Smartphone Radar - Smartphone presence detection (Locked)

[hamw]

Thanks, that seems to have done the trick. The line is in the instructions on the first page:

Using port 514
Some routers do not let you specify a port for the syslog service. Apple's router products are in this category. To work around this issue you'll need to make a few changes to the syslog service already running on your mac. We basically need to tell it to accept your router's logs on port 514, then forward everything to port 1514 for Smartphone Radar to sift through.

Thanks to lharris9 for this tip. Various users have reported success using this. For Apple routers set the log level of syslog to "5 - Notice".

First tell syslog to accept logs from other devices:
http://superuser.com/questions/131578/h ... d-from-rem

Now tell it to forward the logs to itself at port 1514. See the link below. But use the following line in step 4:
CODE: SELECT ALL
*.* @127.0.0.1:1514

http://www.splunk.com/wiki/Community:Ho ... rward_Data

How do we tell if AEBS is sending the appropriate log files to SPR?

[hamw]

OK, so I think we have success. I went to Airport Utility and entered syslog in the search box. It came up with the "Logging and Statistics" page. I entered the mini's static IP in the "Syslog Destination Address" box, reset the AEBS and restarted Indigo. Now we have:

Code: Select all

 

--turned on WiFi on iPhone
PowerLinc address 0F.9C.5C, firmware version 9.2
  Smartphone Radar                Router Log: <133>Jun 12 23:17:07 10.0.1.1 main-base-00-xxxxxxxxx: Associated with station 00:26:XXXXXXX

  Smartphone Radar                Router Log: <133>Jun 12 23:17:07 10.0.1.1 main-base-00-xxxxxxxxx: Installed unicast CCMP key for supplicant 00:26:XXXXXXX


--turned off WiFi on iPhone
  Smartphone Radar                Router Log: <133>Jun 12 23:17:13 10.0.1.1 main-base-00-xxxxxxxxx: Disassociated with station 00:26:XXXXXXX

  Smartphone Radar                Router Log: <133>Jun 12 23:17:13 10.0.1.1 main-base-00-xxxxxxxxx: Rotated TKIP group key.


--turned on WiFi on iPhone
  Smartphone Radar                Router Log: <133>Jun 12 23:17:20 10.0.1.1 main-base-00-xxxxxxxxx: Associated with station 00:26:XXXXXXX

  Smartphone Radar                Router Log: <133>Jun 12 23:17:20 10.0.1.1 main-base-00-xxxxxxxxx: Installed unicast CCMP key for supplicant 00:26:XXXXXXX


--turned off WiFi on iPhone
  Smartphone Radar                Router Log: <133>Jun 12 23:17:23 10.0.1.1 main-base-00-xxxxxxxxx: Disassociated with station 00:26:XXXXXXX

  Smartphone Radar                Router Log: <133>Jun 12 23:17:23 10.0.1.1 main-base-00-xxxxxxxxx: Rotated TKIP group key.

and:

Code: Select all

 Smartphone Radar                "Phone Ham" state is now Home.
  Smartphone Radar                All smartphones are now Home.
  Smartphone Radar                Router Log: <133>Jun 12 23:28:30 10.0.1.1 main-base-00xxxxxxxxx: Installed unicast CCMP key for supplicant 00:26xxxxxxx

Thanks, Travis, for developing this neat solution!

[travisc]

Just got in. I was just writing a reply to ask you if you entered your mac-mini's IP address in your Airport Utility when you responded you already did. That should do the trick.

The reason I wrote *.* for the syslog setup on the main post was because local0.notice will likely not work for non-apple routers. Different routers use different facilities, Apple seems to have standardized on local0, but this is likely not the case for other vendors. *.* tells syslog to forward all the log facilities, the only disadvantage is Smartphone Radar gets more data to sift though.

