I recently learned that some LG and Samsung televisions may use automatic content recognition, and I want to verify what my devices are communicating externally. Ideally, I'd like to log every connection leaving my LAN, identify which device initiated it, see the destination and protocol, and block selected traffic when necessary.
I own my modem and gateway and have a 2.5Gbps internet connection. I understand that blocking traffic could interfere with software updates, content listings, time synchronization, or other features, but I'd still like as much visibility and control as possible. Is Wireshark the right tool, or would a firewall, DNS filter, or another setup be more appropriate?
3 Answers
You can usually determine destinations and traffic volume, but not the actual contents. Most internet traffic is encrypted, so a gateway may show that a TV sent data to a particular service without revealing whether it was telemetry, an update, or something else.
Decrypting it would require a man-in-the-middle setup and installing a trusted certificate on the device. Smart TVs often do not support that properly, and certificate pinning can prevent it anyway. For a device you do not trust, the most reliable privacy control is to keep it offline and connect a separate streaming device that you’re more comfortable managing.
The most practical approach is to put a capable firewall at the network edge and enable connection logging for the devices or rules you care about. OPNsense or pfSense can replace your router, or you can put your existing gateway into bridge mode and use a small computer with two network interfaces. Firewalla, MikroTik, and some Ubiquiti equipment are appliance alternatives.
A firewall can show which internal device contacted which external IP or hostname, when it happened, and how much data was transferred. You can then create outbound rules for particular devices or destinations. Store logs on another system if the volume becomes too large for the firewall itself.
Wireshark is useful for examining packets, but it isn’t usually the best primary monitoring or blocking tool. Capturing everything on a busy 2.5Gbps connection would create enormous amounts of data and requires a suitable network tap or port mirror.
A DIY firewall normally needs separate interfaces for the WAN and LAN sides, and many firewall appliances do not provide Wi-Fi themselves. Your existing wireless access point can usually remain behind the firewall.
DNS monitoring is a good lighter-weight starting point. Pi-hole, AdGuard Home, NextDNS, or similar services can log the domains devices look up and block known telemetry or advertising endpoints. This is much easier to review than a complete packet capture, and it often reveals which services a television is contacting.
However, DNS only shows name lookups. Devices can use cached addresses, hard-coded IPs, encrypted DNS, or third-party content delivery networks, so DNS filtering is not a complete record of outbound traffic. Combining it with firewall logs gives you much better coverage.
That makes sense. I’m mainly looking for connection and volume patterns rather than expecting to read encrypted payloads, so a firewall combined with DNS logging sounds like the best place to start.