Irritating Linksys WAP Broadcast on Wired Network

  1. Got a Linksys WAP54G to connect into existing wired network, IP =
192.168.1.24, firmware = v2.07
  1. Got a Linksys WRT54G to extend range, IP = 192.168.1.23, firmware = v1.04.
  2. Noticed excessive traffic on wired network upon activation of WAP54G.
  3. Ran a sniffer and discovered flood of UDP packets from both these devices to a 234.2.2.2 address (and no responses).
  4. Ping of 234.2.2.2 elicits response from both (and only) these devices?!?

Is this some kind of Linksys family chat? Would appreciate any insight, especially how to turn it off. Sample sniffer output follows. Tks.

Frame 2 (63 bytes on wire, 63 bytes captured) Arrival Time: Jan 10, 2005 21:08:25.947330000 Time delta from previous packet: 0.001133000 seconds Time since reference or first frame: 0.001133000 seconds Frame Number: 2 Packet Length: 63 bytes Capture Length: 63 bytes Ethernet II, Src: 00:0f:66:77:03:0a, Dst: 01:00:5e:02:02:02 Destination: 01:00:5e:02:02:02 (01:00:5e:02:02:02) Source: 00:0f:66:77:03:0a (Cisco-Li_77:03:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 192.168.1.23 (192.168.1.23), Dst Addr:

234.2.2.2 (234.2.2.2) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 49 Identification: 0x0000 (0) Flags: 0x04 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 3 Protocol: UDP (0x11) Header checksum: 0xc9f8 (correct) Source: 192.168.1.23 (192.168.1.23) Destination: 234.2.2.2 (234.2.2.2) User Datagram Protocol, Src Port: 14675 (14675), Dst Port: 14675 (14675) Source port: 14675 (14675) Destination port: 14675 (14675) Length: 29 Checksum: 0x0540 (correct) Data (21 bytes)

0000 4d 61 63 57 72 69 74 65 72 53 65 61 72 63 68 00 MacWriterSearch.

0010 0f 66 77 03 0a .fw..

Frame 3 (75 bytes on wire, 75 bytes captured) Arrival Time: Jan 10, 2005 21:08:25.948251000 Time delta from previous packet: 0.000921000 seconds Time since reference or first frame: 0.002054000 seconds Frame Number: 3 Packet Length: 75 bytes Capture Length: 75 bytes Ethernet II, Src: 00:0f:66:11:8f:7b, Dst: 01:00:5e:02:02:02 Destination: 01:00:5e:02:02:02 (01:00:5e:02:02:02) Source: 00:0f:66:11:8f:7b (Cisco-Li_11:8f:7b) Type: IP (0x0800) Internet Protocol, Src Addr: 192.168.1.24 (192.168.1.24), Dst Addr:

234.2.2.2 (234.2.2.2) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 61 Identification: 0x0000 (0) Flags: 0x04 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 3 Protocol: UDP (0x11) Header checksum: 0xc9eb (correct) Source: 192.168.1.24 (192.168.1.24) Destination: 234.2.2.2 (234.2.2.2) User Datagram Protocol, Src Port: 14675 (14675), Dst Port: 14675 (14675) Source port: 14675 (14675) Destination port: 14675 (14675) Length: 41 Checksum: 0xf99a (correct) Data (33 bytes)

0000 4d 61 63 57 72 69 74 65 72 53 65 61 72 63 68 00 MacWriterSearch.

0010 0f 66 11 8f 7b 00 00 00 00 00 00 00 00 00 00 00 .f..{........... 0020 00 .
Reply to
Phil Houstoun
Loading thread data ...

Correction: Change all references to WRT54G to WRE54G.

Addendum:

If I unplug the WRE54G, said traffic > 1. Got a Linksys WAP54G to connect into existing wired network, IP =

Reply to
Phil Houstoun

On Mon, 10 Jan 2005 23:26:46 -0500, Phil Houstoun spoketh

It's a multi-cast IP address, which is why you are also seeing it on the wired side. Looks like one of your wireless devices are looking for something.

Don't know if this will be helpful to you at all:

formatting link
Lars M. Hansen
formatting link
'badnews' with 'news' in e-mail address)

Reply to
Lars M. Hansen

Reply to
Peter Pan

Reply to
Phil Houstoun

Yes, one day that traffic is gonna make your security gate close on your car and make the door slam on your fingers. Don't install Doom 4. Specially not when you have Linksys routers and security systems.

Reply to
Coenraad Loubser

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.