My 2cts about network and AISCatcher

[Phil353556]

Hi,
I use aiscatcher since a few weeks and I discover that this a great software tool developped and managed by a kind person @jvde-github, (thanks!) I also discover a community.

I should like to share some points about network, as one site feeded by the receiver considers the receiver as offline, or the receiver is up and running.

My system is raspberry pi 4 with a SDR dongle and a very basic antenna
OS: Debian GNU/Linux 12 (bookworm) aarch64
Host: Raspberry Pi 4 Model B Rev 1.4
Kernel: 6.6.20+rpt-rpi-v8
Shell: bash 5.2.15
CPU: (4) @ 1.800GHz
Memory: 114MiB / 1846MiB
fyi, the program neofecth is ran at the end of the login, thanks to the file .bashrc, and displayed of these information.

I first use ss command (ss: another utility to investigate sockets)

IP address 192.168.1.39 is the IP of the raspberry pi.
TCP connexions seeing(last three lines):
-one for the webserver on port 8383, listening incoming connection [ 0.0.0.0:8383 ],
-one for the webserver port 8383, and the browser which is connected to,
-the last line is the connection between the pi (aiscatcher program) and aiscatcher.org on port 4242
the address 185.77.96.227 and the port 4242 are hardcoded in the program [ sources are in the two files ./Application/Config.cpp and /Application/Main.cpp ] "p.Set("HOST", "aiscatcher.org").Set("PORT", "4242").Set("JSON", "on").Set("FILTER", "on").Set("GPS", "off");"

However ss command seems not the right command to "see" udp connections.
So the network swiss knife tool must be use, named wireshark.
Here the program tshark is used, the same but cli only.
I create a simple script to scan the four sites.
Duration in second,is the number of second the program will run.

> #!/bin/bash
> 
> AC="185.77.96.227"
> MT="5.9.207.xxx"
> VF="195.201.71.xxx"
> SX="31.172.90.xxx"
> DURATION=10
> 
> for TARGET in $AC $MT $VF $SX
> do
>  echo " ----------------------------------------------------------------------"
>  case $TARGET in
>  185.77.96.227) echo " AIS Catcher: ${TARGET}"
>         ;;
>  5.9.207.xxx) echo " Marine Traffic: ${TARGET}"
>         ;;
>  195.201.71.xxx) echo " Vessel Finder: ${TARGET}"
>         ;;
>  31.172.90.xxx) echo " ShipXplorer: ${TARGET}"
>         ;;
>  esac
>  tshark -a duration:${DURATION}   -t ud 'not tcp port 22' and "host ${TARGET}"
> done

first with AISCatcher, clear connection and TCP exchanges. Note the ACK it means that data is sent, well received, so there is an acknoledge to the sender (aiscatcher program):

then with Marine Traffic, this is UDP so AISCatcher sends data and hope the data is well received and processed

Same for Vessel Finder, UDP

And same for ShipXplorer, UDP too

Yeah the issue is there: "ICMP 119 Destination unreachable (Port unreachable)"

however as ShipXplorer sees the receiver as offline, what is the real status?
Ok, I know my receiver is up and running, and three sites (AISCatcher, MarineTraffic and VesselFinder) well receive the data, but how to demonstrate the issue is on ShipXplorer side?,
simple with tshark command

Ok let's go a little bit further
run the command again and capture the network data in a file, using the -w parameter with the name for a file.

tshark -a duration:10 -w shipxplorer.pcapng -t ud 'not tcp port 22' and "host 31.172.90.245"

Get the file and load into the wireshark program, then click on any line with an error, something similar to the screenshot hereunder is displayed. Note that data ("!AIVDM,1,1.....) sent by aiscatcher is sent back too.

using the engine https://startpage.com with the error message
found: https://datatracker.ietf.org/doc/html/rfc792
then:

That's good, the issue is on the server side, not the raspberry pi.

happy network
Philippe

Reference:
TCP is a more reliable connection than UDP
https://www.spiceworks.com/tech/networking/articles/tcp-vs-udp/

[jvde-github]

Nice write up. For consideration, you can also feed MarineTraffic via TCP, e.g. using -P. Seems to be working well in my set up.

[Phil353556]

Ah yes, you're right, of course :-)
I re read the mails received from websites
Marine Traffic indicates : UDP and TCP
The two others Vessel Finder and ShipXplorer only UDP
Thank you

[jvde-github]

I was wondering if we can let the program display these errors so embed your approach in catcher but it seems can only be done with root privilege. So your route seems the most advisable then. Thanks for sharing!

cheers Jasper

[Phil353556]

The tests have been as a lambda user not root. As all the ports numbers are above 1024 root privilege is not required.
If tshark is run with root, there is a clear message "Running as user "root" and group "root". This could be dangerous."

Philippe