Ask Your Question
0

AllJoyn TCP traffic not being dissected

asked 2021-02-13 16:28:40 +0000

obones gravatar image

Hello,

I'm trying to figure out how to talk to an "intelligent" light bulb by capturing the traffic generated by the android application when it talks to the bulb via Wifi.

Using tcpdump on the android device, I was able to generate a pcap file which I opened in Wireshark. There are quite a few MDNS queries that look for _alljoyn._tcp.local and _alljoyn._udp.local and I see a few ISAT AllJoyn protocol UDP messages.

But the most promising parts are inside TCP packets that are not analyzed by any of the dissectors, they only appear as TCP ACK packets, despite containing AllJoyn related strings, like this:

0000   08 00 00 00 00 00 00 09 00 01 00 06 7c df a1 07   ............|...
0010   e4 91 f3 b4 45 00 00 c8 00 ac 00 00 ff 06 31 30   ....E.........10
0020   c0 a8 04 01 c0 a8 04 02 f3 f1 c3 87 00 00 1b 3c   ...............<
0030   3c 55 8d 0d 50 18 09 aa 10 83 00 00 42 01 06 01   <U..P.......B...
0040   00 00 00 4d 00 00 00 02 00 00 00 8c 01 01 6f 00   ...M..........o.
0050   00 00 00 10 2f 6f 72 67 2f 61 6c 6c 6a 6f 79 6e   ..../org/alljoyn
0060   2f 42 75 73 00 00 00 00 00 00 00 00 02 01 73 00   /Bus..........s.
0070   00 00 00 0f 6f 72 67 2e 61 6c 6c 6a 6f 79 6e 2e   ....org.alljoyn.
0080   42 75 73 00 03 01 73 00 00 00 00 0f 42 69 6e 64   Bus...s.....Bind
0090   53 65 73 73 69 6f 6e 50 6f 72 74 00 06 01 73 00   SessionPort...s.
00a0   00 00 00 0f 6f 72 67 2e 61 6c 6c 6a 6f 79 6e 2e   ....org.alljoyn.
00b0   42 75 73 00 07 01 73 00 00 00 00 0b 3a 4c 33 74   Bus...s.....:L3t
00c0   58 70 43 67 6c 2e 33 00 00 00 00 00 08 01 67 00   XpCgl.3.......g.
00d0   06 71 61 7b 73 76 7d 00 00 00 00 00               .qa{sv}.....

There are also DBus related packets, like this:

0000   08 00 00 00 00 00 00 09 00 01 00 06 7c df a1 07   ............|...
0010   e4 91 d7 7e 45 00 00 a8 00 a8 00 00 ff 06 31 54   ...~E.........1T
0020   c0 a8 04 01 c0 a8 04 02 f3 f1 c3 87 00 00 19 c0   ................
0030   3c 55 8b b5 50 18 0b 02 41 d5 00 00 42 01 06 01   <U..P...A...B...
0040   00 00 00 00 00 00 00 01 00 00 00 6d 01 01 6f 00   ...........m..o.
0050   00 00 00 15 2f 6f 72 67 2f 66 72 65 65 64 65 73   ..../org/freedes
0060   6b 74 6f 70 2f 44 ...
(more)
edit retag flag offensive close merge delete

Comments

Have you checked if the AllJoyn protocol is enabled? (Settings->Protocols) You can try to assign the protocol dissector manually for the traffic (right click on a packet that contains the AllJoyn related string, select "Decode as..." and choose the AllJoyn protocol under "Current")

If this doesn't help, can you provide your capture?

JasMan gravatar imageJasMan ( 2021-02-14 11:40:16 +0000 )edit

There are sample captures attached to the Gitlab issues where the protocol was added.
How do those compare to your captures?

Chuckc gravatar imageChuckc ( 2021-02-14 16:51:41 +0000 )edit

Looks like the dissector has preferences to set the TCP Message and Server port if that helps.

Anders gravatar imageAnders ( 2021-02-15 09:07:37 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-02-15 09:14:26 +0000

obones gravatar image

Well, as it often turns out, I'm a idiot for not seeing an obvious things: The device is not using the standard 9955 port but rather the 50055 one. So, after having adjusted it inside the preferences, it now decodes the packets just fine.

Sorry for wasting everyone's time here.

edit flag offensive delete link more

Comments

:-) Thank you for your feedback.

JasMan gravatar imageJasMan ( 2021-02-15 10:06:28 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-02-13 16:28:40 +0000

Seen: 680 times

Last updated: Feb 15 '21