topic Re: wowzachild.netgear.com in Arlo

wowzachild.netgear.com

marademha — Sat, 13 Jul 2024 01:28:40 GMT

My device uploaded to wowzachild.netgear.com is this normal? I have not seen the before

Re: wowzachild.netgear.com

StephenB — Sat, 13 Jul 2024 12:05:54 GMT

@marademha wrote:

My device uploaded to wowzachild.netgear.com is this normal? I have not seen the before

What device?

That site doesn't exist.

Re: wowzachild.netgear.com

marademha — Sat, 13 Jul 2024 12:52:21 GMT

I have 2 Arlo pro 4s

Re: wowzachild.netgear.com

StephenB — Sat, 13 Jul 2024 13:02:04 GMT

@marademha wrote:

I have 2 Arlo pro 4s

And what exactly was uploaded?

If you use a DNS lookup tool, you will find that wowzachild.netgear.com doesn't exist. So it is not possible to upload anything to it. There is a wowzachild.arlo.com. Not sure exactly how that is used, but it appears to be something to do with docusign.

Re: wowzachild.netgear.com

marademha — Sat, 13 Jul 2024 13:16:46 GMT

My firewall says both cameras uploaded around 1mb of data on 2 occasions. This has only happened in the last few days. The typical upload locations of the camera are whitelisted

Re: wowzachild.netgear.com

marademha — Sat, 13 Jul 2024 13:21:08 GMT

Looking further they have uploaded up to over 200mb in the last 24 hours

Re: wowzachild.netgear.com

TomMac — Sat, 13 Jul 2024 13:55:57 GMT

Listed here ;

https://www.shodan.io/host/52.50.127.92

as in an SSL certificate;

SSL Certificate

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=California, L=San Jose, O=Netgear, Inc., OU=IT, CN=wowza.netgear.com
        Validity
            Not Before: Aug 12 22:36:30 2016 GMT
            Not After : Aug  6 22:36:30 2041 GMT
        Subject: C=US, ST=California, L=San Jose, O=Netgear, OU=IT, CN=wowzachild.netgear.com

The IP listed in his window comes back to Amazon services

Re: wowzachild.netgear.com

StephenB — Sat, 13 Jul 2024 14:19:56 GMT

@marademha wrote:

My firewall says both cameras uploaded around 1mb of data on 2 occasions. This has only happened in the last few days. The typical upload locations of the camera are whitelisted

No idea where the firewall got that domain name, since the three DNS lookup tools I tried said all there is no such host. The DNS entry for wowzachild.arlo.com isn't tied to an IP address, it appears to be a docusign ID of some kind. You can check all this yourself if you like.

The 54.245.252.251 IP address is assigned to an Amazon AWS server. I tried doing a reverse IP lookup with that address and just got the expected ec2-54-245-252-251.us-west-2.compute.amazonaws.com

Re: wowzachild.netgear.com

marademha — Sat, 13 Jul 2024 14:48:05 GMT

This is the history, I recognise my devices connecting to these other servers as legitimate.

I understand your information above.

So why would the devices be doing this?

Re: wowzachild.netgear.com

marademha — Mon, 15 Jul 2024 00:53:44 GMT

If I block the domain with my firewall the Arlo cameras stop working.

How do I get Arlo to confirm these are legitimate requests.

Re: wowzachild.netgear.com

StephenB — Mon, 15 Jul 2024 10:56:34 GMT

@marademha wrote:

If I block the domain with my firewall the Arlo cameras stop working.

How do I get Arlo to confirm these are legitimate requests.

Contact Arlo support. This is bizarre since the hostname doesn't exist in DNS. The old SSL cert you found goes back to the time when Arlo was part of Netgear. But that hasn't been the case since 2018.

I don't think tier 1 support will be able to help, you'll probably need to get it escalated to tier 3.

I'm tagging the mods - @JamesC , @ShayneS , @BrookeN - to call their attention to your question.

Re: wowzachild.netgear.com

BrookeN — Mon, 15 Jul 2024 18:29:09 GMT

I am looking into this. I will update you as soon as possible.

Re: wowzachild.netgear.com

BrookeN — Wed, 17 Jul 2024 20:36:21 GMT

Can you please get your Pro 4 back online so we can download the device logs?

Re: wowzachild.netgear.com

marademha — Wed, 17 Jul 2024 22:58:44 GMT

How do I provide you the logs?

Re: wowzachild.netgear.com

marademha — Wed, 17 Jul 2024 22:59:23 GMT

Sorry also , do you require my firewall stilling blocking or not

Re: wowzachild.netgear.com

jguerdat — Thu, 18 Jul 2024 11:54:45 GMT

The logs would be on the server, not your camera. I would expect that the firewall should not be blocking so the system is working normally.

Re: wowzachild.netgear.com

marademha — Sat, 20 Jul 2024 13:06:39 GMT

Ok, I have connected them back online. Sorry for delay

Re: wowzachild.netgear.com

Seriously00021 — Sat, 27 Jul 2024 15:14:37 GMT

Did this ever get figured out as I’m having the same issue with the same firewall. Suddenly a week ago (give or take some days) I’m getting a slew of alarms which typically would be due to the destination of traffic having suddenly changed. Has Arlo made any major changes recently? Perhaps running out of an alternative location for DR testing?

Re: wowzachild.netgear.com

StephenB — Sat, 27 Jul 2024 15:18:32 GMT

@Seriously00021 wrote:

Has Arlo made any major changes recently? Perhaps running out of an alternative location for DR testing?

They haven't announced any.

In @marademha's case it is still connecting to an AWS server, and my guess is that is an Arlo server. The puzzle is where the wowzachild.netgear.com domain name is coming from.

Re: wowzachild.netgear.com

marademha — Sat, 27 Jul 2024 15:38:14 GMT

I received the following from Arlo support...

As per Security and FW team, "The devices are in actuality NOT connecting to wowzachild.netgear.com. The router is reporting this due to the certificate on our streaming servers."

Our team are currently working on it to make sure it will display the correct certificate from your end"