6 ms·
Reverse-engineering the UniFi inform protocol
- devmor 7mo ago> ("TNBU" is "UNBT" backwards, presumably UniFi Broadcast Technology.) This seems like an odd misunderstanding, especially because the correct inversion “UBNT” is the default login name for most UniFi web UIs. You might have a bit of dyslexia, OP!
- dwood_dev 7mo agoubnt has been the ubiquiti default login at least back to 2010 when I started using their products, before UniFi was a brand. I always assumed it was short for Ubiquiti Networks.
- hrimfaxi 7mo agoSure, but the parent was saying this part was odd: > "TNBU" is "UNBT" backwards TNBU is clearly NOT uNbt backwards.
- idorosen 7mo agoUsing the network byte ordering (big endian) of UBNT as the magic number in the protocol is a nice touch.
- EvanAnderson 7mo agoI believe they used MIPS processors in their early gear, so that makes sense.
- mikepurvis 7mo agoA lot of companies in that space did then. I was at a robotics company at the time and we experimented with mikrotik routerboards + the various long-range Ubiquiti wifi modules, some of which are even still listed on the website: https://techspecs.ui.com/uisp/accessory-tech/xr https://techspecs.ui.com/uisp/accessory-tech/xr (though not the 900 MHz XR9, which was arguably one of the most interesting for long range comms)
- baconomatic 7mo agoYou might be onto something there! But yes, good catch, I'll get that updated.
- kayfox 7mo agoUBNT stands for UBiquiti NeTworks.
- deleted 7mo ago[deleted]
- voidUpdate 7mo agoIs it just me that pretty much cannot read most of the text in the "Reading the MAC" code block? I don't know if it's because I use dark mode, but some of the text is #24292E on top of #141A16, which for me at least is practically invisible
- baconomatic 7mo agoSorry about that, I typically use light mode, fixed and deployed!
- voidUpdate 7mo agoA million times better, thanks =)
- baconomatic 7mo agoThanks for calling it out!
- scottlamb 7mo agoBit of a thread-jack, but has anyone reverse-engineered the UniFi camera adoption protocol? I was surprised to discover that, unlike the APs, the cameras can't be adopted through the Unifi Software Controller that you can just throw into a Docker container. You're supposed to do that through their NVR appliance (Unifi Protect). I was hoping to just use them with my open-source NVR. They seem to be about the only option for a reasonably priced, larger image sensor camera that is not made by a company participating in the Uyghur genocide (Hikvision, Dahua, Univision, Huawei). I found https://community.home-assistant.io/t/unifi-cameras-without-unifi-protect-solved/904420 https://community.home-assistant.io/t/unifi-cameras-without-... in which someone sshed in, edited some config files by hand, and got streaming to work for the current boot. One could probably take that a bit further and, you know, save the config to flash. But it'd be nice to just do it the way their controller does and know it's going to work for future firmware updates and such. They also stream by connecting to your NVR with modified version of flv, rather than you connecting to them with RTSP, which is annoying but can be worked around.
- ImPostingOnHN 7mo agoIf you want to bypass Unifi Protect, what sort of "adoption" are you thinking of? AFAIK, "adoption" is a Unifi Protect thing. Otherwise it's just a device on your network that you can configure Frigate etc. to connect to and pull streams.
- scottlamb 7mo agoChanging the credentials for web access (firmware upgrade, janky jpeg-based live stream, etc.) and ssh access from the default ubnt:ubnt. Surprisingly, I don't see a page for this in the web UI, and the `password` command in the CLI is ineffective. I haven't looked around the filesystem. Setting where it sends the video stream. Configuring video settings, zone detections, etc. I found a video going through them here: <https://youtu.be/URam5XSFzuM?si=8WK4Yghh9kidZe6c&t=279 https://youtu.be/URam5XSFzuM?si=8WK4Yghh9kidZe6c&t=279> Just about any other camera lets you change this stuff through the camera's built-in web interface and/or ONVIF. Ubiquitis apparently don't. > Otherwise it's just a device on your network that you can configure Frigate etc. to connect to and pull streams. No, it connects to you!
- mrweasel 7mo agoIt seems like a pretty tall order, but I really want an open source access point controller daemon that knows how to provision and manage a wide variety of APs from different manufacturers. So you'd have one services that can provision Ubiquity, MikroTik, TPLink and other APs and manage the clients.
- baconomatic 7mo agoNow that would be interesting! Multi-vendor support is on the radar, but haven't started looking into it much yet.
- myself248 7mo agoAlternately, run OpenWRT on the APs themselves, and then you just need one provisioning protocol.
