Mirroring/intercepting SunPower Monitoring Traffic?

Collapse
X
 
  • Time
  • Show
Clear All
new posts

  • astroboy
    replied
    Originally posted by JJNorcal

    Then I had a day where an entire morning was missing. Reviewing saved tcpdump file, it appeared that all the 130 packets were truncated (tcpdump prematurely ends the packet with "[!http]"). So I started a parallel tcpdump to write packets to a file instead of parsing and piping to node, and reviewing the resulting file with wireshark, none of the packets were actually truncated. There is an apparent problem rendering SP packets with tcpdump (both -v and -A). My best guess is that tcpdump is attempting to honor the content-length tag and is treating the tabs incorrectly as up to 8 chars, so current length of valid data fields can lead to different truncation point.
    i see this from time to time as well with my snooping code, which uses perl and the Pcap module. i'm pretty sure the problem is that if the monitor gets backed up (meaning sunpower is not acknowledging the inverter data) then the datagrams that are being sent grow and grow until they exceed the MTU of the network, which is generally somewhere around 1500 bytes. at this point you need software that can reassemble fragmented IP packets. it's possible that tshark is simply handling this transparently for you. i don't know if tcpdump itself can reassemble IP fragments.



    Leave a comment:


  • JJNorcal
    replied
    Pushed tshark solution to new testing branch.

    Leave a comment:


  • DanKegel
    replied
    Originally posted by JJNorcal
    I have not pushed the changes to gitlab yet. It will require changes to instructions, and I want to get more bake time before committing.
    Sounds promising!

    (FWIW, around here, standard practice is to push works in progress to an alternate branch or personal fork. That way other developers can review if they like, and plus if your workstation explodes or you forget which of a dozen places you were working, your source is safe in the branch.)

    Leave a comment:


  • JJNorcal
    replied
    Quick update on my project.

    Over time, I worked through what appeared to be unreliable/inconsistent behavior from perspective of PVS5. Occasionally a 130 packet went missing. Occasionally a 130 packet was truncated.

    I made "improvements" to fill in missing data points based on lifetime energy supplied in each packet.

    Then I had a day where an entire morning was missing. Reviewing saved tcpdump file, it appeared that all the 130 packets were truncated (tcpdump prematurely ends the packet with "[!http]"). So I started a parallel tcpdump to write packets to a file instead of parsing and piping to node, and reviewing the resulting file with wireshark, none of the packets were actually truncated. There is an apparent problem rendering SP packets with tcpdump (both -v and -A). My best guess is that tcpdump is attempting to honor the content-length tag and is treating the tabs incorrectly as up to 8 chars, so current length of valid data fields can lead to different truncation point.

    So I switched to tshark, which looks like wireshark fork/variant of tcpdump. It can output each parsed packet en masse, so easier for subsequent parsing in node. So far, tshark appears to be a reliable sniffer parser, though the command line syntax proved somewhat challenging to obtain the body of the http post.

    The one caveat to statement of reliablity is that the node app appeared to stop on its own after switching to tshark. This occurred once so far, 90 minutes after the first time I started it up for the first time fully debugged. This is a significant caveat given that this never happened with tcpdump. Linux logs showed signs of terminating the user session which was hosting node, but I was unable to determine a cause. One difference is that tcpdump needs to be launched with admin privileges whereas tshark does not, but I have not been able to reproduce an anomaly despite exiting ssh session, putting computer to sleep, forcing network anomalies, etc.

    I will continue to monitor and report back after a week or so.

    I have not pushed the changes to gitlab yet. It will require changes to instructions, and I want to get more bake time before committing.

    Leave a comment:


  • Sunking
    replied
    Originally posted by DanKegel
    Much better, gitlab.com/JJNorcal/SpPvoConnector now shows me your files. Thanks!
    I thought they finally banned you. Well I will report you for posting links again.

    Leave a comment:


  • DanKegel
    replied
    Originally posted by JJNorcal
    DanKegel, just now seeing this. I must have missed a solarpaneltalk email indicating thread update. Sorry.

    I just now changed "View and edit files in this project" to "Everyone with access" and enabled "Allow users to request access". Hopefully you can find a way in now
    Much better, gitlab.com/JJNorcal/SpPvoConnector now shows me your files. Thanks!

    Leave a comment:


  • JJNorcal
    replied
    Boing, I don't think I can speak for all on this thread, but you do not have a pvs5 which looks like this: https://fccid.io/document.php?id=2725912. And I'm using the snooping method which intercepts real time pushes, so I can't speak to your AJAX problem either. Good luck!

    Leave a comment:


  • boing
    replied
    Ah, thank you SunEagle!

    Leave a comment:


  • SunEagle
    replied
    Originally posted by boing
    Test - I just typed out this long reply yesterday and it went to 'Unapproved'. Is there a moderation process that may result in my post being seen, or is it gone?
    Your post had web links which send it to the moderators for review before it gets approved. Which it is now.

