Hi Colin,
So when tracking the reader's IP I get:
Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
-------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- --------- --------- -----
10.1.30.243 10.1.30.1 1 4 0 0/0 0 0 1 pc1 16 0 0 FI
10.1.30.243 10.1.30.1 1 2 0 0/0 0 0 1 pc1 16 0 0 FI
10.1.30.243 10.1.30.1 1 3 0 0/0 0 0 1 pc1 16 0 0 FI
10.1.30.243 10.1.30.1 1 0 0 0/0 0 0 1 pc1 16 0 0 FI
10.1.30.243 10.1.30.1 1 1 0 0/0 0 0 1 pc1 16 0 0 FI
10.1.30.1 10.1.30.243 1 2 2048 0/0 0 0 1 pc1 16 0 0 FCI
10.1.30.1 10.1.30.243 1 3 2048 0/0 0 0 1 pc1 16 0 0 FCI
10.1.30.1 10.1.30.243 1 0 2048 0/0 0 0 1 pc1 16 0 0 FCI
10.1.30.1 10.1.30.243 1 1 2048 0/0 0 0 1 pc1 16 0 0 FCI
10.1.30.1 10.1.30.243 1 4 2048 0/0 0 0 1 pc1 16 0 0 FCI
which is the reader sending traffic to the default gateway. and then the defualt gateway sending traffic back to the reader's IP. I don't know what traffic it's sending.
Then, I tracked the iPads IP address (where the shopkeep app is running) and found this:
Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
-------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- --------- --------- -----
10.1.30.90 10.1.31.255 17 51970 22222 0/0 0 24 1 tunnel 109 10 0 0 FC
10.1.30.90 10.1.31.255 17 50765 22222 0/0 0 24 0 tunnel 109 4 1 56 FC
10.1.30.90 10.1.31.255 17 49569 22222 0/0 0 24 1 tunnel 109 16 0 0 FC
10.1.30.90 10.1.31.255 17 55781 22222 0/0 0 24 1 tunnel 109 a 0 0 FC
10.1.31.255 10.1.30.90 17 22222 55781 0/0 0 0 0 tunnel 109 a 0 0 FY
10.1.31.255 10.1.30.90 17 22222 51970 0/0 0 0 1 tunnel 109 10 0 0 FY
10.1.31.255 10.1.30.90 17 22222 49569 0/0 0 0 1 tunnel 109 16 0 0 FY
10.1.31.255 10.1.30.90 17 22222 50765 0/0 0 0 0 tunnel 109 4 0 0 FY
So the iPad seems to be doing what one would think it should be doing, broadcasting for the reader but the reader seems to be misbehaving by sending traffic to the default gateway for a destination of the same subnet/vlan...
rif