Ecobee thermostat can’t connect to servers
-
@GPz1100
mine are all default in the firewall settings too. WAN mtu is actually just using the adaptors default. Don't have any defined MTU. -
@GPz1100 Are you able to grab a pcap for comparison with a working connection?
-
@stephenw10 What specifically do you want captured, and for how long? I can use the pf packet capture gui option but what options do you want set there?
The ecobee is on the IOT vlan which only has rfc1918 access to dns server and internet.
-
@ezhawk said in Ecobee thermostat can’t connect to servers:
@GPz1100
mine are all default in the firewall settings too. WAN mtu is actually just using the adaptors default. Don't have any defined MTU.I understand, but since it is working with the other firewall, there must be some difference, no?
-
Just a typical TCP stream from the client to the server. Is it sending/receiving large packets every connection for example? Does the connection just remain open?
-
@stephenw10 Attached is a sanitized pcap. Ecobee mac and lan interace mac sanitized to begin with bb dd cc and lan mac begins with 11 22 33.
sanitizedpacketcapture--20250828135527.pcap
The capture is a 10 min segment of steady state operation.
Note, the ecobee tries to resolve api.amazon.com every 50s. This is denied via dns server as well as blocking the entire amazon asn for the ecobee ip.
Hope this helps.
PS. please delete the previous message - it's already tagged as deleted, please remove permanently.
-
Hmm, so it normally just holds open the TCP connection continually.
-
@stephenw10 That's why I asked what packages were installed. Perhaps something is interfering.
-
@GPz1100 @stephenw10
don't have too many installed.
-
Hmm, are you able to capture the initial connection from the client to the server?
-
@stephenw10
i have a pcap i took yesterday that i was capture while i rebooted the ecobee. trying to go through right now to see if any user/pass might of been passed not encrypted. -
@stephenw10
i think it's clean of user/pass. is there a way i can send it without just posting it? -
@ezhawk Other than the macs, I saw some exchanges include plain text tstat serial number (the PTR requests). Everything else I think is encrypted, at least between the tstat and ecobee. I can't comment on the amazon traffic as that's all blocked here.
-
-
@ezhawk Is there a pcap when it's acting up? Or was that the one on the previous page?
-
@GPz1100 that pcap is yesterday when i rebooted the ecobee and it can't connect to ecobee.com
-
Hmm, nothing there really looks like a routing problem. If you told me that was it working normally I would believe it.
It has no problem connecting to home-fw.ecobee.com. Including with large packets. Though I note that's at a completely different IP than idt.
It ARPs for 10.99.0.35. Do you know what that is?
-
@stephenw10
That's my Home Assistant server. Ecobee is integrated via Apple HomeKit into HA. -
Hmm, and I assume that continues to work fine even when it stops connecting to ecobee's servers?
-
@stephenw10
Yes, there isn't any issue from HA to the Ecobee when the Ecobee cannot connect to the Ecobee servers.
