Hello I'm trying to understand a piece of Wireshark output. Every five seconds it records this same transaction, showing the router broadcasting to 192.168.1.255 on UDP port 9246:

192.168.1.1 192.168.1.255 UDP 100 Source port: 9246 Destination port: 9246

The follow UDP stream gives lines of this:

"ism://192.168.1.1:9246/?nameGateway=GwcVoice&sslMthd=none.ism://192.168.1.1:9246/?"

Any clues as to what might be causing this behaviour much appreciated.

D

asked 30 Mar '13, 08:30

Sysadmin43's gravatar image

Sysadmin43
11112
accept rate: 0%


not sure but I think this might be Nortel protocol. Gateway Controller (GWC) acts as a call processing protocol converter between the CS 2000 series messages and the open-standard H.248 messages used by the MG 9000 and the Universal Audio Server (UAS) Integrated Services Module (ISM) provides conference circuits, enhanced digital announcement machine (EDRAM) announcements, and line test, trunk test, and office alarm unit interfaces

link

answered 30 Mar '13, 09:46

mrEEde's gravatar image

mrEEde
2.1k51238
accept rate: 20%

Hmm..."ism://" doesn't show up in any of the various URI/URL scheme references.

Just guessing from the content, I'd say that your wireless router has some sort of VoIP support, and that these broadcasts are its hooks for server/gateway discovery by clients. Many wireless routers support VoIP in the ISM band...

You could prove/disprove this by disabling VoIP support in the wireless router and grabbing a fresh capture.

link

answered 30 Mar '13, 10:41

wesmorgan1's gravatar image

wesmorgan1
36671019
accept rate: 5%

edited 30 Mar '13, 10:42

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×97
×1

Asked: 30 Mar '13, 08:30

Seen: 1,744 times

Last updated: 30 Mar '13, 10:42

powered by OSQA