IPC querying 'none' domain

R

rscole

n3wb
Apr 14, 2017
5
1
As part of setting up my first camera/nvr, I am trying to determine that the camera is not trying to phone home etc.
The camera is a IPC-HDW5231R-Z. According to my pi-hole logs it will regularly query a domain of 'none'. I have used wireshark, and all it shows is normal ARP traffic.

I have also asked this question here and here, however I am not getting any further.
Any ideas now what the camera may be attempting?
 
I cannot block it with my current router, but will when I set up the Edgerouter (I could do it with the pihole now). Upnp is already disabled on both. I have no ports forwarded to the camera or NVR.
Yes I will put in a fake gateway.
And I'm already 'good'.

I am interested in WHY the camera is querying 'none' in the first place, or if anyone else has seen it with their cameras.
 
rscole said:
According to my pi-hole logs it will regularly query a domain of 'none'.
Click to expand...
is that the fully qualified domain name? And what type of query?

rscole said:
I have used wireshark, and all it shows is normal ARP traffic.
Click to expand...
Do you have port mirroring implemented for the wireshark snoop point?
If not, all you will see is either broadcasts such as ARP, or traffic to/from the PC.
 
Thanks for the reply. I must admit it has been a long time since I played with wireshark, and forgot completely about the port mirroring.
I was only monitoring on the rpi, as it is my dns server for ad blocking purposes. Presumably, as I have not set up port mirroring, I will only ever see the DNS query with wireshark running on the pi.

As you can see below, to the best of my knowledge, the domain is 'none'. Not sure if this effects it, but the pi-hole is set to Never forward non-FQDNs. I did have this disabled at one point, but do not think it made any difference to the pi-hole logging.

Queries
none: type A, class IN
Name: none
[Name Length: 4]
[Label Count: 1]
Type: A (Host Address) (1)
Class: IN (0x0001)
 
You must log in or register to reply here.
Top Bottom