Help with netcat

[balanga]

I'm hoping to install OpenWrt on a GoFlex Home unit but I am currently unable to gain access to it. Without a disk connected it ends up with a flashing orange light, but with its disk in place it ends up with a steady green which is supposed to mean it has booted up OK, but it does not request an IP address from the DHCP server and I am unable to connect. I have noticed that I can ping it whilst it is booting, but get no response once the steady green light has come on.

This unit will not connect via serial cable so I can't really tell what is going on. I suspect that nc was setup on it and think it is looking for an nc server at a particular IP address.

Is there any way to tell what it is looking for? I guess if I kept changing the IP address of my server and ran nc on it whilst booting the GFH unit, I might find what it is looking for. What else could I do?

[anomeome]

sniff the wire with something(wireshark)?

[lleachii]

I suggest making the thread title to better reflect the issue you're having with your device. I see 3 threads for your GoFlex Home.

[iplaywithtoys]

Couple options:

1. As @anomeome above indicates, if you believe it's using DHCP then sniff the traffic from the wire. tcpdump, wireshark, a switch with port mirroring, or more. There are several ways to achieve this.

2. Your post indicates that you can disconnect the disk. You could try connecting the disk to another computer, either with an internal cable or USB adapter. Then you could use the other computer to examine the contents of the disk, assuming the computer can recognise the file system (hint: most current Linux distros recognise more file systems than Windows does). Then, if you can read the filesystem, you might be able to find the configuration information for the network... maybe.

[balanga]

@anomeome

sniff the wire with something(wireshark)?

You're probably right, but I've never used it before and it looks pretty complicated. I know the MAC address and IP address so I need to find out how to filter on those two values...

[iplaywithtoys]

@balanga

I know the MAC address and IP address

If you already know the IP address, then it's using a static IP address, not DHCP, and you can just use nmap to probe it for open ports.

[balanga]

@iplaywithtoys

Couple options:

1. As @anomeome above indicates, if you believe it's using DHCP then sniff the traffic from the wire. tcpdump, wireshark, a switch with port mirroring, or more. There are several ways to achieve this.

2. Your post indicates that you can disconnect the disk. You could try connecting the disk to another computer, either with an internal cable or USB adapter. Then you could use the other computer to examine the contents of the disk, assuming the computer can recognise the file system (hint: most current Linux distros recognise more file systems than Windows does). Then, if you can read the filesystem, you might be able to find the configuration information for the network... maybe.

It isn't using DHCP. I think it is hard coded in uEnv.txt in NAND.

I took the hard disk out and had a look around the filesystem but didn't find any pointers.

[iplaywithtoys]

If the IP address is fixed and cannot be changed - which seems unlikely, but I've not read the Seagate manuals for the product (hint, hint) - then all you need to do is put your computer into the same subnet as the device. Then you'll be able to connect to it.

Then, once you're fed up with dealing with a device which is fixed to a single IP address which cannot be changed, throw it away and get something less awkward.

[balanga]

@iplaywithtoys

@balanga

I know the MAC address and IP address

If you already know the IP address, then it's using a static IP address, not DHCP, and you can just use nmap to probe it for open ports.

root@S07:/# nmap -Pn 192.168.1.22
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-15 20:31 UTC
Stats: 0:00:02 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 4.00% done; ETC: 20:32 (0:00:48 remaining)
Nmap scan report for 192.168.1.22
Host is up (-0.21s latency).
All 1000 scanned ports on 192.168.1.22 are filtered
MAC Address: 00:10:75:2E:AE:0F (Segate Technology)

Nmap done: 1 IP address (1 host up) scanned in 22.50 seconds

Doesn't give much away...

[balanga]

@iplaywithtoys

If the IP address is fixed and cannot be changed -

It can be changed/set by uEnv.txt and I would be able to read or change that if I managed to talk to the system with netcat.

[iplaywithtoys]

@balanga

All 1000 scanned ports [...]

Doesn't give much away...

There are 64535 other ports you didn't scan...

[balanga]

Nmap scan report for 192.168.1.22
Host is up (-0.21s latency).
All 65535 scanned ports on 192.168.1.22 are filtered
MAC Address: 00:10:75:2E:AE:0F (Segate Technology)

Nmap done: 1 IP address (1 host up) scanned in 1394.73 seconds

[jeff]

Wireshark is really the proper tool for the task. Filter on the MAC address of the device.

[iplaywithtoys]

@jeff is right. Probing for open TCP ports didn't get you anywhere. Time to sniff the traffic to/from the device and look for clues.

[balanga]

@jeff

Wireshark is really the proper tool for the task. Filter on the MAC address of the device.

Never used Wireshark before - it looks a bit daunting....

I guess I need to go

Capture -> Capture Filter -> Select Ethernet address

????

[iplaywithtoys]

@balanga

I guess I need to go

Capture -> Capture Filter -> Select Ethernet address

First you need to go to https://www.wireshark.org/docs/wsug_html/

Then, once you've learned how to use the application, it's a case of selecting a capture interface, then deciding whether to apply a capture filter, a display filter, or both.