What my smart pet feeder does on the network (and why I couldn't capture the video)

I bought a cheap Wi-Fi pet feeder and, instead of just trusting it, I spent an evening watching what
it actually does on my own network. Then I turned the capture-and-grade flow into a small open tool,
iotaudit (MIT, macOS/Linux, no account, everything
local). Here's what I found and how it works.

The setup

You can audit a device two ways without re-flashing anything:

• ARP mode - iotaudit ARP-spoofs one device you own so its traffic flows through your laptop, then restores the ARP tables and IP-forwarding on exit.
• pcap - point it at a capture from Wireshark or your router.

brew install nmap   # or: sudo apt install nmap
pipx install iotaudit
sudo "$(which iotaudit)" capture --mode arp --i-own-this-network

It scans the LAN, lets you pick the device, captures for a while, and writes a one-page HTML report
with an A-F grade.

What the feeder actually did

• Telnet (port 23) open - a BusyBox login shell on the LAN. High-risk default.
• Hardcoded 8.8.8.8 - it does its own DNS, bypassing the router (and any Pi-hole).
• US clouds over TLS/MQTT plus a STUN/TURN handshake (the P2P-video pattern).
• No idle uploads - quiet when the app was closed.

The honest part: I couldn't capture the video

When I opened the live stream, barely any video showed up in the capture - a few hundred KB, far too
little for a real stream. The reason is interesting: live video from these devices usually goes
directly from the camera to your phone over Wi-Fi (P2P), and two Wi-Fi clients can exchange
traffic without it ever passing through your laptop (access-point client isolation), or it rides
IPv6 link-local addresses that an IPv4/ARP capture never sees.

So iotaudit now (a) adds IPv6 + NDP to the capture and counts those flows, and (b) when a P2P
session is set up but no stream is observed, it says so in plain English instead of pretending:

Live video set up but not observed here: it most likely went straight to your phone over Wi-Fi.
Not observed does not mean it did not happen.

For ground truth you capture at the router. I think that honesty matters more than a confident-looking
chart: a privacy tool that overclaims is worse than useless.

How the grading works

Findings are indicators from observed traffic, not proof of vendor wrongdoing: plaintext vs TLS
vs "custom" high-entropy protocols (by entropy, not vibes), trackers, open ports with risk notes,
hardcoded DNS, and a traffic timeline. There's also an MCP server so you can ask an assistant to
"audit my pet feeder" locally.

Code and a sample report: https://github.com/emirmrkaljevic/iotaudit - feedback and device profiles
(PRs) welcome. Audit your own network only.