Re: what is this in tcpdump?

[David Brodbeck <brodbd@u.washington.edu>]

On Jul 25, 2007, at 3:47 PM, Andrew Sackville-West wrote:

> I get a lot of these in my tcpdump on my machine:
>
> 15:45:47.427003 IP basement.ipp > 192.168.1.31.ipp: UDP, length 129
> 15:45:48.427004 IP basement.ipp > 192.168.1.31.ipp: UDP, length 167
>
> 192.168.1.31 is my broadcast address, and basement is me. They usually
>           come in pairs like this, though sometimes split up by other
>           traffic. Always, though, its one of length 129 and one of
>           167

IPP is Internet Printing Protocol.  My guess is CUPS is probably set  
to broadcast to other systems so they can automatically discover  
printers.