Help with UDP Packet Drop

E

EvilAlchemist

2[H]4U
Joined
Jan 11, 2008
Messages
2,730
Has anyone seen something like this before from Sonicwall ??

Every Minute is a UDP packet dropped from the same place and destination.

I just can't seem to be able to stop it .. maybe i am in the wrong settings area.

Help or Ideas please .....
Untitled.png
 
That is SSDP (uPnP) protocol - the destination IP address is multicast. Your firewall is dropping these UDP packets. The only way you are going to stop this on your firewall is if you go visit that 192.168.44.1 device and see what it's doing.
 
Cmustang87 said:
That is SSDP (uPnP) protocol - the destination IP address is multicast. Your firewall is dropping these UDP packets. The only way you are going to stop this on your firewall is if you go visit that 192.168.44.1 device and see what it's doing.
Click to expand...

When I ping that address, it comes back as the Sonicwall device!

This is not the IP i use to log into the device so I did not expect that.

I confirmed that MAC address does match the unit in the building.

Thoughts?

Untitled1.png
 
Last edited:
Can you do a screengrab of your interface configs (scrub any identifying info) so I can check the IP address and interface mappings?
 
That pcap screen grab says your source MAC address is a Dell device, not a Sonicwall.

192.168.44.1 is not an IP address that's associated with any interface on the Sonicwall. What is 192.168.44.1?
 
Most firewall appliances are designed to block/drop multicast packets to prevent them from escaping the local network where they originated. Looks like your Sonicwall is working as designed. As others have said, you need to find the gizmo with the 192.168.44.1 address. If the log is correct and it is a Dell, could well be a networked printer trying to find a Dell management gizmo.(You may never have setup a Dell printer management gizmo but the printer will keep trying).
 
Cmustang87 said:
That pcap screen grab says your source MAC address is a Dell device, not a Sonicwall.

192.168.44.1 is not an IP address that's associated with any interface on the Sonicwall. What is 192.168.44.1?
Click to expand...

Sorry for the confusion, let me attempt to clarify. The "Dell" was the system I was using to ping that IP to identify what it was.

I wanted to include the entire packet report so I did not leave any detail out. Totally my bad for not listing that information.

192.168.44.1 reports back as LAN Port on my Sonicwall device (Same MAC as listed in Interface)
 
You must log in or register to reply here.
Back
Top