random data going to broadcast

asked 2019-11-13 09:46:01 +0000

kg
3 ●1

Hi , I am analysing a PCAP and some random Data is going to the Broadcast Address 255.255.255.255 and also the Gateway Broadcast X.X.X.255.

I don't have access to the host to see which service it is generated from but from port searching in the internet it seems that traffic to Gateway Broadcast X.X.X.255 ist service encore with port 1740. Can't seem to find what this service does! Also the same is happening in Port 1741,1742 And 1743. Pakte Bytes are c50b400100100061

Traffic going to Broadcast IP 255.255.255.255 is generated on Port 49166 and Dst 27127 both unassigned Ports and has this byte stream. baf35b2f7e03757d6f0f29533327c637726d9f336a75766cf988504080726166f6732adc53

I've tried all the Decode and Show As Options from Wireshark but cant seem to know what it is. Has someone had the same Problem maybe?

edit retag flag offensive close merge delete

Comments

Can you share a capture containing the packets in question?? Use a public file share such as Google Drive, DropBox etc. and post a link to it back here.

grahamb ( 2019-11-13 11:05:27 +0000 )edit

https://drive.google.com/file/d/1KK-f...

I have activated all the protocol dissectors in Wireshark with the hope that someone can interpret it ...

kg ( 2019-11-13 11:41:20 +0000 )edit

add a comment

Comments

it does but I couldn't pinpoint what is generating it. May I ask how did you find out, because I have googled extensively and would gladly be better in my Wireshark skills.

kg ( 2019-11-13 12:02:49 +0000 )edit

I googled UDP "27127" and UDP "1740". Note the quotes around the port numbers to only show pages that included those specific numbers. I suspected some form of discovery protocol because UDP broadcasts are a very common way of doing that.

You could also look at the originating MAC address of the broadcasts to determine which host is sending them and then use netstat on the machine to determine the process.

grahamb ( 2019-11-13 12:14:07 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

random data going to broadcast

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

random data going to broadcast edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

random data going to broadcast