| 1 |
On Fri, 21 Nov 2008 06:50:04 -0600 |
| 2 |
Dale <rdalek1967@×××××.com> wrote: |
| 3 |
|
| 4 |
> Hi, |
| 5 |
> |
| 6 |
> I noticed a little modem activity while I was idle. I wasn't sure |
| 7 |
> what it was so I used wireshark to capture and exported it. I did a |
| 8 |
> google search and even read the wikipedia thing but I'm still not |
| 9 |
> sure what to make of this. Here is what I got from wireshark: |
| 10 |
> |
| 11 |
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| 12 |
> |
| 13 |
> No. Time Source Destination |
| 14 |
> Protocol Info |
| 15 |
> 20 113.958458 209.244.187.170 224.0.0.1 |
| 16 |
> IGMP V2 Membership Query, general |
| 17 |
> |
| 18 |
> Frame 20 (44 bytes on wire, 44 bytes captured) |
| 19 |
> Arrival Time: Nov 21, 2008 06:41:55.382585000 |
| 20 |
> [Time delta from previous captured frame: 29.711333000 seconds] |
| 21 |
> [Time delta from previous displayed frame: 29.711333000 seconds] |
| 22 |
> [Time since reference or first frame: 113.958458000 seconds] |
| 23 |
> Frame Number: 20 |
| 24 |
> Frame Length: 44 bytes |
| 25 |
> Capture Length: 44 bytes |
| 26 |
> [Frame is marked: False] |
| 27 |
> [Protocols in frame: sll:ip:igmp] |
| 28 |
> [Coloring Rule Name: Routing] |
| 29 |
> [Coloring Rule String: hsrp || eigrp || ospf || bgp || cdp || vrrp |
| 30 |
> || gvrp || igmp || ismp] |
| 31 |
> Linux cooked capture |
| 32 |
> Packet type: Unicast to us (0) |
| 33 |
> Link-layer address type: 512 |
| 34 |
> Link-layer address length: 0 |
| 35 |
> Source: <MISSING> |
| 36 |
> Protocol: IP (0x0800) |
| 37 |
> Internet Protocol, Src: 209.244.187.170 (209.244.187.170), Dst: |
| 38 |
> 224.0.0.1 (224.0.0.1) |
| 39 |
> Version: 4 |
| 40 |
> Header length: 20 bytes |
| 41 |
> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: |
| 42 |
> 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) |
| 43 |
> .... ..0. = ECN-Capable Transport (ECT): 0 |
| 44 |
> .... ...0 = ECN-CE: 0 |
| 45 |
> Total Length: 28 |
| 46 |
> Identification: 0x7a8b (31371) |
| 47 |
> Flags: 0x00 |
| 48 |
> 0... = Reserved bit: Not set |
| 49 |
> .0.. = Don't fragment: Not set |
| 50 |
> ..0. = More fragments: Not set |
| 51 |
> Fragment offset: 0 |
| 52 |
> Time to live: 1 |
| 53 |
> Protocol: IGMP (0x02) |
| 54 |
> Header checksum: 0xd1b4 [correct] |
| 55 |
> [Good: True] |
| 56 |
> [Bad : False] |
| 57 |
> Source: 209.244.187.170 (209.244.187.170) |
| 58 |
> Destination: 224.0.0.1 (224.0.0.1) |
| 59 |
> Internet Group Management Protocol |
| 60 |
> IGMP Version: 2 |
| 61 |
> Type: Membership Query (0x11) |
| 62 |
> Max Response Time: 10.0 sec (0x64) |
| 63 |
> Header checksum: 0xee9b [correct] |
| 64 |
> Multicast Address: 0.0.0.0 (0.0.0.0) |
| 65 |
> |
| 66 |
> 0000 00 00 02 00 00 00 00 00 00 00 00 00 00 00 08 |
| 67 |
> 00 ................ 0010 45 00 00 1c 7a 8b 00 00 01 02 d1 b4 d1 f4 |
| 68 |
> bb aa E...z........... 0020 e0 00 00 01 11 64 ee 9b 00 00 00 |
| 69 |
> 00 .....d...... |
| 70 |
> |
| 71 |
> |
| 72 |
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| 73 |
> |
| 74 |
> Ideas? Thanks |
| 75 |
|
| 76 |
Hmm it looks like an IGMP multicast group membership |
| 77 |
query. I have seen the (SAP) service discovery function of VLC |
| 78 |
broadcasting those (or something similar, i might be mixing up things |
| 79 |
here). |
| 80 |
|
| 81 |
On http://www.networksorcery.com/enp/protocol/igmp.htm i found: |
| 82 |
|
| 83 |
"0x11 Group Membership Query, general or group-specific. General |
| 84 |
Query is used to learn which groups have members on an attached |
| 85 |
network. Group-Specific Query is used to learn if a particular group |
| 86 |
has any members on an attached network. These two messages are |
| 87 |
differentiated by the Group Address." |
| 88 |
|
| 89 |
I hope this is of any help, |
| 90 |
Patric |
Archives