问题的提出:
A:sourceport:murray destination port:39213
今天,在使用wireshark(之前的Ethereal)软件进行嗅探和抓包的时候,发现了一个问题:
出现了很多udp广播包:
源 目标 protocol
192.168.19.1 192.168.19.255 UDP
然后内容是:
sourceport:murray destination port:39213
sourceport:blaze destination port:39213
sourceport:dmidi destination port:39213
sourceport:scol dest
ination port:39213
……
据说39213端口是sygate的管理程序的端口,那么,请问谁知道sygate用39213端口向网内的广播地址发UDP包是什么原因?
B:向39213端口发送udp广播的记录:
09:32:33.965465 IP 219.133.48.87.8000 > 192.168.0.119.32769: UDP, length 56
09:32:33.968067 IP 192.168.0.119.32769 > 219.133.48.87.8000: UDP, length 28
09:32:34.020716 IP 219.133.48.87.8000 > 192.168.0.119.32769: UDP, length 632
09:32:34.705058 IP 192.168.0.10.3737 > 192.168.0.255.39213: UDP, length 268
09:32:34.705799 IP 192.168.0.10.3738 > 192.168.0.255.39213: UDP, length 112
09:32:36.478800 IP 219.133.48.87.8000 > 192.168.0.119.32769: UDP, length 64
09:32:36.537582 IP 192.168.0.10.3739 > 192.168.0.255.39213: UDP, length 824
09:32:37.208785 IP 192.168.0.10.3740 > 192.168.0.255.39213: UDP, length 268
09:32:37.209569 IP 192.168.0.10.3741 > 192.168.0.255.39213: UDP, length 112
09:32:38.914865 arp who-has 192.168.0.10 tell 192.168.0.119
09:32:38.915077 arp reply 192.168.0.10 is-at 00:50:04:ba:27:a1 (oui Unknown)
09:32:39.526133 NBF Packet: Datagram
09:32:39.652763 IP 192.168.0.10.3742 > 192.168.0.255.39213: UDP, length 268
09:32:39.653869 IP 192.168.0.10.3743 > 192.168.0.255.39213: UDP, length 824
09:32:39.654412 IP 192.168.0.10.3744 > 192.168.0.255.39213: UDP, length 112
09:32:39.995348 NBF Packet: Datagram
09:32:42.115367 IP 192.168.0.10.3745 > 192.168.0.255.39213: UDP, length 268
09:32:42.116102 IP 192.168.0.10.3746 > 192.168.0.255.39213: UDP, length 112
09:32:42.726195 IP 192.168.0.10.3747 > 192.168.0.255.39213: UDP, length 824
09:32:44.588784 IP 192.168.0.10.3748 > 192.168.0.255.39213: UDP, length 268
09:32:44.589503 IP 192.168.0.10.3749 > 192.168.0.255.39213: UDP, length 112
09:32:45.810432 IP 192.168.0.10.3750 > 192.168.0.255.39213: UDP, length 824
C、图解udp广播:
--------------------------------------------------------
解答见下页