[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: what is this in tcpdump?



On Wed, Jul 25, 2007 at 04:23:27PM -0700, David Brodbeck wrote:
>
> On Jul 25, 2007, at 3:47 PM, Andrew Sackville-West wrote:
>
>> I get a lot of these in my tcpdump on my machine:
>>
>> 15:45:47.427003 IP basement.ipp > 192.168.1.31.ipp: UDP, length 129
>> 15:45:48.427004 IP basement.ipp > 192.168.1.31.ipp: UDP, length 167
>>
>> 192.168.1.31 is my broadcast address, and basement is me. They usually
>>           come in pairs like this, though sometimes split up by other
>>           traffic. Always, though, its one of length 129 and one of
>>           167
>
> IPP is Internet Printing Protocol.  My guess is CUPS is probably set to 
> broadcast to other systems so they can automatically discover printers.


doh. thanks. I knew it was something like that... 

I had some spurious net traffic today on my local machine which has a
couple ports forwarded to it. I had the torrent ports still open from
downloading an RMS talk the other day, and it was causing all sorts of
activity. The short of it is, I ended up watching my tcpdump for a
while and... well, you start to freak out about stuff...

A

Attachment: signature.asc
Description: Digital signature


Reply to: