I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic.
I've connected it to my laptop and I've shared the connection by using the Network Manager option in Ubuntu. Then, I tried to see the network traffic with Wireshark.
It seems to send all data to an external server hidden in the post using HTTPS. That's it? There's nothing I can do?
The destination server has a self-signed certificate, but probably the device has this one certificate as accepted. Could I replicate this certificate if needed?
I tried to redirect all the traffic to a local server with this iptables rule, but I'm probably missing something. It doesn't seem to work. I don't even get an entry on my Apache log (and yes, it's actually listening on port 443):
iptables -t nat -I PREROUTING --src 10.42.0.73 --dst 81.91.XX.XX -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:443
And this is the output from Wireshark when I do that:
It seems the connection can't be stablished. But shouldn't my Apache react and write a log entry at least? What am I doing wrong? Is this a good approach or should I try other things?
(Please notice I've hidden the full destination IP on both the rule and the screenshot)