Why can't I pull the data off my LAN?

[MarkRS-UK]

The inverter data already flows through my router on its way out to China, so why can't that be caught to power this?

My (H1) inverter already has the installer's WiFi gizmo set up (I assume that's standard) to link to my house LAN so the data should be there already, shouldn't it?

Having said that, I don't even seem to be able to find the data with WireShark. I know the ipv4 address and MAC address but filtering for those shows me nothing but ARP notifications. I'm a software guy not a comms guy :(

[canton7]

You can (see https://github.com/nathanmarlor/fox-local/ for a proof of principle), but:

1. Intercepting the traffic from another device on a network typically is not trivial. Some routers support this, but the vast majority of home devices do not. Even on routers which do, most users won't have the skills to set this up.
2. AFAIK the inverter only sends data to foxcloud every 5 mins, and one of the big advantages of avoiding foxcloud is that you can get more up-to-date data. If you're happy with data every 5 mins, just use https://github.com/macxq/foxess-ha to read data from foxcloud, rather than intercepting it en route to foxcloud.

[canton7]

Having said that, I don't even seem to be able to find the data with WireShark. I know the ipv4 address and MAC address but filtering for those shows me nothing but ARP notifications. I'm a software guy not a comms guy :(

Yeah, your router won't send data from/to the inverter to your computer -- why would it? You'll only see broadcasts, and traffic explicitly directed to your machine.

[nathanmarlor]

Beat me to it 😅

[MarkRS-UK]

Thanks both.
You're right, if nothing else the five minute thing kills the idea. I wasn't thinking clearly, sorry.

[nathanmarlor]

It's basically encapsulated modbus data, albeit with less available registers than the native 485 port. See PoC here -> https://github.com/nathanmarlor/fox-local

You'll need to NAT traffic from your inverters dongle to the container.

[canton7]

Ouch. How does it authenticate against foxcloud? Is there any authentication at all, or does it just go "this is from dongle XYZ, please believe me"?

[nathanmarlor]

Unfortunately the latter - if someone knows your inverter/dongle serial number they can send in whatever measurements they like.

More worryingly, it also opens up the system to a drive by style attack - most dongles have static AP keys, it wouldn't take much to rejoin it to a temporary network, NAT the traffic and you basically have full local control of the inverter and batteries (including all safety parameters). Unlikely but relatively trivial.

[canton7]

Yeah I'm aware of the AP issue, but that at least does require someone snooping around quite close to my house. I'm a bit more concerned about someone just enumerating the data loggers from the comfort of their own home. I doubt there's any rate-limiting or anything

[calum-mcfarlane]

See, this kind of amateur hour nonsense is what made me look at HA in the first place (I didn't know about any specifics, but I assumed there would be Something Awful lurking in there, to say nothing of availability and reliability).

Presumably @nathanmarlor you just plug the dongle in if you need to upgrade the firmware and then disconnect it afterwards?

[jamesog]

Reading that properly, I'm a bit rather scared that I don't see any TLS anywhere?

I used to work for a large CDN that had presence in China. I can tell you that TLS is definitely not standard inside China. Internet inside China is basically... not the normal Internet.