This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

broadcast to network addresses

0

appology for my previous mail..the pad got messed up here is the trace. Can someone explain it to me please?? I dont undrestand why the reply from the server is an ip broadcast and at the same time as hardware broadcast 255.255.255.255

Many thanks

alt text

asked 04 Dec '13, 14:06

Mehran's gravatar image

Mehran
11223
accept rate: 0%


One Answer:

0

a quick google search (I'm sure you did that too!!) reveals, that the ports 6666 and 6667 with multicast traffic are related to the Symantec Ghostcast server (system imaging/backup). So, if you are using that software in your company, don't care about those packets, as they are 'normal'.

I dont undrestand why the reply from the server is an ip broadcast

I don't understand it either, but that's also normal, as I don't know the product and hence I have no idea what they (Symantec) are doing in their protocol. I think this would be a perfect question for their support people ;-))

appology for my previous mail..

No problem. I deleted your other question.

Regards
Kurt

answered 04 Dec '13, 14:19

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Port 6666 and 6667 is used by an application where devices find each other. Basically the client hook up to the device which is operates in two parts. A WEB server and streamer.

(04 Dec '13, 14:21) Mehran

So, this is not Symantec Ghostcast?

used by an application where devices find each other.

Is it your product, did you develop it?

A WEB server and streamer.

why did they (whoever developed the application) choose UDP for a web server?

I dont undrestand why the reply from the server is an ip broadcast and at the same time as hardware broadcast 255.255.255.255

That's a question, only the developer of that software/application/device can answer, as there is nothing network related (I know of) that would cause such a behavior.

If you have any information about the products/software used, please post it here, otherwise we can only speculate.

(04 Dec '13, 14:23) Kurt Knochner ♦

Well guys I think I figured it out!!! This part of the program dicover all embedded devices on the network even if they have a different IP address than 192.168.1.xx
The 192.168.1.255 get the respond from 192.168.1.xx while 255.255.255.255 gets all others. remember the client application is listenning to the port 6666 while all other devices are on 6667.

Kurt thanks for your attempt mate.

(04 Dec '13, 14:40) Mehran