Hello I'm trying to understand a piece of Wireshark output. Every five seconds it records this same transaction, showing the router broadcasting to 192.168.1.255 on UDP port 9246: 192.168.1.1 192.168.1.255 UDP 100 Source port: 9246 Destination port: 9246 The follow UDP stream gives lines of this: "ism://192.168.1.1:9246/?nameGateway=GwcVoice&sslMthd=none.ism://192.168.1.1:9246/?" Any clues as to what might be causing this behaviour much appreciated. D asked 30 Mar '13, 08:30  Sysadmin43 |
2 Answers:
not sure but I think this might be Nortel protocol. Gateway Controller (GWC) acts as a call processing protocol converter between the CS 2000 series messages and the open-standard H.248 messages used by the MG 9000 and the Universal Audio Server (UAS) Integrated Services Module (ISM) provides conference circuits, enhanced digital announcement machine (EDRAM) announcements, and line test, trunk test, and office alarm unit interfaces answered 30 Mar '13, 09:46  mrEEde |
Hmm..."ism://" doesn't show up in any of the various URI/URL scheme references. Just guessing from the content, I'd say that your wireless router has some sort of VoIP support, and that these broadcasts are its hooks for server/gateway discovery by clients. Many wireless routers support VoIP in the ISM band... You could prove/disprove this by disabling VoIP support in the wireless router and grabbing a fresh capture. answered 30 Mar '13, 10:41  wesmorgan1 edited 30 Mar '13, 10:42 |
