Uniden 536 HP Wifi "feature"

[bigbloke]

Hi All,

I've just acquired a secondhand Uniden BCD536, early days but thought that as it has a Wi-Fi feature
some people might appreciate an insight into its partially flawed implementation by uniden.

There are two modes of operation:

AP (access point mode) -- the radio itself act as a stand alone Wi-Fi hub providing wireless
access to its capabilities

Infrastructure mode -- The radio integrates into your existing wireless network and provides
access to its services over a wider area -

Access point mode works exactly as you would hope, but range is quite limited.

Infrastructure mode has a flaw - its not network address translation (NAT) friendly. In other words,
if you hope to run the radio at home and access it remotely and you have a NATed firewall between the scanner and you
(e.g. a holiday hotel Wi-Fi access point) - you're stuffed !

the device running the SIREN app must be in the same sub-network as the radio or you don't hear the audio - just the
on screen displayed data. those familiar with Session initiation Protocol telephony will be aware of the scenario, but it goes like
this (refer to the diagram below):

nat-prob.png

* Siren App connects to scanner IP through a firewall with overload (one to many) NAT
* Firewall sees the connection attempt and allows it through to the scanner - and starts "tracking" the connection.
* Scanner responds, firewall says "yes the traffic originally came from inside so I'm allowing this through.
* current channel data is displayed on the radio.
* The scanner receives some audio - it wants to send it to the Siren App. so it alerts siren over the same data port that
it has voice to forward to it , and tells siren which audio port to listen on.
* The firewall is cool with this as , again, the conversation started from the inside , so it allows the setup messages back in
* Siren opens the port and waits for the incoming connection from the scanner
* the scanner encodes the audio and forwards it to the device running siren on the new audio port
* the firewall looks at this new connection from the scanner and says "this conversation did not start from inside me, its unsolicited
traffic from outside trying to get inside! not permitted!" and drops the packet flow

hence - you get no audio.

this will happen on any connection with overload NAT so even if you port forward to the outside world and try to listen to your scanner on , lets say, a hotel wifi AP - then your still going to hit the same problem!

What were uniden thinking ? why didnt they use something more like IAX2 protocol (which is highly NAT friendly and single socketed!)

Hope this helps someone out there and potentially stops them spending a fortune on a feature that will not work the way they hoped. I bought mine to keep in the van so I will be running exclusively in AP mode - therefore the issue won't affect me.

Also if your home AP runs on the European Wi-Fi channels 12 & 13 , the wifi device cannot access them. It only works on the american channels 1-11

Regards

BB

[stratocaster]

I can see they're just under the £800 mark brand new, well, that was on amazon uk. That feature flaw is handy to know. I wonder if a firmware update will include a rectification programme, or will they stick with current format?

[Admiral]

Can you Telnet into the device?

[bigbloke]

Ive yet to conduct a proper portscan Admiral.

My IT setup is complicated here, and due to the lack of channel 12/13 wifi support I have to
put the 536 out in the "External DMZ / guest network" like:

Code: Select all

    ISP wifi  /\/\/\ BCD536
       |               
ISP ROUTER---ext dmz---INTERNAL FIREWALL---5 internal subnets --- my devices

With the current Intrusion detection rule sets on the Internal firewall the port scanning host would have its IP / MAC
removed from the DHCP whitelist and would be added to the blacklist after 10 consecutive ports.

both the ISP router and firewall are in the attic so ill have to go up and plug in.

I have tried ports 80/443 though . no response on 443 but 80 comes back with a minimal webpage

minimal.png

Regards

BB

[bigbloke]

I can see they're just under the £800 mark brand new, well, that was on amazon uk. That feature flaw is handy to know. I wonder if a firmware update will include a rectification programme, or will they stick with current format?

well in my opinion the firmware of the bcd536 lags woefully behind that of the 436.

to rectify the feature they will have to re-write both the scanner firmware and the siren app. Uniden are not TYT where new
firmware updates have some degree of regularity - hell the latest uniden update didnt even fix what the **** change note
said it did !!

I think you have more chance of finding lord lucan riding shergar !

I cant even get on to the uniden forums at radio reference due to a website / ISP issue to have a (constructive) moan at uniden about it

Regards

BB

[bigbloke]

Can you Telnet into the device?

took the tablet into the attic and scanned the first 1024 ports

what I found may alarm!

mailmemaybe.png

in the spirit of openness - I added the protocol names in the right column with the exception of HTTP

At this stage my advice to anyone owning or thinking of purchasing this device is NOT to run it in infrastructure mode
until uniden justify what those email ports are used for.

HTTP (80) and RTSP are the only ones that can be justified for the scanners application

Regards,

the somewhat gobsmacked

BB

[bigbloke]

uniden are clearly aware of the shortcomings of Siren and have released a basic desktop app and the latest firmware update (7/7/17) does at least now allow RTSP streaming using VLC which is firewall friendly

rtsp://{scanner ip address}/au:scanner.au

but you dont get the channel data via MP3 tags like you do in proscan

for the love of god uniden, offer Bob Aune (developer of Proscan) a decent wage and royalties and bring him into the fold!

Regards

BB

[bigbloke]

I have just discovered that Bob Aune has added favourtites editing to proscan for the 436 / 536 and possibly the 3600 implicitly (cant test)

if the guy was in the room I would **** kiss him !! (then buy him a beer or 10!)

direct export from proscan to sentinel HPE !!!

regards

BB

[bigbloke]

for those wondering what unidens 536 remote control app looks like:

536 remote via wifi.png

its really clunky but it does work

If you are going to buy a 536 - do yourself a favour - invest in proscan !

Regards

BB