Well, I did manage to intercept the traffic by redirecting DNS to servers it’s trying to connect via setting hostnames to:
dc1-3-iothub-02.azure-devices.net
gateway-prod-gw-northeurope-1-g2.northeurope.cloudapp.azure.com
(then restarting the boiler)
to my mitmproxy, but it’s all encrypted. It’s MQTT protocol with SSL, so unless someone gets their hands on on Viessman certificates or finds a way how to respect e.g. mitmproxy certificates, we are out of luck knowing what’s inside it.
mitmproxy logs:
[09:28:15.511][192.168.0.209:57921] client connect
[09:28:15.543][192.168.0.209:57921] Client TLS handshake failed. The client does not trust the proxy's certificate for dc1-3-iothub-02.azure-devices.net (tlsv1 alert unknown ca)
[09:28:15.544][192.168.0.209:57921] client disconnect
and tcpdump -i br-lan -n host 192.168.0.209 and not port 22 from my router:
09:28:36.031226 IP 52.156.218.86.443 > 192.168.0.209.57928: Flags [P.], seq 4961:5671, ack 599, win 63, length 710
09:28:36.031318 IP 52.156.218.86.443 > 192.168.0.209.57928: Flags [F.], seq 5671, ack 599, win 63, length 0
09:28:36.041653 IP 192.168.0.209.57928 > 52.156.218.86.443: Flags [.], ack 5672, win 12287, length 0
09:28:36.049235 IP 192.168.0.209.57928 > 52.156.218.86.443: Flags [F.], seq 599, ack 5672, win 12287, length 0
09:28:36.052895 IP 192.168.0.209.60179 > 192.168.0.1.53: 3921+ A? dc1-3-iothub-02.azure-devices.net. (51)
09:28:36.053304 IP 192.168.0.1.53 > 192.168.0.209.60179: 3921* 1/0/0 A 192.168.0.195 (67)
09:28:36.083664 IP 52.156.218.86.443 > 192.168.0.209.57928: Flags [.], ack 600, win 63, length 0
09:28:41.105851 IP 192.168.0.209.4222 > 192.168.0.1.53: 44590+ A? mgmt.viessmann-platform.io. (44)
09:28:41.112028 IP 192.168.0.1.53 > 192.168.0.209.4222: 44590 2/0/0 CNAME mgmt-global-1-waf-2.northeurope.cloudapp.azure.com., A 52.156.218.86 (124)
09:28:41.116046 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [S], seq 24734, win 24576, options [mss 1460,nop,wscale 1], length 0
09:28:41.152489 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [S.], seq 601248823, ack 24735, win 64240, options [mss 1440,nop,wscale 10], length 0
09:28:41.155586 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [.], ack 1, win 12288, length 0
09:28:41.157320 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [P.], seq 1:184, ack 1, win 12288, length 183
09:28:41.193447 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [.], ack 184, win 63, length 0
09:28:41.202836 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [.], seq 1:1453, ack 184, win 63, length 1452
09:28:41.203074 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [P.], seq 1453:2905, ack 184, win 63, length 1452
09:28:41.203304 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [P.], seq 2905:4097, ack 184, win 63, length 1192
09:28:41.203418 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [P.], seq 4097:4687, ack 184, win 63, length 590
09:28:41.238661 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [.], ack 2905, win 11562, length 0
09:28:41.279523 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [.], ack 4687, win 11986, length 0
09:28:41.783994 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [P.], seq 184:259, ack 4687, win 11986, length 75
09:28:41.862484 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [.], ack 259, win 63, length 0
09:28:41.865787 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [P.], seq 259:310, ack 4687, win 11986, length 51
09:28:41.901736 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [.], ack 310, win 63, length 0
09:28:41.901970 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [P.], seq 4687:4961, ack 310, win 63, length 274
09:28:41.910804 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [P.], seq 310:599, ack 4961, win 11849, length 289
09:28:41.958755 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [P.], seq 4961:5423, ack 599, win 63, length 462
09:28:41.958847 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [F.], seq 5423, ack 599, win 63, length 0
09:28:41.967685 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [.], ack 5424, win 11618, length 0
09:28:41.974815 IP 192.168.0.209.57930 > 52.156.218.86.443: Flags [F.], seq 599, ack 5424, win 11618, length 0
09:28:42.010758 IP 52.156.218.86.443 > 192.168.0.209.57930: Flags [.], ack 600, win 63, length 0