A long day, from pilot prep just after midnight to about 19:07 in the hotel's comms room.

Pilot-day plan

I wrote the plan for the hotel IPTV pilot, then checked it and found three problems. A five minute auto-undo timer on the uplink change would have expired mid-test, so I now confirm straight after the checks pass. Under IGMPv2 a channel only drops about 260 seconds after its last report, so the multicast soak became "past 5 minutes". Three rooms only go ahead if the front desk says they are empty. I decided to accept a second IGMP querier on VLAN 220. The remote read-only checks passed.

Gateway in safe mode

The UniFi controller said safe mode was active. The UCG Fiber was at 92% memory, with about 241 MB free of 3 GB and 1.25 GB in swap. Safe mode had done one thing, limiting IPS to important signatures. IPS restarted at about 00:12 after a signature update, which is the likely tipping point, though I can't prove it. Protect for the 5 cameras takes roughly 0.6 to 0.75 GB, the Network app 0.54 GB, UniFi OS 0.45 GB and IPS 0.16 GB.

I turned on SSH to read the process list and changed nothing. My shortlist of ten settings includes dropping the driveway camera from 4K to 2K (it produces 46% of all footage), turning off face and number-plate detection, and trimming IPS from 34 rule categories to about 18. Only three have a measured saving behind them. The longer-term fix is moving Protect to a UNVR Instant.

A Windows drive for pve04

pve04 has no file sharing and root login is key-only, so I mapped it with SSHFS-Win. It failed twice: Windows' own ssh.exe was being picked up, and the key file SSHFS-Win reads held the wrong key. net use still gave error 67, probably because the launcher service runs as SYSTEM, so I mount the drive from a scheduled task at sign-in. It is untested across a sign-out.

pve04's log also showed my connections arriving from pve01. My PC was sending all lab traffic through Tailscale because pve01 advertises the lab subnet. I turned off accepting routes on the PC.

Wi-Fi speed

My PC's Wi-Fi 7 link ran at 188 Mbps up and 142 down, because it had joined the office access point on 2.4 GHz. On 5 GHz it reached 639 and 677. That radio was meant to be on channel 132 at 22 dBm but sat on channel 64 at 15 dBm, probably after radar detection on a DFS channel. A force-provision didn't move it. A reboot did, and the result was 887 up and 806 down. Wired 2.5G gives 1.95 Gbps.

I also found an open Wi-Fi repeater name that answered pings from my home gateway address. The controller has never seen it as a client, and only the lounge access point hears it, at -93 dBm. It looks like a neighbour's network, but I haven't ruled out a bridge into my home VLAN.

The hotel's core switches

I arrived at 14:31. The hotel's IT provider hadn't replied, so I used the day for a read-only survey. I plugged into core 1 port 41, confirmed the port from the switch's LLDP announcement, recorded every session, and ran the same counters on both cores twice, an hour apart.

• VLAN 220 exists on both cores with no member ports. Ports 22 and 44, which the pilot needs, aren't configured, so I won't patch into port 22 as it stands.
• In UniFi, room 11's port was already on VLAN 220, but 220 is missing from the IGMP snooping list.
• The cores don't route, so VLAN 220 can't leak into the hotel through them.
• Listening passively, I found the old TV system's encoders still streaming about 81 Mbps. Its two servers sit on different VLANs, so one has been asking for the other's address for 84 days.
• I also matched the firewall's DHCP leases against UniFi's client list to tell guest devices apart from the hotel's own.

I made two mistakes. My Mac announced itself over IPv6 on the server VLAN until I turned off AirPlay Receiver and IPv6 on the adapter. The other was pasting about 70 lines of switch output back into a terminal. I wasn't in configure mode, and show config status confirmed nothing changed.

By evening the provider had moved room 11's port to VLAN 220 and was unavailable for the weekend, so that TV was dark. I swapped its lead onto room 14's port, whose jack is dead from the renovation, and logged it. The pilot didn't run.

Still open

• The provider must configure core 1 ports 22 and 44 and add VLAN 220 to IGMP snooping.
• Move room 11 back to port 1 before the pilot restarts.
• Move Protect to the UNVR Instant, then turn SSH off on the gateway and remove the key I added.
• Finish tracing cables from ports 7, 26 and 30 on core 1 and 45 and 46 on core 2.
• Work out who owns the open repeater.