up vote 0 down vote favorite
share [g+] share [fb]

I just plugged in a couple tp-link wirless access points and found that while they work fine, I am now seeing traffic going from their internal ip's to a 239.255.255.250 which is nothing on my network. Researching that ip, it looks like it might be related to ssdp? I looked through all the settings and see nothing about ssdp. I also turned off everything I could find in the ap - upnp, firewall, dhcp, etc. (I am only using it as a basic wireless access point on to the lan).

Any ideas?

link|improve this question
59% accept rate
feedback

2 Answers

up vote 2 down vote accepted

This is indeed a multi-cast address used by ssdp. Among other things printers use this to advertize that they are IPP capable. Windows PC's can do this as well if the have the MS webserver (IIS) running.

Your access-points (and your internet facing router) simply send it along as they consider it normal outgoing traffic. (Most routers automatically block outgoing multi-casts when they are NATTING as it makes no sense to send this kind of traffic to the internet. Some routers are smart enough to block 224...* multi-cast, but let 239...* through.)

Contrary to popular believe this, by itself is NOT UPNP related. It is of course possible that a UPNP capable device used UPNP to tell the router to open the firewall for this traffic.

link|improve this answer
+1 Nice detailed answer – Dave M Jan 11 at 14:51
Perhaps you have seen different equipment then I have, but in my experience no routers will do anything in the multicast range without configuration. – Zoredache Jan 11 at 17:53
@zoredache: Most low-range consumer stuff doesn't bother filtering multicast at all. I have seen Sitecom, Linksys, D-Link, Netgear, TP, LevelOne, Zyxell and AVM/FrizBox all guilty of it. More serious equipment usually blocks but allows configuration (either though UPNP, managment interface or both). – Tonny Jan 11 at 18:56
feedback
up vote -1 down vote

This is often associated with UPnP. The address 239.255.255.250 is not a "valid" internet address but used for other purposes. Looking it up with WHOIS will report "reserved for special purposes" The traffic may be a device on your network using UPnP

link|improve this answer
Explain downvote please – Dave M Jan 11 at 17:20
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.