Comments in line. ""Priscilla Oppenheimer"" wrote in message news:[EMAIL PROTECTED] > Richard Burdette wrote: > > > > Hello, > > > > I'm studying for the Support exam using the CiscoPress books > > and Trouble > > Shooting Campus Networks from Priscilla. I must say that the > > Trouble > > Shooting book is excellent on its own, but especially so as > > compared to the > > CiscoPress offerings. > > Thanks. :-) > > > > > Anyway I've been playing around with NetMonitor > > Are you referring to the NetMonitor application from ModemWizard?
I'm speaking of the 'ole Network Monitor utility from Microsoft. The other utility I was working with that also recorded these packets is a beta application that runs on top of WinCap. Well, now that I've restarted the system these broadcasts appear to have stopped. > > > and also some > > newer Unix > > ported packet capture utilities on various platforms and came > > across > > something on a .Net Enterprise server that has me puzzled. > > So you are running NetMonitor on the .Net server? > > > My > > system is > > continually (once a second) broadcasting to a destination port > > of 192. > > UDP? Probably since TCP doesn't usually broadcast. That is strange. > > > A > > lookup of ports reveals this is for OSU network monitoring > > (Oregon State U). > > Uh, Ohio State. Don't blame us Oregonians. :-) Sorry, I think it does have something to do with Oregon State.... One second, I think I've found the culprit just know from the website http://www.net.princeton.edu/software/osunms_probe/osunms_probe.8.html I found the following; *********** The probe packet is simply a UDP packet broadcasted to port 192. The packet's IP source is the (primary) IP address assigned to the interface specified on the commandline; the packet's UDP source port is specified with the -P option, or defaults to 55830. The UDP payload consists of one byte of x'01' followed by 115 bytes of x'00'. (This is the probe packet observed to be used by version 1.2 of Apple's AirPort Admin Utility to locate potential Apple AirPort Basestations, and by Lucent's RG Setup to locate potential Lucent ORiNOCO Residental Gateways. Because the program does not examine the response packet to determine if the respondent is indeed one of these devices, it is possible it will provoke responses from other devices listening on that port as well. ************ On this system I will switch between my Orinoco wireless and the NIC depending on what I'm doing on my network. For some reason on this server, it will not allow me to disable the Wireless adapter. As a workaround I disable the Radio that essntially kills that connection allowing me to then enable the NIC. What must have happened is that the system did not realize what I had done and begun to look for the AP. Sounds good anyway. Sorry for the confusion. > > > Anyway, could anyone shed some light on what application or > > service on the > > server is causing this? > > I have a theory. I wonder if it is NetMonitor itself. It might be looking > for banner ads or gathering data for one of its tests? > Do you see this traffic even when not using NetMonitor? Try Ethereal. It's a > great free protocol analyzer. > > > I have always found tracking down an > > application > > causing packet output to be hard to find, does anyone have tips > > on resolving > > this type of scenario? > > It's truly a pain. The official list from the Internet Assigned Numbers > Authority just says this, as you probably know: > > osu-nms 192/tcp OSU Network Monitoring System > osu-nms 192/udp OSU Network Monitoring System > # Doug Karl > > You could ask Doug?? :-) > > Are you sure it's not port 92, instead of port 192? That would make more > sense. Here's what IANA says about 92: > > npp 92/tcp Network Printing Protocol > npp 92/udp Network Printing Protocol > > > Or maybe 192 is Hex?? Probably not though. That would be 402, which doesn't > seem any more likely: > > genie 402/tcp Genie Protocol > genie 402/udp Genie Protocol > # Mark Hankin > > Sorry I can't be more help. > > Priscilla > > > > > Thanks... > > > > Richard Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=64023&t=64011 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
