0

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable) enter image description here

and in the Wireshark packet detail panel, there displays the packet structure:

eth:ehtertype:ip:icmp:ip:udp

enter image description here

and more details:

the payload is IP:UDP (from router to mac), and you see the router port is 53, it related to DNS.

enter image description here

enter image description here

enter image description here

and in my macOS, there is no application listening the port:

$ netstat -an | grep 55166 get nothing.


What's the protocol use the packet? and what's the intension of the packet?

2
  • Src port is 53. It means DNS. DNS is udp. As i think, it is connecting via DNS
    – infra
    Aug 27, 2020 at 4:08
  • Unfortunately, questions about home networking and consumer-grade devices are explicitly off-topic here. You could try to ask this question on Super User.
    – Ron Maupin
    Aug 27, 2020 at 13:01

2 Answers 2

0

ICMP is used to signal network layer (IP) or transport layer (TCP, UDP, ...) errors.

In this case, the ICMP sender 192.168.2.228 informs the initial sender 192.168.2.1 that a transport layer port cannot be reached. The ICMP payload contains parts of the problem packet with the network and transport layer headers. In your case that seems to have been a DNS reply.

Note that host configurations and issues are off-topic here, so we can't dive into the actual reason for the rejection.

0

Your displaying packet is a message sent via ICMP.

the message means from router's DNS response to your mac unreachable.

192.168.2.1:53 -> 192.168.2.228:55166

You can check your firewall on your macOS, or use Wireshark to capture the while process.

set the filter in your Capture filter:

(udp) and (host 192.168.2.1) and (port 53)

Not the answer you're looking for? Browse other questions tagged or ask your own question.