Irritating Linksys WAP Broadcast on Wired Network

1. Got a Linksys WAP54G to connect into existing wired network, IP =
192.168.1.24, firmware = v2.07
2. Got a Linksys WRT54G to extend range, IP = 192.168.1.23, firmware =
v1.04.
3. Noticed excessive traffic on wired network upon activation of WAP54G.
4. Ran a sniffer and discovered flood of UDP packets from both these
devices to a 234.2.2.2 address (and no responses).
5. Ping of 234.2.2.2 elicits response from both (and only) these devices?!?


Is this some kind of Linksys family chat? Would appreciate any insight,
especially how to turn it off. Sample sniffer output follows. Tks.


Frame 2 (63 bytes on wire, 63 bytes captured)
Arrival Time: Jan 10, 2005 21:08:25.947330000
Time delta from previous packet: 0.001133000 seconds
Time since reference or first frame: 0.001133000 seconds
Frame Number: 2
Packet Length: 63 bytes
Capture Length: 63 bytes
Ethernet II, Src: 00:0f:66:77:03:0a, Dst: 01:00:5e:02:02:02
Destination: 01:00:5e:02:02:02 (01:00:5e:02:02:02)
Source: 00:0f:66:77:03:0a (Cisco-Li_77:03:0a)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.23 (192.168.1.23), Dst Addr:
234.2.2.2 (234.2.2.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 49
Identification: 0x0000 (0)
Flags: 0x04
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 3
Protocol: UDP (0x11)
Header checksum: 0xc9f8 (correct)
Source: 192.168.1.23 (192.168.1.23)
Destination: 234.2.2.2 (234.2.2.2)
User Datagram Protocol, Src Port: 14675 (14675), Dst Port: 14675 (14675)
Source port: 14675 (14675)
Destination port: 14675 (14675)
Length: 29
Checksum: 0x0540 (correct)
Data (21 bytes)


0000 4d 61 63 57 72 69 74 65 72 53 65 61 72 63 68 00 MacWriterSearch.
0010 0f 66 77 03 0a .fw..

Frame 3 (75 bytes on wire, 75 bytes captured)
Arrival Time: Jan 10, 2005 21:08:25.948251000
Time delta from previous packet: 0.000921000 seconds
Time since reference or first frame: 0.002054000 seconds
Frame Number: 3
Packet Length: 75 bytes
Capture Length: 75 bytes
Ethernet II, Src: 00:0f:66:11:8f:7b, Dst: 01:00:5e:02:02:02
Destination: 01:00:5e:02:02:02 (01:00:5e:02:02:02)
Source: 00:0f:66:11:8f:7b (Cisco-Li_11:8f:7b)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.24 (192.168.1.24), Dst Addr:
234.2.2.2 (234.2.2.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 61
Identification: 0x0000 (0)
Flags: 0x04
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 3
Protocol: UDP (0x11)
Header checksum: 0xc9eb (correct)
Source: 192.168.1.24 (192.168.1.24)
Destination: 234.2.2.2 (234.2.2.2)
User Datagram Protocol, Src Port: 14675 (14675), Dst Port: 14675 (14675)
Source port: 14675 (14675)
Destination port: 14675 (14675)
Length: 41
Checksum: 0xf99a (correct)
Data (33 bytes)


0000 4d 61 63 57 72 69 74 65 72 53 65 61 72 63 68 00 MacWriterSearch.
0010 0f 66 11 8f 7b 00 00 00 00 00 00 00 00 00 00 00 .f..{...........
0020 00 .

Correction: Change all references to WRT54G to WRE54G.

Addendum:

If I unplug the WRE54G, said traffic on the wired network stops.
Apparently, it's some sort of sync between the WAP and the WRE but,
again, should this be broadcast on the wired side as well?

Phil Houstoun wrote:
> 1. Got a Linksys WAP54G to connect into existing wired network, IP =
> 192.168.1.24, firmware = v2.07
> 2. Got a Linksys WRT54G to extend range, IP = 192.168.1.23, firmware =
> v1.04.
> 3. Noticed excessive traffic on wired network upon activation of WAP54G.
> 4. Ran a sniffer and discovered flood of UDP packets from both these
> devices to a 234.2.2.2 address (and no responses).
> 5. Ping of 234.2.2.2 elicits response from both (and only) these devices?!?
>
>
> Is this some kind of Linksys family chat? Would appreciate any insight,
> especially how to turn it off. Sample sniffer output follows. Tks.
>
>
> Frame 2 (63 bytes on wire, 63 bytes captured)
> Arrival Time: Jan 10, 2005 21:08:25.947330000
> Time delta from previous packet: 0.001133000 seconds
> Time since reference or first frame: 0.001133000 seconds
> Frame Number: 2
> Packet Length: 63 bytes
> Capture Length: 63 bytes
> Ethernet II, Src: 00:0f:66:77:03:0a, Dst: 01:00:5e:02:02:02
> Destination: 01:00:5e:02:02:02 (01:00:5e:02:02:02)
> Source: 00:0f:66:77:03:0a (Cisco-Li_77:03:0a)
> Type: IP (0x0800)
> Internet Protocol, Src Addr: 192.168.1.23 (192.168.1.23), Dst Addr:
> 234.2.2.2 (234.2.2.2)
> Version: 4
> Header length: 20 bytes
> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
> 0000 00.. = Differentiated Services Codepoint: Default (0x00)
> .... ..0. = ECN-Capable Transport (ECT): 0
> .... ...0 = ECN-CE: 0
> Total Length: 49
> Identification: 0x0000 (0)
> Flags: 0x04
> 0... = Reserved bit: Not set
> .1.. = Don't fragment: Set
> ..0. = More fragments: Not set
> Fragment offset: 0
> Time to live: 3
> Protocol: UDP (0x11)
> Header checksum: 0xc9f8 (correct)
> Source: 192.168.1.23 (192.168.1.23)
> Destination: 234.2.2.2 (234.2.2.2)
> User Datagram Protocol, Src Port: 14675 (14675), Dst Port: 14675 (14675)
> Source port: 14675 (14675)
> Destination port: 14675 (14675)
> Length: 29
> Checksum: 0x0540 (correct)
> Data (21 bytes)
>
>
> 0000 4d 61 63 57 72 69 74 65 72 53 65 61 72 63 68 00 MacWriterSearch.
> 0010 0f 66 77 03 0a .fw..
>
> Frame 3 (75 bytes on wire, 75 bytes captured)
> Arrival Time: Jan 10, 2005 21:08:25.948251000
> Time delta from previous packet: 0.000921000 seconds
> Time since reference or first frame: 0.002054000 seconds
> Frame Number: 3
> Packet Length: 75 bytes
> Capture Length: 75 bytes
> Ethernet II, Src: 00:0f:66:11:8f:7b, Dst: 01:00:5e:02:02:02
> Destination: 01:00:5e:02:02:02 (01:00:5e:02:02:02)
> Source: 00:0f:66:11:8f:7b (Cisco-Li_11:8f:7b)
> Type: IP (0x0800)
> Internet Protocol, Src Addr: 192.168.1.24 (192.168.1.24), Dst Addr:
> 234.2.2.2 (234.2.2.2)
> Version: 4
> Header length: 20 bytes
> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
> 0000 00.. = Differentiated Services Codepoint: Default (0x00)
> .... ..0. = ECN-Capable Transport (ECT): 0
> .... ...0 = ECN-CE: 0
> Total Length: 61
> Identification: 0x0000 (0)
> Flags: 0x04
> 0... = Reserved bit: Not set
> .1.. = Don't fragment: Set
> ..0. = More fragments: Not set
> Fragment offset: 0
> Time to live: 3
> Protocol: UDP (0x11)
> Header checksum: 0xc9eb (correct)
> Source: 192.168.1.24 (192.168.1.24)
> Destination: 234.2.2.2 (234.2.2.2)
> User Datagram Protocol, Src Port: 14675 (14675), Dst Port: 14675 (14675)
> Source port: 14675 (14675)
> Destination port: 14675 (14675)
> Length: 41
> Checksum: 0xf99a (correct)
> Data (33 bytes)
>
>
> 0000 4d 61 63 57 72 69 74 65 72 53 65 61 72 63 68 00 MacWriterSearch.
> 0010 0f 66 11 8f 7b 00 00 00 00 00 00 00 00 00 00 00 .f..{...........
> 0020 00 .
>
>
>
>
>
>
>

On Mon, 10 Jan 2005 23:26:46 -0500, Phil Houstoun spoketh

>
>
>Correction: Change all references to WRT54G to WRE54G.
>
>Addendum:
>
> If I unplug the WRE54G, said traffic on the wired network stops.
>Apparently, it's some sort of sync between the WAP and the WRE but,
>again, should this be broadcast on the wired side as well?
>
>Phil Houstoun wrote:
>> 1. Got a Linksys WAP54G to connect into existing wired network, IP =
>> 192.168.1.24, firmware = v2.07
>> 2. Got a Linksys WRT54G to extend range, IP = 192.168.1.23, firmware =
>> v1.04.
>> 3. Noticed excessive traffic on wired network upon activation of WAP54G.
>> 4. Ran a sniffer and discovered flood of UDP packets from both these
>> devices to a 234.2.2.2 address (and no responses).
>> 5. Ping of 234.2.2.2 elicits response from both (and only) these devices?!?
>>

It's a multi-cast IP address, which is why you are also seeing it on the
wired side. Looks like one of your wireless devices are looking for
something.

Don't know if this will be helpful to you at all:
http://www.dslreports.com/forum/rema...8958~mode=flat

Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'news' in e-mail address)

Check your model number again... A WRE is a Wireless Range Extender... *NOT*
a AP

Lars M. Hansen wrote:
> On Mon, 10 Jan 2005 23:26:46 -0500, Phil Houstoun spoketh
>
>>
>>
>> Correction: Change all references to WRT54G to WRE54G.
>>
>> Addendum:
>>
>> If I unplug the WRE54G, said traffic on the wired network stops.
>> Apparently, it's some sort of sync between the WAP and the WRE but,
>> again, should this be broadcast on the wired side as well?
>>
>> Phil Houstoun wrote:
>>> 1. Got a Linksys WAP54G to connect into existing wired network, IP =
>>> 192.168.1.24, firmware = v2.07
>>> 2. Got a Linksys WRT54G to extend range, IP = 192.168.1.23,
>>> firmware = v1.04.
>>> 3. Noticed excessive traffic on wired network upon activation of
>>> WAP54G.
>>> 4. Ran a sniffer and discovered flood of UDP packets from both these
>>> devices to a 234.2.2.2 address (and no responses).
>>> 5. Ping of 234.2.2.2 elicits response from both (and only) these
>>> devices?!?
>>>
>
> It's a multi-cast IP address, which is why you are also seeing it on
> the wired side. Looks like one of your wireless devices are looking
> for something.
>
> Don't know if this will be helpful to you at all:
> http://www.dslreports.com/forum/rema...8958~mode=flat
>
> Lars M. Hansen
> http://www.hansenonline.net
> (replace 'badnews' with 'news' in e-mail address)

Yes, to be clear, I have a WAP54G (Wireless Access Point) and a WRE54G
(Wireless Range Extender), both by Linksys.

Peter Pan wrote:
> Check your model number again... A WRE is a Wireless Range Extender... *NOT*
> a AP
>
> Lars M. Hansen wrote:
>
>>On Mon, 10 Jan 2005 23:26:46 -0500, Phil Houstoun spoketh
>>
>>
>>>
>>>Correction: Change all references to WRT54G to WRE54G.
>>>
>>>Addendum:
>>>
>>> If I unplug the WRE54G, said traffic on the wired network stops.
>>>Apparently, it's some sort of sync between the WAP and the WRE but,
>>>again, should this be broadcast on the wired side as well?
>>>
>>>Phil Houstoun wrote:
>>>
>>>>1. Got a Linksys WAP54G to connect into existing wired network, IP =
>>>>192.168.1.24, firmware = v2.07
>>>>2. Got a Linksys WRT54G to extend range, IP = 192.168.1.23,
>>>>firmware = v1.04.
>>>>3. Noticed excessive traffic on wired network upon activation of
>>>>WAP54G.
>>>>4. Ran a sniffer and discovered flood of UDP packets from both these
>>>>devices to a 234.2.2.2 address (and no responses).
>>>>5. Ping of 234.2.2.2 elicits response from both (and only) these
>>>>devices?!?
>>>>
>>
>>It's a multi-cast IP address, which is why you are also seeing it on
>>the wired side. Looks like one of your wireless devices are looking
>>for something.
>>
>>Don't know if this will be helpful to you at all:
>>http://www.dslreports.com/forum/rema...8958~mode=flat
>>
>>Lars M. Hansen
>>http://www.hansenonline.net
>>(replace 'badnews' with 'news' in e-mail address)
>
>
>

Yes, one day that traffic is gonna make your security gate close on your car
and make the door slam on your fingers. Don't install Doom 4. Specially not
when you have Linksys routers and security systems.