From owner-freebsd-hackers@FreeBSD.ORG Sun May 9 22:31:46 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4465216A4CE for ; Sun, 9 May 2004 22:31:46 -0700 (PDT) Received: from mail.wolves.k12.mo.us (duey.wolves.k12.mo.us [207.160.214.9]) by mx1.FreeBSD.org (Postfix) with ESMTP id C56EB43D46 for ; Sun, 9 May 2004 22:31:45 -0700 (PDT) (envelope-from cdillon@wolves.k12.mo.us) Received: from localhost (localhost [127.0.0.1]) by mail.wolves.k12.mo.us (Postfix) with ESMTP id 2D0A21FEF9; Mon, 10 May 2004 00:31:45 -0500 (CDT) Received: from mail.wolves.k12.mo.us ([127.0.0.1]) by localhost (mail.wolves.k12.mo.us [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 67976-01; Mon, 10 May 2004 00:31:43 -0500 (CDT) Received: by mail.wolves.k12.mo.us (Postfix, from userid 1001) id 6C8161FEE9; Mon, 10 May 2004 00:31:43 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by mail.wolves.k12.mo.us (Postfix) with ESMTP id 68E0A1A976; Mon, 10 May 2004 00:31:43 -0500 (CDT) Date: Mon, 10 May 2004 00:31:43 -0500 (CDT) From: Chris Dillon To: TSaplin Mikhail In-Reply-To: <200405091922.36624.tsmm@list.ru> Message-ID: <20040510001226.T67823@duey.wolves.k12.mo.us> References: <200405091922.36624.tsmm@list.ru> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Virus-Scanned: by amavisd-new at wolves.k12.mo.us cc: freebsd-hackers@freebsd.org Subject: Re: GATEKEEPER.MCAST.NET again (unexpected traffic) X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 May 2004 05:31:46 -0000 On Sun, 9 May 2004, TSaplin Mikhail wrote: > Recently I wrote, that I have litle traffic to GATEKEEPER.MCAST.NET, > (tcpdump show this: > 20:32:41.496039 129dial.supernet.kz.52075 > GATEKEEPER.MCAST.NET.1718: udp 31 > ) > > David Malone on my question wrote: > >Does sockstat show which process is using port 52075? > No, sockstat show nothing about this. > > I've installed new system due express installation - but packets is steel > going. > > Maybe this is going on your 5.1 system, and is this right? Those are multicast UDP packets being sent by an H.323 endpoint application trying to find a local H.323 gatekeeper. Since they are multicast, they will stay within your LAN unless you have explicitly configured a router or tunnel to carry them out of it. Totally harmless, unless you really don't want any H.323-enabled applications installed and running. Use sockstat to look for anything listening on the 224.0.1.41 (gatekeeper.mcast.net) address. -- Chris Dillon - cdillon(at)wolves.k12.mo.us FreeBSD: The fastest, most open, and most stable OS on the planet - Available for IA32, IA64, AMD64, PC98, Alpha, and UltraSPARC architectures - PowerPC, ARM, MIPS, and S/390 under development - http://www.freebsd.org Q: Because it reverses the logical flow of conversation. A: Why is putting a reply at the top of the message frowned upon?