This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is “Standard query 0x0000 PTR, _ippd._tcp.local, “QM” question PTR” ? My script hangs on this packet .

0

I have implemented socket client to communicate with my device from pc. The program successfully establishes the communication with device and starts to send/recieve packets but then it hangs. Here the Wireshark log where it has been hanged alt text

And here it the Frame 191 whereit hangs

Frame 191: 87 bytes on wire (696 bits), 87 bytes captured (696 bits) on interface 0 Interface id: 0 (wlx30b5c2125754) Encapsulation type: Ethernet (1) Arrival Time: Apr 24, 2017 05:14:09.911227896 +04 [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1492996449.911227896 seconds [Time delta from previous captured frame: 0.524355526 seconds] [Time delta from previous displayed frame: 0.524355526 seconds] [Time since reference or first frame: 3.809895894 seconds] Frame Number: 191 Frame Length: 87 bytes (696 bits) Capture Length: 87 bytes (696 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:mdns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Tp-LinkT_12:57:54 (30:b5:c2:12:57:54), Dst: IPv4mcast_fb (01:00:5e:00:00:fb) Destination: IPv4mcast_fb (01:00:5e:00:00:fb) Source: Tp-LinkT_12:57:54 (30:b5:c2:12:57:54) Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 172.16.87.84, Dst: 224.0.0.251 0100 …. = Version: 4 …. 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) Total Length: 73 Identification: 0xf52d (62765) Flags: 0x02 (Don't Fragment) 0… …. = Reserved bit: Not set .1.. …. = Don't fragment: Set ..0. …. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (17) Header checksum: 0xa215 [correct] [Header checksum status: Good] [Calculated Checksum: 0xa215] Source: 172.16.87.84 Destination: 224.0.0.251 [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: 5353, Dst Port: 5353 Multicast Domain Name System (query) Transaction ID: 0x0000 Flags: 0x0000 Standard query 0… …. …. …. = Response: Message is a query .000 0… …. …. = Opcode: Standard query (0) …. ..0. …. …. = Truncated: Message is not truncated …. …0 …. …. = Recursion desired: Don't do query recursively …. …. .0.. …. = Z: reserved (0) …. …. …0 …. = Non-authenticated data: Unacceptable Questions: 2 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries _ipps._tcp.local: type PTR, class IN, "QM" question Name: _ipps._tcp.local [Name Length: 16] [Label Count: 3] Type: PTR (domain name PoinTeR) (12) .000 0000 0000 0001 = Class: IN (0x0001) 0… …. …. …. = "QU" question: False _ipp._tcp.local: type PTR, class IN, "QM" question Name: _ipp._tcp.local [Name Length: 15] [Label Count: 3] Type: PTR (domain name PoinTeR) (12) .000 0000 0000 0001 = Class: IN (0x0001) 0… …. …. …. = "QU" question: False

192 3.816102710    fe80::2dad:1d24:560e:dfff ff02::fb              MDNS     107    Standard query 0x0000 PTR _ipps._tcp.local, &quot;QM&quot; question PTR _ipp._tcp.local, &quot;QM&quot; question</code></pre></div><div id="question-tags" class="tags-container tags"><span class="post-tag tag-link-tcp" rel="tag" title="see questions tagged &#39;tcp&#39;">tcp</span> <span class="post-tag tag-link-socket" rel="tag" title="see questions tagged &#39;socket&#39;">socket</span> <span class="post-tag tag-link-stream" rel="tag" title="see questions tagged &#39;stream&#39;">stream</span> <span class="post-tag tag-link-wireshark" rel="tag" title="see questions tagged &#39;wireshark&#39;">wireshark</span></div><div id="question-controls" class="post-controls"></div><div class="post-update-info-container"><div class="post-update-info post-update-info-user"><p>asked <strong>24 Apr '17, 02:22</strong></p><img src="https://secure.gravatar.com/avatar/4cd73fb7c739ce6825247b45d3298096?s=32&amp;d=identicon&amp;r=g" class="gravatar" width="32" height="32" alt="Vardan9&#39;s gravatar image" /><p><span>Vardan9</span><br />

6114
accept rate: 0%

edited 24 Apr ‘17, 02:27


One Answer:

1

This is a mDNS query of a device using Zeroconf/Bonjour trying to find a printer service on the local network.

As your haven't given any information about your client application it's hard to say if the mDNS packets affects your application.

answered 24 Apr '17, 04:10

Uli's gravatar image

Uli
9031515
accept rate: 29%