Saturday, October 15, 2011

Samsung SmartTV traffic

My SmartTV does magic things without asking me, like installing new updates to SmartTV, adding apps, removing apps, disabling stuff in the menu, re-enabling it, etc. I've tried to sniff the network traffic it creates in order to find out what to block in order to stop it from communicating with external servers, but not to stop it from streaming movies from my computer. My findings are the following:

-the TV is creating a lot of ARP traffic.

-It tries to communicate over SSDP with 239.255.255.250 which means it's trying to find something by multicasting



No incoming traffic to 10.0.0.31 appears, maybe it's getting the updates over the cable provider's network.
Please comment if you have any more information on how these updates work.

EDIT:
Actually I later realized that all I saw was the broadcast traffic, because of the switched network. I'll have to re-do this next time the TV gets on my nerves with connecting to Samsung and downloading updates.


4 comments:

Fabricio Toresan said...

Hi, which tool did you use?
Can I capture the traffic using a computer in the same router, but connected to the wired network?

I'm asking because my smartTV (UN40ES6500) connects to the wireless network successfully, but fails to connect to the internet, and I'd like to check what's going on under the hood.

Vasile said...

I'm a bit uncertain. Your router is probably a switch also, and that means that traffic will not be broadcasted over all ports. You'd be better off putting a HUB between the router and the internet connection, and connect your computer to the hub. Hubs send traffic over all ports, enabling network cards in promiscuous mode to capture packets not intended for them

Fabricio Toresan said...

Thanks a lot for your reply. I found out what was going on.
Even with 60-65% of wireless signal, the TV needed to be closer to the router in order to get the Internet working. Moving it 2 or 3 meters closer fixed the issue(!).
Without a hub, all I could get was the ARP broadcast packages from the TV.

Vasile said...

Exactly. One could sniff ditectly over wireless if the wireless interface is capable oh going in promiscuous mode .. I'm glad it helped