UDP Port 889 Broadcast (ip.ttl "Time to Live" only 1)

asked 2020-03-06 16:12:10 +0000

Chuckc
2858 ●5 ●567 ●19

updated 2021-06-27 14:55:02 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

I found packets like this on my home LAN.
A Google search "udp port 889 broadcast" turns up two good leads, one being the old Wireshark Q&A site.

https://osqa-ask.wireshark.org/questi...

The other site
https://forum.netgate.com/topic/11296...

has a good answer (if you scroll down far enough) but I thought in the spirit of DenverCoder9 it would be good to add a pcap, some screen shots of the diagnosis and notes.

answered 2020-03-06 16:21:17 +0000

Chuckc
2858 ●5 ●567 ●19

pcap showing broadcast about every 12 seconds
https://drive.google.com/file/d/1TeAt...
The data is anonymized. Mainly contains 0's.

sysinternals Process Monitor running on source machine image description

Options -> Show Resolved Network Addresses
Filter: Path Contains 889
Show Network Activity

sysinternals TCPView - it happens to be listening on the same port image description

Since it's listening you could also find it with netstat -anbp UDP

edit flag offensive delete link

Comments

I use cFos and have the same traffic. Thanks for the pcap cause I was looking searching for info on 889. Yesterday, I found it connects to a provider in Germany in the pfSense logs so want to add it to the post. 144.76.59.84 , Data Center/Web Hosting/Transit, hetzner.de Germany. cfos.de,

kiowa ( 2021-02-18 15:18:40 +0000 )edit

Motherboard upgrade at our house included cFos. Documentation here: https://www.cfos.de/en/cfosspeed/refe...

Chuckc ( 2021-08-13 15:15:26 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

UDP Port 889 Broadcast (ip.ttl "Time to Live" only 1)

1 Answer

Comments

Your Answer

Question Tools

Stats

UDP Port 889 Broadcast (ip.ttl "Time to Live" only 1) edit

1 Answer

Comments

Your Answer

Question Tools

Stats

UDP Port 889 Broadcast (ip.ttl "Time to Live" only 1)