I'm trying to reverse engineer a device to be able to access its API locally. Currently it is communicating with an online server, where I can log into to see its data.

Set up

The device connects directly with ethernet to my desktop. Another port on my desktop has an uplink to the internet. I've bridged the connections through the Windows UI. I've disabled IPv6 on the Network Bridge in order to make my life easier.


I've set up Wireshark to listen on the Network Bridge, filtering on its IP ip.src == || ip.dst == or its ethernet address eth.src == ##### || eth.dst == #####.

The capture includes the initial connection. I've seen some SOAP communication on startup and am able to ask it for its metadata such as serial number and firmware version. But I don't see any packets with the actual data.


Through the online website, I can see actual data which has been produced by the device, so I am certain that it has sent it somehow. But no packages have been sent or received at all, after the initial setup.

When reconnecting (physically), I do get receive a TLSv1 packet from the server, but I never see data being sent.

Please tell me why I am being stupid, and how to solve it. Thanks!

  • 1
    If the device is at least moderately reasonable, it'd use transport encryption. You will not be able to read the data. // Also, whether you enable or disable IPv6 on your PC doesn't matter for the device.
    – Daniel B
    Nov 5 '21 at 22:36
  • @DanielB TLS shouldn't prevent me from at least capturing the data, right?
    – Breina
    Nov 6 '21 at 7:45
  • 1
    Are you listening on one of the bridge’s slave interfaces? If you listen on the virtual bridge interface, you’ll only get traffic directed there. A bridge works like a switch.
    – Daniel B
    Nov 6 '21 at 10:11
  • Ah that explains it. I've disabled the bridge and just shared the internet connection with the other ethernet port. Now I can see all the encrypted TLS traffic. The next step is to forge the DNS query to make it communicate to my own device. Thanks for your help!
    – Breina
    Nov 6 '21 at 15:48

It appears you were sniffing on the virtual bridge interface. This interface will only receive traffic directed there + some other packets as part of the discovery process. Keep in mind that a bridge works mostly like a regular Ethernet switch: Once the switch has learned which MAC addresses are reachable through which ports, traffic for these MAC addresses will only be sent to these ports.

Only as part of the learning process are packets flooded to all ports. That’s what you saw.

To get all traffic, you need to sniff traffic on one of the bridged “real” interfaces, preferably the one the device to monitor is connected to. You will then see all traffic.

Of course, since it appears the actual data exchange is encrypted, you won’t be able to inspect its contents. But maybe the device has weak security and you can perform a man in the middle attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.