1

My router (Unifi UDM-SE) has a honeypot configured which is capturing a scan from the iPhone about twice per day. I would like to figure out which App is doing this. I have followed the instructions on this post (Detecting port scanning activity of a mobile app) and have Wireshark capturing packets from the iPhone but can't determine which applications are generating the traffic. Is this the best way and how do I determine the culprit application or is there a better way to find the rogue app?

3
  • 1
    This question needs a lot more information, like what sort of traffic and how many endpoints. It might just be a Bonjour discovery, quite legitimate. Commented May 28 at 13:16
  • Hi @AndyGriffiths sorry for the lack of clarity. It's HTTP traffic on Port 80 that is all the Honeypot is reporting. It identifies the IP the request is coming from (my iPhone) and the IP (the HoneyPot) that it is trying to reach. I have about 25 endpoints on the network(s) two separate VLANS. The VLAN that the iPhone is on is supposed to be isolated from the VLAN (main default network) the Honeypot is on but somehow the request is getting to the Honeypot. I assume it is a network scan by an app looking for open ports on the network Commented May 28 at 16:00
  • Apps don’t run in the background so if this timing is regular, it probably is the OS
    – bmike
    Commented May 28 at 17:45

1 Answer 1

3

In Settings > Privacy & Security > Local Network, you can see the list of apps that have permission to access the network. Turn off those settings one at a time to isolate the one responsible.

I used this suggestion after the follow-on suggestions of using a binary search vs one at a time

8
  • I thought about doing that but given on the number of apps the have local network access (any app that needs to get Wifi credentials needs Local Network access - don't know why it's that way) and the frequency of the network scans (2-3 /day) it will take a long time to isolate the responsible app so I was hoping for a more efficient method. Was hoping that there would be a way to ID the app from the Wireshark traffic monitoring Commented May 28 at 15:55
  • @globaltechsoul Once it's out of the iPhone there's no way of knowing which app it came from, no more than you could find out if it were coming from any other IP device. You need to be able to track that traffic directly on the iPhone, and I don't think there's a way to do that. You may want to look at the iPhone logs (you can see them with Xcode or in the console on a Mac), there may be errors logged for the failed connections.
    – jcaron
    Commented May 28 at 16:56
  • 4
    Apps most certainly don’t need local network access just to use WiFi networking. I would turn them off split half search style until you can know if it’s the OS or an app.
    – bmike
    Commented May 28 at 17:47
  • 1
    Another possibility is that iOS itself is probing the network. I don't know whether it does that, but you can find out by disabling all apps from local network access and testing.
    – Linc D.
    Commented May 28 at 18:16
  • 2
    @globaltechsoul you could do a binary search; disable half the list, if it still happens, it's from the other half - repeat with half the new list. Even with 500 apps, it would only take log2(500) = ~9 steps.
    – Ari Lotter
    Commented May 28 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .