answer seen
  • api.production.loqed.com · 1× · A · 34.155.200.196
  • captive.g.aaplimg.com · 1× · HTTPS · no answer seen
  • cl2.g.aaplimg.com · 1× · HTTPS · no answer seen
  • configuration.ls.v.aaplimg.com · 1× · HTTPS · no answer seen
  • discover-pa.googleapis.com · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
  • encrypted-tbn0.gstatic.com · 1× · A · 142.251.127.100, 142.251.127.101, 142.251.127.102, 142.251.127.113, 142.251.127.138, 142.251.127.139
  • encrypted-tbn1.gstatic.com · 1× · A · 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139
  • encrypted-tbn3.gstatic.com · 1× · A · 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139
  • eu-central-courier-4.push-apple.com.akadns.net · 1× · HTTPS · no answer seen
  • gsp85-ssl.ls2-apple.com.akadns.net · 1× · HTTPS · no answer seen
  • hooks.nabu.casa · 1× · A · 3.73.212.91, 63.181.149.124
  • init.push-apple.com.akadns.net · 1× · HTTPS · no answer seen
  • lb._dns-sd._udp.0.0.12.10.in-addr.arpa · 1× · PTR · no answer seen
  • lb._dns-sd._udp.15.89.76.100.in-addr.arpa · 1× · PTR · no answer seen
  • lb._dns-sd._udp.56.111.171.10.in-addr.arpa · 1× · PTR · no answer seen
  • lb._dns-sd._udp.6.0.0.192.in-addr.arpa · 1× · PTR · no answer seen
  • lb._dns-sd._udp.jrz-iot.mci.edu · 1× · PTR · no answer seen
  • mask.apple-dns.net · 1× · HTTPS · no answer seen
  • mqtt.production.loqed.com · 1× · A · 34.155.200.196
  • play.googleapis.com · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
  • pool.ntp.org · 1× · A · 152.53.100.131, 152.53.119.76, 46.102.157.67, 91.206.8.34
  • prod-lt-playstoregatewayadapter-pa.googleapis.com · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
  • remoteprovisioning.googleapis.com · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
  • spot-pa.googleapis.com · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
  • vie-efz.ms-acdc.office.com · 1× · HTTPS · no answer seen

HTTP (2 requests)

  • connectivitycheck.gstatic.com · 1 requests · GET · /generate_204
  • 10.12.0.103 · 1 requests · · /generate_204

Clear-text protocols and service events

  • http: 1 flows, 373 B · 10.12.0.103 -> 142.250.154.94:80
  • xmpp: 1 flows, 96 B · 10.12.0.101 -> 31.13.84.49:5222
  • https: 1 flows, 21 B · 17.248.209.81 -> 10.12.0.102:443
  • icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
  • icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
  • icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
  • DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
  • DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
  • DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
  • DHCP ack: d6:cd:eb:e5:d1:75 iphone → 10.12.0.102 (server 10.12.0.250)
  • DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
  • DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
  • DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
  • DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
  • DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
  • DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
  • DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
  • DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)

Coverage

  • Complete extraction · 410 flows, 330 encrypted, 1 with undecoded payload · 4 clear-text payloads scanned
  • Undecoded ports (flows): 5222: 1
  • Flows with application data that tshark did not decode (port: flows): 5222: 1
  • 30 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.

Cloud URLs and Endpoints (54)

  • 1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local — Ports: —; TLS: N/A; Cipher: N/A
  • 142.251.127.188 — Ports: 443, 5228; TLS: N/A; Cipher: N/A
  • 142.251.20.113 — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • 18.97.36.19 — Ports: —; TLS: N/A; Cipher: N/A
  • 25-courier.push.apple.com — Ports: 443; TLS: N/A; Cipher: N/A
  • 3.91.171.254 — Ports: 443; TLS: N/A; Cipher: N/A
  • 31.13.84.49 — Ports: 80, 443, 5222; TLS: N/A; Cipher: N/A
  • 8.8.8.8 — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • _dns.resolver.arpa — Ports: —; TLS: N/A; Cipher: N/A
  • _rdlink._tcp.local — Ports: —; TLS: N/A; Cipher: N/A
  • a1366.dscapi6.akamai.net — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • api.production.loqed.com — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • bag.itunes.apple.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • captive.apple.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • captive.g.aaplimg.com — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • cl2.apple.com — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • cl2.g.aaplimg.com — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • configuration.ls.apple.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • configuration.ls.v.aaplimg.com — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • connectivitycheck.gstatic.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • courier.push.apple.com — Ports: 443, 5223; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • discover-pa.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • encrypted-tbn0.gstatic.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • encrypted-tbn1.gstatic.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • encrypted-tbn3.gstatic.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • eu-central-courier-4.push-apple.com.akadns.net — Ports: 443; TLS: N/A; Cipher: N/A
  • gateway.icloud.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • gsp85-ssl.ls.apple.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • gsp85-ssl.ls2-apple.com.akadns.net — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • gspe1-ssl.ls.apple.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • hooks.nabu.casa — Ports: 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES128-GCM-SHA256
  • i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local — Ports: —; TLS: N/A; Cipher: N/A
  • init.push-apple.com.akadns.net — Ports: 443; TLS: N/A; Cipher: N/A
  • init.push.apple.com — Ports: 443; TLS: N/A; Cipher: N/A
  • lb._dns-sd._udp.0.0.12.10.in-addr.arpa — Ports: —; TLS: N/A; Cipher: N/A
  • lb._dns-sd._udp.15.89.76.100.in-addr.arpa — Ports: —; TLS: N/A; Cipher: N/A
  • lb._dns-sd._udp.56.111.171.10.in-addr.arpa — Ports: —; TLS: N/A; Cipher: N/A
  • lb._dns-sd._udp.6.0.0.192.in-addr.arpa — Ports: —; TLS: N/A; Cipher: N/A
  • lb._dns-sd._udp.jrz-iot.mci.edu — Ports: —; TLS: N/A; Cipher: N/A
  • loqed-8c4b146a1acc._http._tcp.local — Ports: —; TLS: N/A; Cipher: N/A
  • m.hotmail.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • mask.apple-dns.net — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • mask.icloud.com — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • mqtt.production.loqed.com — Ports: 80, 443, 8080, 8883; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • n1cez2fg-android.mobile-messenger.intercom.com — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • nexus-websocket-a.intercom.io — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • play.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • pool.ntp.org — Ports: 22; TLS: N/A; Cipher: N/A
  • prod-lt-playstoregatewayadapter-pa.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • remoteprovisioning.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • spot-pa.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • vie-efz.ms-acdc.office.com — Ports: 80, 443; TLS: N/A; Cipher: N/A
  • www.google.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • www.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384

Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector

Reference in New Issue View Git Blame Copy Permalink