Cannot access device over network interface. Now what?

Question

I made a really dumb mistake today.

I bought a network camera a few days ago from some reseller on eBay, and it's running embedded Linux. I'm not sure what I did, but I edited /etc/network/interfaces, rebooted, and now the device is no longer taking an address from DHCP.

There really aren't any other obvious ways to access it. The device has: an Ethernet in and a power in. The board itself is almost entirely unlabeled, so I'm stumped. All I know is that lsusb had returned two unused ports (I'm guessing it would be for a wireless interface over USB, considering it had all the files for wireless, just not an interface) and the flash memory is on-chip. What do I do now? Did I just brick it?

If I did: agh.

I tried a crossover cable; it did not work. Plugged it in, no response. Checked Wireshark and it was a ghosttown, except for me. Here are a couple images:

The area on the underside of the board is the CMOS sensor and lens apparatus. The second board underneath has no connection to the mainboard except for power. I wasn't expecting the CMOS sensor to be so exposed, so when I lifted the top board, I shivered in fear!

Please keep the content of your question safe for families (the "If I did" part) — miniBill, Mar 11 '14 at 05:52
Can you add a model number? If it's custom device, how about an image of the pcb in case there are some potential reset jumpers. — jdh, Mar 11 '14 at 14:49
There is no visible model, unfortunately. I did upload a few images and can take more if needed. — Kevin Evans, Mar 12 '14 at 01:05
You didn't happen to note down what you changed in /etc/network/interfaces did you ? — Lawrence, Mar 13 '14 at 06:25
I could be wrong, but it looks like it has JTAG availability. — AWippler, Mar 14 '14 at 18:37
@AWippler - it is hard to for me to say as well, but I think it's a definite possibilty. I wonder if those two sections of 4 pins each could be tested with serial connection wires, to me it looks like 1 ground and 3 live pins each. Wish I could see a model name for the board or under those stickers. — That Realtor Programmer Guy, Mar 20 '14 at 03:27

score 1 · Answer 1 · answered Mar 18 '14 at 22:01

1

2 ideas for you: 1) Look for a "reset to factory defaults" switch or button or anything that can be shorted or pressed :) 2) Ask the seller the name and password of wifi network he used to connect it to, then duplicate it on your router. It's likely that you only killed wired, not wifi interface and old settings might still be there

answered Mar 18 '14 at 22:01

Alec Istomin

629
6
10

There doesn't seem to be anything that I can press or jump on the board. I asked the seller a few days ago for any information, but to no avail. There is no wireless on the device. :( – Kevin Evans Mar 19 '14 at 14:11
Disassemble (maybe there is something on the other side of the board) and then start shorting literally everything... :) – Alec Istomin Mar 19 '14 at 23:00

score 1 · Answer 2 · answered Mar 20 '14 at 02:51

Well shoot!

With your cross-over cable you could take a computer off your network such that it's only hooked up to your camera. Then run a full ip scan with nmap.

nmap -T4 -A -v 0-255.0-255.0-255.0-255 >> IP_Scan.results

This should scan -every- possible ip and port for notable results. Now this will take a while, but shouldn't be a few weeks like it would be on the real internet,... and I'd highly suggest trying at least these two rational ranges on their own first (there's a middle one, too, but I always forget it,...):

nmap -T4 -A -v 10.0-255.0-255.0-255 >> IP_Scan.results

nmap -T4 -A -v 192.168.0-255.0-255 >> IP_Scan.results

You'll also want to check the self-assigning range of 169.254.0-255.0-255 in case the network interface defaults to such a thing.

I'm not actually positive you need, or even want, to use a crossover cable for this but it makes the most sense to me at time of writing. You probably want to check with two computers that have known IPs first to ensure you're getting results back at all with your setup.

Anyway once the scan is complete, you can check open up the IP_Scan.results (or whatever you've named it) file to see what IPs and ports exist. You should then be able to find out what the IP of the camera is at.

Once you've got one or more IPs, run nmap as root on them to find the MAC address - but you'll probably have to force your computer to be on that same network first. You may need to fix up your laptop/desktop as a router or gateway itself on the same subnet you find existing on the device. This way you can trick both devices into being networked and communicate valid packets; though it might need some further coercion.

score 0 · Answer 3 · answered Mar 19 '14 at 09:31

0

Maybe you gave the device a static IP in a different subnet than the one you are looking in. Do the switch LEDs blink when you jack the device in ? If yes, there´s network traffic and you can use a network monitoring tool to sniff out the packets sent by the device, aswell as the subnet it´s broadcasting in.

answered Mar 19 '14 at 09:31

Jannis Alexakis

251
1
3

They blink on the device's ethernet, but when I use Wireshark, it does not display any information coming from the device (it only displays packets coming from my computer). – Kevin Evans Mar 19 '14 at 14:13

Cannot access device over network interface. Now what?

3 Answers3