I have those packets, too. These ports are used by MikroTik Neighbor Discovery Protocol (MNDP)
http://www.mikrotik.com/documentation/manual_2.7/IP/MNDP.html
The operator of 209.189.196.68 probably enabled it on all interfaces, including ampr tunnels.
AFAIK the source of the RIP broadcasts should be 169.228.66.251 (just checked it now).
Marius, YO2LOJ
-----Original Message----- From: 44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu [mailto:44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu] On Behalf Of Don Moore Sent: Thursday, January 30, 2014 14:10 To: TAPR xNOS Mailing List; AMPRNet working group Subject: Re: [44net] [nos-bbs] strange udp broadcasts...
(Please trim inclusions from previous messages) _______________________________________________ I too am getting this and have been for a few weeks now but initiated by a different address...
07:04:00.406011 IP 209.189.196.68 > 192.168.1.150: IP 0.0.0.0.5678 > 255.255.255.255.5678: UDP, length 119 (ipip-proto-4) 07:05:00.408246 IP 209.189.196.68 > 192.168.1.150: IP 0.0.0.0.5678 > 255.255.255.255.5678: UDP, length 119 (ipip-proto-4)
73, Don
On Thu, Jan 30, 2014 at 12:49 AM, Jerome Schatten romers@shaw.ca wrote:
44ers...
So every minute of every hour of every day, I get this below; it started several weeks ago. It looks like it's coming from the Ampr portal -- why? 24.84.205.232 is indeed my ip and it seems that 209.84.205.232 is the same ip as the rip broadcasts are coming from. Is there any way to turn this off other than turning off rip?
Wed Jan 29 21:35:27 2014 - tun0 recv: IP: len 167 209.189.196.68->192.168.1.149 ihl 20 ttl 55 DF prot IP IP: len 147 0.0.0.0->255.255.255.255 ihl 20 ttl 64 prot UDP UDP: len 127 5678->5678 Data 119 0000 ..1.....Seattle-ER1....6.7....MikroTik............FLNH-GLS0....R 0040 B2011UAS......................T......ampr-24.84.205.232 (encap) 0.0.0.0->255.255.255.255 UDP 0000 ..1.....Seattle-ER1....6.7....MikroTik............FLNH-GLS0....R 0040 B2011UAS......................T......ampr-24.84.205.232
jerome - ve7ass
nos-bbs mailing list nos-bbs@tapr.org http://www.tapr.org/mailman/listinfo/nos-bbs