- blacklion 7mo agoDoes it support seamless roaming of clients between group of APs? Last time I've tried, it was not supported by any open source solution.
- BenjiWiebe 7mo agoWell AFAIK the core seamless roaming in Unifi is using hostapd, which is the same AP software you use on OpenWrt. See 802.11r Fast Transition. I think it should even be possible to get seamless roaming between Unifi and OpenWrt with correct configuration of hostapd.
- riobard 7mo agoSeamless WiFi roaming is mostly a client decision. The best you can do on AP is to: a) optimize signal strength for coverage (stronger signals aren't always better in multi-AP deployment); b) provide hints via 802.11k/v/r to help clients make, hopefully, better decisions; c) forcefully drop and disassociate clients when signal is weak enough. But if the client has bad WiFi implementation, there's nothing much you could do. OpenWRT currently supports 802.11k/v/r, but optimizing coverage by adjusting signal strength and channels is left for experienced users to deal with manually. There is the are where some commercial offerings will do, but the result greatly varies. AFAIK there's no ideal system anyway coz physics is hard.
- ctippett 7mo agoNice trick. Just a heads up that I had to whitelist your domain as NextDNS blocked it for being newly registered. Given this thread will probably attract other Unifi users... has anyone had success migrating from MongoDB to something like FerretDB? I played around with getting this to work a few weeks ago and found that day-to-day it works without issue, but restoring a backup will error since it relies on some unsupported Mongo semantics (renaming collections iirc).
- paulddraper 7mo agoWhat does an admin do about NextDNS blocks?
- bastawhiz 7mo agoIf you subscribe to the mindset of "new domains are likely to be bad" you just deal with a steady stream of allowlist requests from your users until the end of time. There will be new domains until the end of time, and site owners shouldn't be doing anything extra (imo) to justify their existence to admins. If you use a firewall voluntarily and that firewall blocks sites that are legitimate, that's on you, not the site owner. We get this a lot at my job, where many customers' admins block s3 buckets by default. We give our customers a list of hostnames to allowlist and if they can't figure it out, that's on them.
- ThePowerOfFuet 7mo ago>If you subscribe to the mindset of "new domains are likely to be bad" you just deal with a steady stream of allowlist requests from your users until the end of time. Newly-registered domains are not generally an issue with enterprise users. However, they are overrepresented in malicious traffic due to domain-generation algorithms (DGAs).
- Terretta 7mo ago> Newly-registered domains are not generally an issue with enterprise users. I take it this means enterprise users are not generally needing to do anything legit-for-work on a newly registered domain. Enterprise clicks on newly registered domains tend to be (a) being phished or smished or cryptomined or whatever, or (b) someone reading X or Bsky or HN or ProductHunt's vibe code of the date -- things the enterprise would also like to have blocked. Consider the CloudFlare/Proofpoint/NextDNS/etc. domain block on new domains much like updating one's HN home page to https://news.ycombinator.com/classic https://news.ycombinator.com/classic …
- CptKriechstrom 7mo agoDo I miss something? How do you adopt the device in the first place? If you have to SSH into the device and set the inform URL manually could't you just route the request based on the request hostname?
- baconomatic 7mo agoYep, once you set-inform the host header handles the routing. This in particular is most useful for things like DHCP Option 43, where devices only get an IP.
- CptKriechstrom 7mo agoBut if you only got that IP and a MAC-Address - how do you know which tenant is supposed to adopt the device?
- baconomatic 7mo agoWe support two approaches, you can either pre-register MAC-Addresses or you can add source IP's to assist with that mapping. There is more information in our docs about this: https://tamarack.cloud/docs/migration https://tamarack.cloud/docs/migration
- Szpadel 7mo agothat's the key information to understand the whole thing. it would be great if that could be in the article in the first place. (I'm assuming you are the author)
- baconomatic 7mo agoGood call, I should have made that more clear. Article updated!
- psd1 7mo agoThe default inform address is unifi:8080. Every network I've set up (which is not many) has a dns search suffix handed out by dhcp. So the wap will resolve, e.g. unifi.branch.megacorp.net with zero config needed.
- openclaw01 7mo ago[dead]
- opengrass 7mo agoController uses way to much RAM compared to OpenWISP and good luck if a device is EOL. Lots of $10 USG-3P's out there.
- devilbunny 7mo agoFWIW, the USG-3P is listed as supported by OpenWRT.
- opengrass 7mo agoI must admit, it's a better choice than a Raspberry Pi.
