Wireshark advice

JanJ

If LAN is 192.168.1.x
And Computer with Wireshark is, 192 .168.1.9

Can that Wireshark be set up on computer at .9 so it displays/captures all data to/from a camera at 192.168.1.175?

I have some Wireshark help files but not covering this.

Thanks

sempergoofy

Wireshark will open the NIC in promiscuous mode so it can see all packets that arrive on the NIC. However, the counter question is, “Why would a packet from the camera at .175 arrive on .9’s NIC?” If .175 is sending its packets to some other address in a conversation, then I can’t see where .9 would see that traffic.
You could set up .9 to be the gateway in the config for .175, and enable ip-forwarding on .9 and put rules in the firewall for .9 to accept the packets from .175 (and the client of .175).
You would not have to do that work if you just want to capture traffic between .9 and .175.

Wireshark lets you setup capture filters for that which you seek nicely.

cypherstream

A managed switch can mirror the port towards your computer running wireshark. Each vendor calls it something different from a port mirror to a tap to a span, etc…

JanJ

cypherstream Thank you both.
No wonder I couldn’t find it! — because it doesn’t exist. !!(What I’d hoped to do)..

Switches here are un-managed.

I had seen Whois from .175 at .9 when I gave cameras a bogus gateway, (until I gave it a physical gateway-sans WAN connection, then the Whois/Whereis commands ceased). I did not interpret that correctly and spend my last week or so trying to see .175 at .9, which after your description, though I still wish it could be done, understand it can’t!🤷🏼‍♂️

HardlyWorthit

JanJ Switches here are un-managed.

I seem to recall that the switch you use to test cables may be a managed switch. I could be mistaken.

MacLeech

JanJ I believe you have the TP Link tl-sg108 switch which has some neat features like port mirroring
https://www.tp-link.com/us/support/faq/527/

JanJ

Yes I do!
NetGear ProSAFE GS105E. Latest firmware as of last fall. (Though I’ve only used it as a cable tester). Somewhere in a binder somewhere I have the user operations notes, printed out.
So I’ll go find the printouts. Anybody willing to discuss the how-to??

I can say: I have 2 switches: one POE, with all cameras, and other with all other devices. POE connects to non POE switch via a patch. Non POE switch also connects to router. Computer at .9 is one non POE switch, .175 and all other cameras .161 … .176 on POE switch.
When I find the manual, what do I need to read up on?

I’ll look for manual of managed switch

HardlyWorthit

JanJ
Manual for GS105ev2
https://www.downloads.netgear.com/files/GDC/GS105EV2/WebManagedSwitches_UM_EN.pdf
There is a Windows based configuration utility in addition to the web based utility.
https://www.downloads.netgear.com/files/GDC/GS105E/ProSAFE_Plus_Utility_UM_EN.pdf

JanJ

MacLeech
What you mentioned is the port mirroring on page 68/69 of manual link just above?
Correct?

If so, another question: where does managed switch want to physically go?
Can it reside in between the two unmanaged switches, with computer .9 on one side and .175 camera on other side, connected to one of 12 POE outputs? Camera is POE, so managed switch can’t connect to camera directly, only via POE switch.
Thanks for the spoon feeding!

JanJ

EDIT… after reading instructions… I think I know how to connect… But I’d like confirmation….
because device is POE that complicates it somewhat….

Normally Connect computer (With WireShark) to managed switch via port 4…

Connect camera I want to mirror, to POE inserter, and output of inserter to Managed switch port 2…. (Camera will find Bogus Gateway via Managed switch, to Main Switch, to POE switch, where Bogus Gateway is connected. Normally camera connects to POE Switch, so simpler connection to Bogus Gateway)…

In Port Mirroring….. Select Port 2 as source (POE Inserter & Camera), and Port 4 (Computer with WireShark) as destination…..

After APPLY, Then Start WireShark on computer, and it will ‘see’ what’s I/O on Device under test????

Am I interpreting the instructions correct?
Thank You (I’m self taught)

JanJ

Adding this to make thread active again I’d love confirmation that my above approach is correct….. Thank You!

bighorn1

Yes, basically correct setup to capture.
But what is that “bogus gateway” you’re mentioning?

JanJ

Thank You oh so much! The 3x mfg cameras I have: 2K HikVision, & 2x different mfg 4K cameras…. Do not have firmware updates. HikVision because they obsoleted the cameras, & other two just never gave info as to where updates are. Nor do any have support contacts.
In case security issues come up, I’m attempting to isolate them as much as possible, yet still use the Video they create.
So I gave cameras a gateway IP that is non-existent, so if cameras TRIED to phone home they could not! (I have remote access to their video IP streams via other way). Also isolated them by IP in (real) router firewall, where I see no ‘hits’ on those I/O DENY rules!😁
Both ideas worked, but the non-existing gateway idea: all cameras then flooded LAN with “Whois/whereis x.x.x.x” (gateway IP I added in cameras… this was seen by WireShark on computer at .9)..
For kicks, I took an old router, set it for that Gateway IP, connected its LAN to my LAN, with nothing at it’s WAN. By giving a real device at that IP, That silenced all the Whois/whereis traffic on LAN from all cameras, and assured no Internet access via an empty WAN Port! I knick-named it ‘Bogus Gateway’. It was that traffic I saw from all cameras at .9 that made me to want to examine more, out of curiosity, I do not think or expect an issue, I’m just incredibly nosy. And being self taught, I come up with these hair-brained schemes!
Stuck in honey-do issue now, so I posted what I could to get proper info so when I can try it, at least others say I’m headed in right direction!!😇

sempergoofy

JanJ So I gave cameras a gateway IP that is non-existent, so if cameras TRIED to phone home they could not! (I have remote access to their video IP streams via other way).

And there is the root of the mystery I guess. The remote access need from a system other than your 192.168.1.x LAN. If it were not for that, then specifying no gateway at all on the cameras should limit them to only being able to speak with other systems on the same subnet. But if you want access from a different subnet (including remotely) then without a default route to a gateway, you would be unable to reach the camera.

JanJ

For complexity reasons, I’m not running a VLAN System, and that’s another reason why the Bogus Gateway and Firewall rules.
I access camera via a different program on LAN, externally, and it connects to stream of cameras. So other than camera setup program via LAN, I never access cameras remotely, only through that other program.

I know camera ftp’s still pics to NAS, and streams IP to other program on LAN, and reports externally with its data. That program saves cameras video live to external devices & saved to other location on same NAS. And whatever communications to ‘Bogus Gateway” happen. Camera never connects externally I’m told. My firewall I/O Deny rules & Bogus Gateway seem to bear this out.
I’m not suspecting anything, planning on just looking and learning, that is all.. Heck: I might even learn something!