For users of other routers, I'd recommend always starting with *.*. If you want to optimize things, then once things are working, open your Console app and find some log entries from the router. Enable Viewing of the Facility column in the View menu. That will show you the facility name your router is using which will allow you to filter them out so only they are forwarded to Smartphone Radar. So for example if your facility said "firewall", you'd use the following line in the syslog config:

Code: Select all

firewall.* @127.0.0.1:1514

Thanks, Travis, for developing this neat solution!

Your welcome. Thanks for the feedback, glad you got it working!

[loafbread]

travisc
Thank you for this plugin. I have been using it for a couple days now and it works great. I configured my CentOS Linux router to log dhcpd requests to Smartphone Radar. It has been working great. I will be deleting my hacked together ping, DNS, twitter scripts soon and relying on Smartphone Radar.
Thanks again
loafbread

[travisc]

travisc
Thank you for this plugin. I have been using it for a couple days now and it works great. I configured my CentOS Linux router to log dhcpd requests to Smartphone Radar. It has been working great. I will be deleting my hacked together ping, DNS, twitter scripts soon and relying on Smartphone Radar.
Thanks again
loafbread

That's great, thanks!

If you ever notice Smartphone Radar thinking your phones are away when they really are home, it might be because the iPhone is not doing the DHCP every time it connects. When I tested this it was a previous version of iOS, things may have changed by now. But legally the iPhone can usually assume it's leased the address for 24 hours depending on the router's settings. Most of the time it would re-lease every time it connects to the WiFi, but sometimes it wouldn't. To get around that I upped the log level so all network traffic was logged. That can add up to a LOT of logging! I researched a little iptables trick to reduce that. The following iptables command forced my router to log any of activity from my iPhone at most once a minute:

Code: Select all

iptables -I FORWARD -s Travis-iPhone -m limit --limit 1/minute --limit-burst 1 -j LOG

I used this in the Firewall script tab on my Tomato router. But it should work on any linux box that uses iptables.

Thanks for the feedback loafbread.

[hamw]

Yes, it seems SPR thinks the phones go away if they have not been activated for a half hour or whatever. Is there a similar workaround we can use for the AEBS to keep SPR correct?

[travisc]

Yes, it seems SPR thinks the phones go away if they have not been activated for a half hour or whatever. Is there a similar workaround we can use for the AEBS to keep SPR correct?

Make sure your phone is set to check email every 15 minutes. I'm not sure if push email accounts poll the server at all, IMAP and POP do for sure. SPR relies on this polling activity in the log to reset the timers. If that's not the prob, maybe your AEBS is only logging DHCP requests and not normal network activity, try increasing the log level on your AEBS so it logs more activity.

[loafbread]

hamw,
What type of information are you seeing in your AirPort Extreme log? I was not able to use my AirPort Extreme with SPR because all it logged was the wireless association information and that did not happen often enough. Maybe yours logs more because you are using it as a router, mine is used only as a bridged access point.

[hammer32]

Last night while my wife's iPhone was plugged into her Mac and mine was plugged in to the wall SmartPhone Radar stopped detecting them. I was surfing the web and getting email over wifi, so at least my iPhone was still connected to the TimeCapsule.

I've got Indigo set to send an email when both phones are set to "away", so as far as I can tell this is the first time in the 5 days I've been running SMR that this has happened. I'm not sure how to troubleshoot this, are there any logs I should check?

Thanks!

[travisc]

Last night while my wife's iPhone was plugged into her Mac and mine was plugged in to the wall SmartPhone Radar stopped detecting them. I was surfing the web and getting email over wifi, so at least my iPhone was still connected to the TimeCapsule.

I've got Indigo set to send an email when both phones are set to "away", so as far as I can tell this is the first time in the 5 days I've been running SMR that this has happened. I'm not sure how to troubleshoot this, are there any logs I should check?

Thanks!

