What is this traffic?

[Josephny]

I am hoping someone can help me understand this traffic.

192.168.0.103 is a Home Assistant server (HASSIO) physically located in location A.

192.168.40.10 is a Windows PC (Beelink Mini sitting in a basement of a house running Blue Iris and allowing me to pretend I am there).

192.168.40.1 is a hEX (wired to .10).

192.168.0.0/24 and 192.168.40.0/24 are connected via a Wireguard VPN.

I ran a packet sniffer on the hEX filtering for 192.168.0.103 and there is quite a lot of traffic which I can’t explain.

Can anyone decipher this?

[pe1chl]

To understand what the traffic is, do a packet sniffer with output to a file, download the file, and load it in “wireshark” on your computer.
That will show all fields with the deciphering knowledge of wireshark.

But I think it is MQTT. That is a protocol used by Home Assistant.

[Josephny]

That is a great suggestion! Thank you.

In the meantime, however, I figured it out.

I had forgotten that I installed “HASS.Agent” on the Windows machine. This is a very cool system monitoring software that feeds Windows and PC hw heatlh/status data to Home Assistant.

I turned it off on the Win PC and the traffic completely disappeared.

But, just for giggles, I turned it back on, sniffed and analyzed and (not at all surprising) you were right: