2

Bellow I show the output of my tcpdump What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)?

I am especially intrested in the meaning of what this mean: _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)

06:58:18.995368 IP 192.168.2.22.5353 > 224.0.0.251.5353: 0 [15q] PTR (QM)? _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)
06:58:19.004888 IP 192.168.2.22.5353 > 224.0.0.251.5353: 0 [15q] PTR (QM)? _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)
06:58:21.294223 IP 192.168.2.22.52089 > 239.255.255.250.1900: UDP, length 174
06:58:21.300872 IP 192.168.2.22.52089 > 239.255.255.250.1900: UDP, length 174
5

The first two lines are the system with IP address 192.168.2.22 sending a bunch of mDNS multicast queries for PTR records of various services in the local network.

PTR means the message is about a PoinTeR record, (QM) are the flags in the mDNS request packet (Query and Multicast), and the question mark just makes it easier to see that it's a query.

  • PTR (QM)? _airplay._tcp.local. Any Apple AirPlay-capable video displays here?
  • PTR (QM)? _raop._tcp.local. Any Apple AirPlay-capable audio devices here?
  • PTR (QM)? _sleep-proxy._udp.local. Is there a device that could tell anyone who might ask that I'm still available while I'd doze off for a quick power-save nap?
  • PTR (QM)? _uscan._tcp.local. Any HP-compatible network scanners here?
  • PTR (QM)? _uscans._tcp.local. Any SSL/TLS-capable HP-compatible network scanners here?
  • PTR (QM)? _ippusb._tcp.local. Are there any shared printers that are using the IPP-over-USB protocol, i.e. USB-connected printers shared by a Mac?
  • PTR (QM)? _scanner._tcp.local. Are there any Bonjour-capable scanners?
  • PTR (QM)? _ipp._tcp.local. Are there any printers using the IPP protocol here?
  • PTR (QM)? _ipps._tcp.local. Any SSL/TLS capable IPP printers?
  • PTR (QM)? _printer._tcp.local. Any kinds of shared printers at all?
  • PTR (QM)? _pdl-datastream._tcp.local. Any HP JetDirect-style network printers?
  • PTR (QM)? _ptp._tcp.local. Any devices supporting the Picture Transfer Protocol over this network?
  • PTR (QM)? _googlecast._tcp.local. Is there a ChromeCast-capable device in this network?
  • PTR (QM)? _airport._tcp.local. Any Apple AirPort WiFi APs?
  • PTR (QM)? _privet._tcp.local. Any Google CloudPrint-capable printers or print services?

On the last two lines, the same device is sending out multicast SSDP (a HTTP-like Simple Service Discovery Protocol) messages, but tcpdump does not analyze that protocol deep enough to tell whether it's querying for local services or announcing its own network services. A SSDP query would be the first step in e.g. network uPnP, which might allow an application to request a temporary port forwarding through a NAT automatically if the NAT router has the uPnP feature enabled.

I think those four lines are a fairly typical example of queries a smartphone or a tablet might make when connecting to a WiFi network.

1

What does the first two mean lines means?

192.168.2.22.5353

The sender of this message, 192.168.2.22, port number 5353. I assume it is UDP.

 224.0.0.251.5353

It is a multicast message to multicast group 224.0.0.251, UDP port number 5353.

This multicast group and this port number is used for mDNS/IPv4. mDNS is one of at least three protocols I know which are used in the local network to find the IP address of a computer with a certain host name not needing a DNS server.

Multicast messages are sent to and received by all computers in the local network. In the case of mDNS the computer that has the information required will answer the request with a unicast packet (a packet which is directly sent to the sender of the original packet).

In other words: One computer sends a packet with the question "what is the IP address of computer1.local" to all computers in the local network; the computer with the host name computer1.local will send its own IP address back to the sender.

2
  • That part I did understand but what does "airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)?" mean what are the question marks here meaning? Sep 11 '18 at 5:49
  • That's the service names 192.168.2.22 is looking for in the internal network, hence the question mark. It is nothing but tcpdump's interpretation of the corresponding "query" flag in the packet. 192.168.2.22 is performing Service Discovery using mDNS, as per RFC6763 (tools.ietf.org/html/rfc6763) - absolutely nothing to worry about. You might want to consider exporting from tcpdump to a file, and to open that file in Wireshark for dissection/analysis - Wireshark's graphical way of presenting a packet is a lot more detailed than TCPdump can do on a single line. Sep 11 '18 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.