This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Odd UDP output from router to 192.168.1.255 – any ideas?

0

Hello I'm trying to understand a piece of Wireshark output. Every five seconds it records this same transaction, showing the router broadcasting to 192.168.1.255 on UDP port 9246:

192.168.1.1 192.168.1.255 UDP 100 Source port: 9246 Destination port: 9246

The follow UDP stream gives lines of this:

"ism://192.168.1.1:9246/?nameGateway=GwcVoice&sslMthd=none.ism://192.168.1.1:9246/?"

Any clues as to what might be causing this behaviour much appreciated.

D

asked 30 Mar '13, 08:30

Sysadmin43's gravatar image

Sysadmin43
11112
accept rate: 0%


2 Answers:

0

not sure but I think this might be Nortel protocol. Gateway Controller (GWC) acts as a call processing protocol converter between the CS 2000 series messages and the open-standard H.248 messages used by the MG 9000 and the Universal Audio Server (UAS) Integrated Services Module (ISM) provides conference circuits, enhanced digital announcement machine (EDRAM) announcements, and line test, trunk test, and office alarm unit interfaces

answered 30 Mar '13, 09:46

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

0

Hmm..."ism://" doesn't show up in any of the various URI/URL scheme references.

Just guessing from the content, I'd say that your wireless router has some sort of VoIP support, and that these broadcasts are its hooks for server/gateway discovery by clients. Many wireless routers support VoIP in the ISM band...

You could prove/disprove this by disabling VoIP support in the wireless router and grabbing a fresh capture.

answered 30 Mar '13, 10:41

wesmorgan1's gravatar image

wesmorgan1
411101221
accept rate: 4%

edited 30 Mar '13, 10:42