7

Bellow I show the output of my tcpdump What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)?

I am especially interested in the meaning of what this mean:

PTR (QM)? _airplay._tcp.local.
PTR (QM)? _raop._tcp.local.
PTR (QM)? _sleep-proxy._udp.local.
PTR (QM)? _uscan._tcp.local.
PTR (QM)? _uscans._tcp.local.
PTR (QM)? _ippusb._tcp.local.
PTR (QM)? _scanner._tcp.local.
PTR (QM)? _ipp._tcp.local.
PTR (QM)? _ipps._tcp.local.
PTR (QM)? _printer._tcp.local.
PTR (QM)? _pdl-datastream._tcp.local.
PTR (QM)? _ptp._tcp.local.
PTR (QM)? _googlecast._tcp.local.
PTR (QM)? _airport._tcp.local.
PTR (QM)? _privet._tcp.local. (247)

06:58:18.995368 IP 192.168.2.22.5353 > 224.0.0.251.5353: 0 [15q] PTR (QM)? _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)
06:58:19.004888 IP 192.168.2.22.5353 > 224.0.0.251.5353: 0 [15q] PTR (QM)? _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)
06:58:21.294223 IP 192.168.2.22.52089 > 239.255.255.250.1900: UDP, length 174
06:58:21.300872 IP 192.168.2.22.52089 > 239.255.255.250.1900: UDP, length 174
Improve this question

2 Answers 2

Reset to default
12

The first two lines are the system with IP address 192.168.2.22 sending a bunch of mDNS multicast queries for PTR records of various services in the local network.

PTR means the message is about a PoinTeR record, (QM) are the flags in the mDNS request packet (Query and Multicast), and the question mark just makes it easier to see that it's a query.

Any system providing a service of the queried type is supposed to answer with a PTR record that points at a SRV record that describes the queried service on the responding system. This scheme is called DNS-based Service Discovery (DNS-SD): it can be used with both mDNS and regular DNS, and it's described in RFC 6763.

The service names used to be tracked in a temporary registry which was later merged into the Service Name and Transport Protocol Number Registry maintained by IANA. In the IANA registry, you should search for the plain service name, with the first underscore omitted. The entry in the IANA registry is usually quite short, but even you'll usually find at least a few names or other keywords you can use to refine your google results.

  • PTR (QM)? _airplay._tcp.local. Any Apple AirPlay-capable video displays here?
  • PTR (QM)? _raop._tcp.local. Any Apple AirPlay-capable audio devices here?
  • PTR (QM)? _sleep-proxy._udp.local. Is there a device that could tell anyone who might ask that I'm still available while I'd doze off for a quick power-save nap?
  • PTR (QM)? _uscan._tcp.local. Any HP-compatible network scanners here?
  • PTR (QM)? _uscans._tcp.local. Any SSL/TLS-capable HP-compatible network scanners here?
  • PTR (QM)? _ippusb._tcp.local. Are there any shared printers that are using the IPP-over-USB protocol, i.e. USB-connected printers shared by a Mac?
  • PTR (QM)? _scanner._tcp.local. Are there any Bonjour-capable scanners?
  • PTR (QM)? _ipp._tcp.local. Are there any printers using the IPP protocol here?
  • PTR (QM)? _ipps._tcp.local. Any SSL/TLS capable IPP printers?
  • PTR (QM)? _printer._tcp.local. Any kinds of shared printers at all?
  • PTR (QM)? _pdl-datastream._tcp.local. Any HP JetDirect-style network printers?
  • PTR (QM)? _ptp._tcp.local. Any devices supporting the Picture Transfer Protocol over this network?
  • PTR (QM)? _googlecast._tcp.local. Is there a ChromeCast-capable device in this network?
  • PTR (QM)? _airport._tcp.local. Any Apple AirPort WiFi APs?
  • PTR (QM)? _privet._tcp.local. Any Google CloudPrint-capable printers or print services?

On the last two lines, the same device is sending out multicast SSDP (a HTTP-like Simple Service Discovery Protocol) messages, but tcpdump does not analyze that protocol deep enough to tell whether it's querying for local services or announcing its own network services. A SSDP query would be the first step in e.g. network uPnP, which might allow an application to request a temporary port forwarding through a NAT automatically if the NAT router has the uPnP feature enabled.

I think those four lines are a fairly typical example of queries a smartphone or a tablet might make when connecting to a WiFi network.

Improve this answer
2
  • Is there a list of these names and what they mean? Or you are interpreting them intuitively?
    – InvisibleWolf
    Apr 8, 2022 at 20:31
  • 2
    @InvisibleWolf I have had a habit of examining the "ambient background traffic" in my home and workplace networks every once in a while. I had seen most of those names before, and looked up the rest - either from the IANA service name registry, or just by googling. (Links to relevant RFCs and service name registries added.)
    – telcoM
    Apr 8, 2022 at 22:25
1

What does the first two mean lines means?

192.168.2.22.5353

The sender of this message, 192.168.2.22, port number 5353. I assume it is UDP.

 224.0.0.251.5353

It is a multicast message to multicast group 224.0.0.251, UDP port number 5353.

This multicast group and this port number is used for mDNS/IPv4. mDNS is one of at least three protocols I know which are used in the local network to find the IP address of a computer with a certain host name not needing a DNS server.

Multicast messages are sent to and received by all computers in the local network. In the case of mDNS the computer that has the information required will answer the request with a unicast packet (a packet which is directly sent to the sender of the original packet).

In other words: One computer sends a packet with the question "what is the IP address of computer1.local" to all computers in the local network; the computer with the host name computer1.local will send its own IP address back to the sender.

Improve this answer
2
  • That part I did understand but what does "airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)?" mean what are the question marks here meaning?
    – jennifer ruurs
    Sep 11, 2018 at 5:49
  • That's the service names 192.168.2.22 is looking for in the internal network, hence the question mark. It is nothing but tcpdump's interpretation of the corresponding "query" flag in the packet. 192.168.2.22 is performing Service Discovery using mDNS, as per RFC6763 (tools.ietf.org/html/rfc6763) - absolutely nothing to worry about. You might want to consider exporting from tcpdump to a file, and to open that file in Wireshark for dissection/analysis - Wireshark's graphical way of presenting a packet is a lot more detailed than TCPdump can do on a single line.
    – Marc 'netztier' Luethi
    Sep 11, 2018 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.