> It's all fairly trivial. After the card gets a DHCP
> response, it sends out a flood of ARP requests ... for
> each host in the subnet. It then does a triple handshake
> on the predesignated port of each host in turn, until it
> finds one that's running a server on it. After that it
> just tries to authenticate with that host, and send it
"That host" is, of course, the one running the Eye-Fi manager. Chris's tools will listen on that predesignated port for the card to contact it, and start accepting pictures.
Well, here's the problem: I don't see any of this behavior!! I set up a second ethernet card in one of my Linux machines and turned on bridging with it and a normal card, then put my wifi access point on that second card. That makes my PC act like an ethernet switch that allows me to monitor all the traffic that goes over it with network monitoring tools.
I used a filter in Wireshark to narrow down the traffic to just the Eye-Fi card with this filter
(eth.addr == 00:18:56:aa:bb:cc) &&That's because "00:18:56:aa:bb:cc" is the MAC address of the Eye-Fi card, and "184.108.40.206" is the IP address of the Eye-Fi server. So, this let me look at all of the card's communication with things other than the Eye-Fi server.
!(ip.addr == 220.127.116.11)
After the DNS requests to talk to the Eye-Fi server, I don't see the card do much of anything.