This is our old Q&A Site. Please post any new questions and answers at

Hello I'm trying to understand a piece of Wireshark output. Every five seconds it records this same transaction, showing the router broadcasting to on UDP port 9246: UDP 100 Source port: 9246 Destination port: 9246

The follow UDP stream gives lines of this:


Any clues as to what might be causing this behaviour much appreciated.


asked 30 Mar '13, 08:30

Sysadmin43's gravatar image

accept rate: 0%

not sure but I think this might be Nortel protocol. Gateway Controller (GWC) acts as a call processing protocol converter between the CS 2000 series messages and the open-standard H.248 messages used by the MG 9000 and the Universal Audio Server (UAS) Integrated Services Module (ISM) provides conference circuits, enhanced digital announcement machine (EDRAM) announcements, and line test, trunk test, and office alarm unit interfaces

permanent link

answered 30 Mar '13, 09:46

mrEEde's gravatar image

accept rate: 20%

Hmm..."ism://" doesn't show up in any of the various URI/URL scheme references.

Just guessing from the content, I'd say that your wireless router has some sort of VoIP support, and that these broadcasts are its hooks for server/gateway discovery by clients. Many wireless routers support VoIP in the ISM band...

You could prove/disprove this by disabling VoIP support in the wireless router and grabbing a fresh capture.

permanent link

answered 30 Mar '13, 10:41

wesmorgan1's gravatar image

accept rate: 4%

edited 30 Mar '13, 10:42

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Mar '13, 08:30

question was seen: 5,979 times

last updated: 30 Mar '13, 10:42

p​o​w​e​r​e​d by O​S​Q​A