I have a bunch of Apple devices and a TI CC3000 WiFi module. I made the TI device an mDNS advertiser. When I capture packets with Wireshark, I see the mDNS packets from TI are blue color (UDP color code), all other mDNS packets from other devices are Red with white text (TTL low or unexpected). Using mDNS Watcher app, I can see all Bonjour supported devices but not the TI device. Is this color code telling me something that I am missing? asked 08 Jul '14, 15:29  lilyhack |
One Answer:
O.K. the color rule for "TTL low or unexpected" is this
So, the matching rule could be
So, the destination address of the mDNS traffic is probably not 224.0.0.251. Is that right? If so, that could explain why you don't see the TI device with your mDNS Watcher app. Regards answered 08 Jul '14, 17:39  Kurt Knochner ♦ edited 08 Jul '14, 17:44 showing 5 of 6 show 1 more comments |
no, the destination address for all the mDNS traffic (including TI) is 224.0.0.251
can you post a sample capture file on https://appliance.cloudshark.org/upload/ (or google drive or dropbox)? One frame that is marked like that, should be O.K.
EDIT: Please also add another frame (marked differently) as well!
Here it is https://www.cloudshark.org/captures/d72b612860b5 I have mDNS packets only of those two types (blue & red)
Although cloudshark.org shows the red coloring for frames 354, 355, etc. this is not the case with my installation of Wireshark, which is the latest development build on Windows 7 x64 (Version 1.12.0-rc2-125-g8a47b3a (v1.12.0-rc2-125-g8a47b3a from master-1.12).
The only difference between the marked and unmarked frames is the TTL.
unmarked: 1
marked: 255
Based on the coloring rule (see my answer) and the TTL in the marked frames (255), they do not deserve the 'Low TTL or unexpected' coloring.
So, I believe this is a bug of the Wireshark version you are using (and probably also cloudshark.org).
Pleas upgrade your Wireshark version and the (pseudo) problem should go away.
I am using the latest release build 1.10.8. Upgrade to development version 1.12 resolves the color issue. Thanks.
Good.
Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).