I recently bought a camera (for indoors home monitoring), and I got suspicious of its behavior data wise.

It is set up like this:

  • First you download and install an app called Lookcam onto your phone.
  • You power the device up by connecting it to the mains
  • It acts as an AP and you can connect to its own network using your cell phone.
  • Then you open the Lookcam app and it lists the available wifi networks. So proceed by entering the password and connecting to your home wifi network.
  • From there on, the camera disables its AP and you can no longer see its own network.

You can now see the recorded videos (it records to an SD card) and the live stream from the app.

Since it only records to the SD while connected to the wifi, I had a hunch that it could be sending data to unauthorized parties.

How can I check its activity?

I am new to this, although I have used Wireshark for checking minor information in the past. Using Wireshark, this is the little I've done so far.

Got the device MAC address from my router admin. Recorded about 15 minutes of activity. Filtered the device's MAC address using the command: eth.src==MAC. Statistics -> Conversations.

There were 64kb from the device to my router over this time span, and 0 byte from my router to the device. The majority of the communication was UDP.

I did not go any further.

Can someone instruct me a step-by-step procedure on how can I reliably check if it is or isn't sending my data somewhere?

  • 1
    If the concern is about camera sending unauthorized traffic, you can block the outward camera traffic at router level. if this is more of curiosity investigation to know the details ,what you have done with wireshark is the right way to go forward. next step would be to determine what destination IP address the UDP traffic is sent to from wireshark capture and see the location of ip address using online offerings which offer "ip location lookup" services.
    – choppe
    Commented May 10 at 18:54
  • One way to analyze traffic could be to insert a MikroTik router in your network setup, and use the MikroTik Torch tool to check all the network connections being made (Torch tool in action here: youtube.com/watch?v=45E2uwI3xhc). But be warned as MikroTik routers are VERY complex to setup, much more complex than the typical router/firewall (it should also be said that the relevant documentation is extensive and the community of people on the forum is large). Mikrotik router can also be cheap, a Mikrotik hEX cost about 60$ and can route 1Gbps of traffic.
    – Max
    Commented May 16 at 20:41


You must log in to answer this question.

Browse other questions tagged .