YOUR SMART TV is watching you back.

your tv is talking even when you're not

you turn off the tv, walk away, go to bed. the screen is black but the network card is not sleeping. smart tvs phone home constantly, sending viewing data, ad ids, diagnostics, and sometimes stuff you never agreed to share. the good news is you don't need to trust a privacy policy to find out what's happening. you just watch the traffic yourself.

the command, broken down

tshark -i eth0 -f 'host 192.168.1.22'

tshark is the command line version of wireshark, a packet capture tool. it lets you see every bit of traffic crossing an interface in real time, no gui required.

-i eth0 tells it which interface to listen on. this is usually the interface on your router or a machine sitting between your tv and the internet, since you want to see what the tv sends, not what your own laptop sends.

-f 'host 192.168.1.22' is a capture filter. it tells tshark to only show traffic to or from that one ip address, which in this case is your smart tv on your local network. this keeps your capture readable instead of drowning in every device on your wifi.

run it, let it sit for a few minutes with the tv "off," and watch what shows up. you'll usually see dns lookups to ad networks, analytics domains, and the manufacturer's own servers, even with nothing playing.

finding your tv's ip first

if you don't already know your tv's local ip, check your router's admin page under connected devices, or run a quick network scan from a machine on the same lan.

nmap -sn 192.168.1.0/24

look for the device name that matches your tv brand. once you have the ip, plug it into the tshark filter above. this whole process only touches your own network, which is the point. you're auditing your own gear, not snooping on anyone else's.

what you'll actually see

most smart tvs generate steady background traffic to a handful of domains tied to telemetry and ad tracking, even when idle. you'll often spot repeated dns queries every few minutes, small https connections that don't correspond to anything you're watching, and traffic that continues long after you've turned the screen off. none of this is illegal or even unusual, it's just how the ad supported tv model works. the value of running the capture yourself is that you stop guessing and start seeing exactly which domains are involved, so you can decide what to block.

turning what you learn into action

once you have a list of domains or ips your tv talks to, you have real options instead of vague unease.

block specific domains at the router or with a pi-hole style dns sinkhole. this stops the tv from resolving tracker domains without breaking core functionality like firmware updates or streaming apps.

put the tv on its own vlan or a guest network segment so it can reach the internet but can't see or touch other devices on your lan. this limits blast radius if the tv itself is ever compromised or just misbehaving.

go through the tv's actual privacy settings and turn off "viewing data," "acr" (automatic content recognition), and any ad personalization toggles. these are usually buried three menus deep on purpose.

if the tv absolutely does not need internet access to function for your use case, like if you only use it with an external streaming box, just don't connect it to wifi at all. the simplest fix is often the best one.

the takeaway

your smart tv isn't uniquely evil, most connected devices behave this way. the difference between feeling paranoid about it and actually doing something about it is a five minute packet capture. you don't need to be a network engineer to run tshark, you just need curiosity and your own router. see what's leaving your house, decide what you're okay with, block the rest. that's the whole job.