Turn on the "Show Router Log" option in SPR. Then watch your Indigo events log and use your phones, check your email, surf the web, etc. If you only see one or two entries when you start using the phone that's no good. You want to continuously see log activity for your phone each time you surf to a new website, each time it checks email, etc. You can try to increase the log level in your Time Capsule to get this data. If that doesn't work, then you might be stuck. As loafbread said, maybe the Apple routers just refuse to log connection activity.

[hamw]

I have the sneaking suspicion that the AEBS may simply not allow iPhone presence monitoring without a kludgy workaround like the text solution we tried before. Has the Tomato router been totally accurate with the phones idle?

If so, is there a recommended router that's easy to set up (with some help..... )?

[Swancoat]

UPDATED (JUN 10):
First tell syslog to accept logs from other devices:
http://superuser.com/questions/131578/h ... d-from-rem

Uh, can someone tell me how to do this with more detail?

I'm following the instructions. I didn't have permission to edit that file, so I gave myself permission, but it still won't let me save the changes. How do I edit it?

[Swancoat]

Ok, I'm not exactly sure how I botched this (Probably shouldn't have tried given that I know approx 0 about using the command line).

Anyway, I figured out via google how to edit the plist... which is copy the file, edit, and replace the original - which worked (sort of... more on this later).

Then I headed off to tell it to forward the logs to itself at port 1514. This is where it gets messy. On the step which tells me to unload (and then load) the plist file, I get:

Code: Select all

launchctl: Dubious ownership on file (skipping): /System/Library/LaunchDaemons/com.apple.syslogd.plist
nothing found to unload

Now, going back to the plist, since I edited it in the finder, the permissions are messed up and not the same as they were originally. (They now only list me as the owner. No 'system' or 'wheel' or anything.

Did I screw myself here somehow?

[Swancoat]

Ok. So I ran disk utility and repaired the permissions. That seemed to have done something. Router logs are showing up in my Indigo log.

So a lot of this seems to be working. Unfortunately, it's not detecting my phone. I've picked it up and loaded new web pages. Nothing.

[Swancoat]

My problem now seems similar to those above (I'm running Apple Airport Express Base Station). I have logs, but no phone connection stuff.

Code: Select all

Smartphone Radar                Router Log: <133>Jun 17 23:31:43 10.0.1.1 attic-extreme ether: (WAN) link state is Up.

  Smartphone Radar                Router Log: <133>Jun 17 23:31:43 10.0.1.1 attic-extreme natpmp: Binding added for udp, 0.0.0.0:32769 to 10.0.1.9:4500 with lifetime 7200

  Smartphone Radar                Router Log: <133>Jun 17 23:31:43 10.0.1.1 attic-extreme natpmp: Binding added for udp, 0.0.0.0:32770 to 10.0.1.9:5353 with lifetime 7200

  Smartphone Radar                Router Log: <133>Jun 17 23:31:43 10.0.1.1 attic-extreme natpmp: Binding added for udp, 98.199.236.87:32769 to 10.0.1.9:4500 with lifetime 7200

  Smartphone Radar                Router Log: <133>Jun 17 23:31:43 10.0.1.1 attic-extreme natpmp: Binding added for udp, 98.199.236.87:32770 to 10.0.1.9:5353 with lifetime 7200

  Smartphone Radar                Router Log: <133>Jun 17 23:31:43 10.0.1.1 attic-extreme dhcpc: Internet configuration leased [IPv4] -- host <98.199.236.87/255.255.248.0> gateway <98.199.232.1> dns <68.87.85.102 68.87.69.150> wins <> lease <225679> domain <hsd1.tx.comcast.ne

  Smartphone Radar                Router Log: <133>Jun 17 23:31:44 10.0.1.1 attic-extreme admin: Connection accepted from [fe80::21b:63ff:fe95:fc9e%bridge0]:49425.

  Smartphone Radar                Router Log: <133>Jun 17 23:31:44 10.0.1.1 attic-extreme admin: Connection accepted from [fe80::21b:63ff:fe95:fc9e%bridge0]:49424.