1

I don't think I have ever seen this happening when I have used Wireshark to view the traffic:

enter image description here

It starts from 192.168.0.2 and loops to 192.168.0.255, then starts it all over again, endlessly.

Is this normal? Or my router just got crazy?

2 Answers 2

1

It's not your router; most likely this is some computer on your network (whether it's yours or some other box's is hard to tell from the context) using the Simple Service Discovery Protocol (SSDP). The purpose of this protocol is:

  • To find other computers that are accessible on the local network, just to determine which IP addresses are routable to remote hosts on the LAN
  • To determine if any of the aforementioned LAN IP addresses are running any services that this computer can use; for example, Universal Plug and Play.

It's like walking into a large, dark room and yelling, "Anybody home"?

However, the frequency of this could be a problem if it is happening ridiculously often. Try and measure how much bandwidth this is occupying, if you can. If it's happening many times per second, you should probably care. Or if it's occupying a lot of bandwidth or slowing down your network, you should probably care.

2
  • 1
    The "Who has..." messages are not part of SSDP – they are ARP requests. Aug 25, 2012 at 0:26
  • i checked now: it makes those requests 30 times at the same second every 10 seconds. my internet has been laggy... indeed. maybe it helps if i restart router.
    – Rookie
    Aug 25, 2012 at 11:13
1

Some routers use such periodic ARP queries to detect which IP addresses are in use on the network – for displaying a device list, or for excluding IP addresses of statically-configured devices from the DHCP pool.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .