[solved] UDP broadcasts

[furom]

Hi,

I see two broadcasts in my log I would like to know more about;

239.255.255.250:1900 UDP

Looking it up I find a "Simple Service Discovery Protocol (SSDP)", which seems to be part of UPnP. Should this normally be allowed or how I can determine what it's about?

I also see

255.255.255.255:1900 UDP

which I was not able to google.

Thanks

[rcoleman-netgate]

@furom 255.255.255.255 is broadcast for any network so that IP is nothing specific.

239.255.255.250 is a multicast address IIRC.

UDP1900 brings up this: https://www.grc.com/port_1900.htm

[furom]

@rcoleman-netgate said in UDP broadcasts:

@furom 255.255.255.255 is broadcast for any network so that IP is nothing specific.

239.255.255.250 is a multicast address IIRC.

UDP1900 brings up this: https://www.grc.com/port_1900.htm

Thanks! After reading on GRC and also googled "multicast address IIRC", it looks to be local to my network, right? I do get some devices broadcast for something, and is probably all good, but can I be certain this is local to my network(s)? It says "within an organization", so guess it could be interpreted that way?

[rcoleman-netgate]

@furom Multicast is typically always local to your network. Something is sending that out. Open Wireshark and hunt it down. they'll have a MAC you can reference.

Multicast is also generally unroutable. https://en.wikipedia.org//wiki/Broadcast,_unknown-unicast_and_multicast_traffic