    Leave a comment:


  • boing
    replied
    Test - I just typed out this long reply yesterday and it went to 'Unapproved'. Is there a moderation process that may result in my post being seen, or is it gone?

    Leave a comment:


  • boing
    replied
    I had drawn conclusions similar to intipower's findings. (I wish I had seen this thread first before having to discover it on my own!) A couple of additional/similar findings are below. I'm wondering if my supervisor is a bit different than yours based on what I'll highlight below.

    First, this is what mine looks like. Note the two LAN ports on the top right. Is that how all of yours are too?


    best free photo upload sites


    Assuming so, try this. Hook up the network port not in use (one is probably "wired" to your LAN one way or another) on your supervisor to a an AJAX capable browser device (think: Laptop with a GUI... more on that AJAX requirement below) You could throw a hub/switch in the middle, but it really isn't necessary. Now you can:

    1)
    Visit your Supervisor's main page. If you don't know the IP of your supervisor, visit:


    That'll take you to the supervisor's main local page on your LAN, and indeed the page that SunPower uses to discover/setup devices when the technicians are out.

    2)
    The supervisor will bridge your internet connection. Assuming your supervisor has Internet access (i.e. is reporting data to the sunpower servers), your laptop (or whatever) device that is hooked into the second port of the supervisor will now have the same LAN/WAN access. Try it out, visit https://www.solarpaneltalk.com while you are in that configuration. (be sure to turn off wifi so you know you aren't accessing through wifi!)

    3)
    As mentioned earlier, there are some key URLs in the above setup. I.e.:

    http://sunpowerconsole.net/cgi-bin/d...and=DeviceList (which spits out a list of known devices and their serial number but NOT in JSON format as mentioned by other members, in html format. I'm wondering if this is because I've got a different version and/or software/firmware version on my supervisor?)

    example output:


    best free photo upload sites

    or another nifty URL:

    http://sunpowerconsole.net/cgi-bin/d...ber=########## (where one replaces the ########## with one of the serial numbers from the above URL. Here again, the information is presented in HTML format and not JSON format.)

    example output:


    best free photo upload sites

    The problem I'm having is that one cannot simply just wget/curl/lynx/etc. to these URLs because they have an AJAX "Loading..." screen. It is pretty fast, but if on tries to say 'lynx' to one of those URLs, you'll end up with:


    best free photo upload sites

    Hence me mentioning 'something with an AJAX capable browser above.

    So my question: do any of you see that 'Loading...' on yours? I'm looking at some sort of PhantomJS (or other headless browser) solution to retrieve data from my CLI Rasp Pi and store/present/alert how I'd like to. Too bad, it was THIS close to being simple:

    ->||<-

    Am I overlooking anything, or does that seem to be the best approach?

    Leave a comment:


  • JJNorcal
    replied
    DanKegel, just now seeing this. I must have missed a solarpaneltalk email indicating thread update. Sorry.

    I just now changed "View and edit files in this project" to "Everyone with access" and enabled "Allow users to request access". Hopefully you can find a way in now (the repo has always had Public visibility) . Perhaps you have another suggestion where I can post current snapshot of files, but note that I have been checking in updates into this repo.

    Leave a comment:


  • DanKegel
    replied
    Originally posted by JJNorcal
    And yes, I pushed the code. You prob need to create a gitlab account. It's free. Let me know if you have an account and can't access. I'm new to gitlab...
    I have an account, and can't access gitlab.com/JJNorcal/SpPvoConnector... well, I can, but all it shows me is that there is a project.
    gitlab.com/JJNorcal/SpPvoConnector/settings/members lists you as the only person with access.

    You may have to open up access or grant me membership...

    Leave a comment:


  • JJNorcal
    replied
    Some final thoughts.

    I started by capturing all http (not just SP) packets to avoid dealing with specific IPs. This worked fine over powerline with two port pi (built-in enet + USB adapter). I added second USB adapter once I discovered that I need to deal with wifi. At this point I ran into tcpdump buffering issues (due to increased http traffic) which I was unable to overcome, so I reserved two DHCP IPs for the two SP macs, and the three port pi switch (built-in enet connected to powerline, USB1 to wifi, and USB2 to my home router) is performing fine.

    I'm getting 60 Mbps throughput through the pi 3 (I get 225 Mbps over wire). My 802.11n wifi is somewhat faster than that (I can get over 100Mpbs on a good day in some rooms), but I can't tell the difference and my family is blissfully unaware of the new bottleneck. That said, burning wifi bandwidth without cause goes against my nature, so I'm likely going to take the port mirroring approach at some point, maybe when I upgrade my AP. But I'm leaving this as is for now.

    Would have been better if I pushed SP to install enet cable.

    Leave a comment:


  • JJNorcal
    replied
    Yes, they have two different network interfaces (three, I think, if you count cellular which I'm not sure is active). And yes, I pushed the code. You prob need to create a gitlab account. It's free. Let me know if you have an account and can't access. I'm new to gitlab...

    Leave a comment:

Working...