I'm trying to reverse engineer a device to be able to access its API locally. Currently it is communicating with an online server, where I can log into to see its data.
Set up
The device connects directly with ethernet to my desktop. Another port on my desktop has an uplink to the internet. I've bridged the connections through the Windows UI. I've disabled IPv6 on the Network Bridge in order to make my life easier.
Monitoring
I've set up Wireshark to listen on the Network Bridge, filtering on its IP ip.src == 192.168.1.10 || ip.dst == 192.168.1.10
or its ethernet address eth.src == ##### || eth.dst == #####
.
The capture includes the initial connection. I've seen some SOAP communication on startup and am able to ask it for its metadata such as serial number and firmware version. But I don't see any packets with the actual data.
Problem
Through the online website, I can see actual data which has been produced by the device, so I am certain that it has sent it somehow. But no packages have been sent or received at all, after the initial setup.
When reconnecting (physically), I do get receive a TLSv1 packet from the server, but I never see data being sent.
Please tell me why I am being stupid, and how to solve it. Thanks!