- bxbdbehdbdb 7mo agoI don't quite get the reason for sniffing the packets. Wouldn't it be simpler to just run multiple VMs on one host to be multi tenant?
- baconomatic 7mo agoIt would definitely be simpler, however the routing issue still stands. You would need to have a public IP for every VM, which is getting less practical. The MAC-based proxy makes it so we only need one IP and we can worry about the routing within our platform instead.
- deleted 7mo ago[deleted]
- roywashere 7mo agobut it is http! why can't you do virtual hosting on a reverse proxy?
- baconomatic 7mo agoYou definitely can once the device has a hostname set in set-inform. The MAC proxy is just for initial adoption where a device may only know the IP. Such as when you use DHCP Option 43.
- gh02t 7mo agoYou can after the initial discovery step, the article mentions this. The MAC routing is for the first step where the device is reaching out to try and find a controller and signal it's available for adoption, which uses an IP address at least in the scheme that is relevant for hosted operators. After that initial channel is established, the controller uses it to tell the device what its hostname is, and you can switch to more normal HTTP proxy routing thereafter.
- baconomatic 7mo agoYep, that's exactly right!
- cheriot 7mo agoThis is very cool. I wonder if there's a way to control routing client side and remove the list of mac addresses. Eg manage DNS for customers (upsell ad blocking!) and CNAME the unifi entry to a customer specific vhost.
- baconomatic 7mo agoThank you! DNS-based adoption works well for this. You point the unifi hostname at the tenant's subdomain and the Host header handles routing from there. We also have a DHCP Option 43 generator for setups where DNS isn't practical.
- andrewaylett 7mo agoI'm glad the payload was usable and the author has fixed their problem, it's an interesting challenge. However, there are other approaches. A public IP per client isn't going to be nearly as expensive as a VM per client, and lets you route your clients by target. Or you could route by source IP: either by having the client register their IPs, or with some combination with seeing where folk log in from. Neither is necessary, though, given inspection does appear to work.
- burgreblast 7mo agoI don’t get this comment. Inspection does work but the suggested alternatives don’t. Having the client register their IPs isn’t tenable for most folks. What’s my IP at the shop? (No idea) Will it change? (Yes) now it’s broken. Seeing where folks log in from isn’t nearly the same as where their UniFi networks are located. (Store vs home.) Broken. So neither of the those are robust approaches whereas the author’s solution is bulletproof and simply works in all cases. No offense, but why suggest “other approaches” that have such major holes? Why not just cheer on the solution that works all the time?
- andrewaylett 7mo agoThe author framed his issue as a choice between separate VMs (with high cost) per user or decoding the messages. As he, you, and I all say: what he's got does work. I'm absolutely not saying that now he's solved the problem he should do something else. But the choice wasn't between only those two extremes. This protocol was amenable to inspection, the next might not be. I use NextDNS, one of the features it provides is letting you register a source IP so requests from your network "just work". It might not be a mainstream consumer feature, but neither NextDNS nor managed Unifi controllers are mainstream consumer products.
- stereo 7mo agoNice hack! Would hosting controllers on individual IPv6 addresses on the same VM solve this too?
- baconomatic 7mo agoYeah IPv6 would solve this because we wouldn't have to go through the proxy at all, since each VM could get their own. Unfortunately IPv6 isn't quite as supported as we'd like.
- baby_souffle 7mo agoUbiquity in general has had garbage support for IPv6 since the beginning. They claimed most of their customers aren't asking for it when I pushed them on the issue years ago.
- FireBeyond 7mo agoYup, absolutely. I'm so annoyed by this. I haven't been able to get either my Comcast IPv6 address pool set up and usable throughout my home network (three switches and two Unifi Pro 6 WAPs, across a few VLANs), nor my HE.net tunnel. So annoyed.
- baby_souffle 7mo agoI use Ubnt for layer 1 and 2. Their switches are nice if your needs can be met by their spog. Same with their access points although I haven’t see a good one from then since WiFi 5. Their latest WiFi 7 ap is top dollar but used last generation chip and has a cooling fan :[ Dont use unit for routing, though.
- lkuty 7mo ago"The whole proxy is maybe 200 lines of Go with an in-memory MAC-to-tenant lookup table." Is it possible to have the source code or is it private ?
- baconomatic 7mo agoThe proxy is part of our platform so the source isn't public, but the concept is straightforward and the blog post covers the core logic. Happy to answer questions about the approach if you're building something similar!
- argulane 7mo agoI think you can even use standard haproxy acl rules and tables to extract few bytes from the request and route them correctly. No need for Go.