Ethereal-users: Re: [ethereal-users] UDP broadcasts - what are these?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gerald Combs <gerald@xxxxxxxx>
Date: Sun, 4 Jun 2000 11:23:38 -0500 (CDT)
On Sun, 4 Jun 2000, John J. LeMay Jr. wrote:

> Can anyone help me identify the following?
> 
> My Mandrake 7.0 (2.2.14) machine is equipped with a eepro100 adapter. I am
> seeing a continuous series of UDP packets being bradcast from this machine.
> Packets are being sent from my machine at 192.168.1.1:1069 (logan) to
> 255.255.255.255:5456. 

The port numbers list at
http://www.isi.edu/in-notes/iana/assignments/port-numbers lists port
5456 as belonging to 'apc-tcp-udp-6', followed by a contact address at
APC, the UPS manufacturer.  Are you running any sort of UPS software?

The unchanging source port indicates that a process is hanging around with
the socket open.  If you have 'lsof' or 'fuser' installed, you should be
able to track it down with 'lsof -i udp:1069' or 'fuser -n udp 1069'.  I
believe newer versions of 'netstat' under Linux can also show the PID of
each socket's owner.

> 
> TCPDUMP shows the packets as:
> 
> 11:35:42.119078 logan.1069 > 255.255.255.255.5456: udp 256
> 11:35:47.373467 logan.1069 > 255.255.255.255.5456: udp 256
> 
> I captured the payload using Ethereal:
> 
> 0000  ff ff ff ff ff ff 00 d0  b7 1d d8 6c 08 00 45 00   ........ ...l..E. 
> 0010  01 1c bf 2b 00 00 40 11  f8 ca c0 a8 01 33 ff ff   ...+..@. .....3.. 
> 0020  ff ff 04 2d 15 50 01 08  72 f1 30 33 31 7c 31 7c   ...-.P.. r.031|1| 
> 0030  70 75 62 6c 69 63 7c 39  7c 33 31 36 37 33 7c 30   public|9 |31673|0 
> 0040  7c 30 7c 32 30 31 30 7e  7c 00 d8 23 35 08 00 00   |0|2010~ |..#5... 
> 0050  00 00 03 00 00 00 18 00  00 00 18 00 00 00 60 98   ........ ......`. 
> 0060  29 00 00 00 00 00 03 00  00 00 18 00 00 00 18 00   )....... ........ 
> 0070  00 00 60 98 29 00 38 f5  ff bf ca b1 20 00 04 7a   ..`.).8. .......z 
> 0080  19 00 14 00 00 00 18 8f  18 00 30 fa 27 08 38 d5   ........ ..0.'.8. 
> 0090  38 08 18 34 3c 08 4c f5  ff bf 44 f5 ff bf 30 fa   8..4<.L. ..D...0. 
> 00a0  27 08 08 6d 39 08 40 4a  31 08 b8 48 31 08 98 49   '..m9.@J 1..H1..I 
> 00b0  31 08 84 f5 ff bf 96 8a  08 08 84 f5 ff bf d0 8a   1....... ........ 
> 00c0  08 08 f0 2f 39 08 08 6d  39 08 40 4a 31 08 b8 48   .../9..m [email protected] 
> 00d0  31 08 38 f6 ff bf 08 6d  39 08 44 cd 09 08 c0 34   1.8....m 9.D....4 
> 00e0  3c 08 08 6d 39 08 88 f5  ff bf 6b 69 08 08 98 49   <..m9... ..ki...I 
> 00f0  31 08 40 4a 31 08 b8 f5  ff bf 3f c0 09 08 b0 49   1.@J1... ..?....I 
> 0100  31 08 40 4a 31 08 8c bf  09 08 38 f6 ff bf 5c 69   1.@J1... ..8...\i 
> 0110  08 08 90 89 08 08 c0 64  08 08 54 c8 09 08 e8 4a   .......d ..T....J 
> 0120  31 08 00 00 00 00 d4 f5  ff bf                     1....... ..       
> 
> 
> John LeMay Jr.
> Senior Enterprise Consultant
> NJMC, LLC.
> 
> The rules have changed... Get paid to surf the web!!!
> http://www.alladvantage.com/go.asp?refid=bdc893
>