IP Camera's using up all our Upload broadband !

[remus]

Hi all,

Staff at the community centre where I volunteer have been coplaining about slow internet for a while this year.
they say its getting worse and worse and after our ISP reported we were using a strangely large amount of Upload data. I disconnected all computers and devices from our network and enabled them one by one while monitoring our ISP upload usage summary page in a web browser on my phone.

I've discovered the problem is caused by IP Camera's we have been installing since April this year. We have about 20 of these things at the moment, they are all configured by P2P.

The manufacturer in China "Longse" claim they will use a little data to transmit P2P readiness status to a server for devices to connect to remotely via apps.

But these camera's are consuming over 4GB of upload broadband every day now.

Can I get some advice as to how I can place a computer between the network switch and our modem to capture the data the camera's are transmitting and examine it ?

All comments and suggestions welcome.

Thank you

[Rich]

Hi remus
Wireshark will let you set triggers and capture on a wide variety of parameters. The problem is getting
a good point to tap the data stream. You'll probably need to place a computer between the network
switch and the modem with 2 network cards to act as a "bridge". Then use Wireshark to listen in on
one of those network cards. You can probably use  iptables.tcz  to bridge the 2 network cards.

[NewUser]

We had a similar problem at work when video cameras data was sent to a remote site, instead of being kept locally.  Unfortunately I don't remember the fix, though decreased resolution was a part.

[curaga]

Many Chinese cameras are known to send their image stream to Chinese servers, and to let the parent company view & control everything. The bad thing about it is that if you block that in your firewall, the cameras may stop working locally too.

[hiro]

The more these IoT devices can do the more important it is to separate them cleanly in their own VLAN or comparable measures and block all outside communication.
If the devices stop working without their command&control servers as curaga warns then they are not worth having in the first place and should be discarded or given away with a big fat warning.

Little side-story to show other practical unintended benefits:
Some years ago I bought an amazon firestick exclusively to use the XBMC fork Kodi, and I was wise enough to block all connections but to my NAS.
Friends did the same, but forgot my recommendation to block all possible, so their OS got upgraded and amazon removed functionality that was required to auto-start Kodi. Firmware downgrades are also not possible any more.
My device wasn't able to update, so I'm fine.

It's not just about China for me. I want to be in control.

[Pats]

Posted by remus on September 21, 2018..
... Staff at the community centre where I volunteer have been coplaining about slow internet for a while this year.they say its getting worse and worse and after our ISP reported we were using a strangely large amount of ...

curaga has pointed to an important aspect, and it looks more obvious reason for OPs problem.

... At the same time, now a days, one should be aware about *the cryptojacking code* which  hijacks the system CPU and puts it to use mining cryptocurrency,
... There are several types of malware out there that will mine cryptocurrency by using  speed and processing power of infected machines .
... Ggl for more details.

[remus]

Thanks to everyone for their comments and suggestions.

That these camera's are transmitting so much data somewhere autonomously is worrying !

Sounds like I need to figure out if our TP-Link td-w8990 ADSL router has a built in firewall for starters.

[Rich]

Hi remus

Sounds like I need to figure out if our TP-Link td-w8990 ADSL router has a built in firewall for starters.

Is that model number a typo? Google insists on returning results for  td-w8980.  Typing in the LAN address of the router
into a web browser should give you its web based interface.

[Rich]

Hi remus
This is a manual for the 8980:
https://static.tp-link.com/res/down/doc/TD-W8980_V1_UG.pdf
According to section  4.14  it does have a firewall.

[remus]

Yep its a TP-LINK TD-W8980

Thanks for the manual link.

I've set a firewall rule stopping all outgoing traffic from IP Range of the Camera's but not the NVR.

Our uploads have returned to a normal rate, but I'm unable to access the NVR via app on my phone now. I'm going to re install it to be sure.

Will post my findings.

[NewUser]

Do you know where the video/pictures are going?

[remus]

Do you know where the video/pictures are going?

At this stage, I'm unaware of WHAT and WHERE data is being transmitted.

I've yet to setup a system between the network and the modem to investigate that.

Is wireshark going to sort out the WHERE and WHAT ?

[Rich]

Hi remus
Wireshark can do what you need. If you set up the following in the capture field:

Code: [Select]

host 10.1.1.61 or 10.1.1.62 or 10.1.1.63 or 10.1.1.64 or 10.1.1.65 or 10.1.1.66This will only capture traffic to and from those cameras.

[remus]

Hi All,

I can report the following.

Blocking the IP Camera's IP Range from outgoing transmission has stopped the massive data upload through our modem.

Restarting the NVR and re installing the settings in mobile phones got remote access to the NVR working again.

All in all we are pretty happy with the outcome.

My manager is curious as to what is actually being transmitted. I will install wireshark in a VM and see how I go before deploying a machine to tap the transmissions. Then I'll target a few of the camera's and modify the firewall to let that traffic through again (This may note be nesesary... perhaps the camera's are just going to stupidly transmit without RTS confirmation that packets are received on the other end...)

[remus]

Experiments (Education )with wireshark continues.

In the mean time, my manager would like me to setup something to monitor web traffic on our network in future so when this happens again we won't be caught guessing.

So is there an existing TinyCore / MicroCore app that does the following ?
- Able to show web traffic history/trends for devices on our LAN by IP or MAC address.
- I guess it would be neat if the app supported a web gui we could access from the LAN
- It would also be neat if the app could send an email alert if web traffic exceeds a preset limit.

As always your thoughts and comments are welcome.

Thanks.