Unsolicited response from host with invalid source port 32784 via Linksys E4200

[sArkar]

Sponsored Links

After I replaced my old router with this new Cisco Linksys E4200, I am facing a huge technical problem. First of all let me tell you that I am running a firmware update version 1.0.02 build on this Linksys E4200 router.

The problem is that at least every one minute I can notice that my router keeps on sending me unsolicited DNS message to the IPV4 multicast address 01:00:5e:00:00:fb. The message is sent using the destination IP address of 224.0.0.251. This unsolicited message is nothing but just a DNS response with source port 32784. Transaction ID 0, flags 0x8400, questions 0, answer RRs 2, authority RRs 0 and additional RRs 1. Can anyone explain what exactly is going on, I am totally clueless?

[Kiran25]

I do sometimes receives these unsolicited messages but in my system whenever I receive such message my desktop pc however records or you can say logs an error in the machine like “Feb 23 07:39:22 sauterws02 avahi-daemon[1067]: Received response from host 10.146.9.1 with invalid source port 32784 on interface 'eth0.0”. for your knowledge let me tell you that the host address i.e. 10.146.9.1 is just the router’s IP address.

Most interestingly I can also see these messages on the wireless link from my laptop. I am sure that this E4200 is just trying to make sure that there is no such old information with its name existing and therefore due to this reason it is generating these DNS messages in such wrongly way.

[Roxanne's]

Transaction ID 0, flags 0x8400, questions 0, answer RRs 2, authority RRs 0 and additional RRs 1. Can any one explain what exactly is going on, I am totally clueless.

By looking at your above statements I can only say that both the two answer somehow relate to the router. one of them must have the Name, type A (host address), class 1 (IN), cache flush true, time to live 1 minute, data length 4, and the address of the router. in my case the additional record is for Cisco18738.local, type NSEC, class IN, cache flush true, time to live 1 minute, data length 5, next domain name Cisco18738.local, RR type A (host address).

[Carita Carlos]

Hello my friend, forget about the researches why don’t to look out for a proper solution. I had the exact same problem but instead of digging up the issue I just went on for a proper solution and now at last I am here with it.

Recently I noticed that there is a new release for the E4200 firmware version 1.0.04 build. This latest firmware release is somehow being used for correcting those minor issues without even listing them. But take a note that, loading this firmware will not solve all other issue excluded from this thread.

[Hadriel]

I need to tell and give you two most important suggestion and information:
If you are aware of the internet draft, you can find that the multicast DNS implementations should definitely silently ignore any kind of multicast DNS responses that are actually received, where you can notice the source UDP port is not 5353. I guess your avahi-daemon do not fulfills the requirements.
Another thing I would like to tell you is that better you at least once try to contact the Support center; you need to contact Linksys support.

[Aadidev]

I am very much sure that the avahi daemon is not at all silently ignoring these packets; therefore I personally believe that it is the main reason for all mess up. I am not sure but I guess Cisco themselves are using these packets for the proprietary functions so therefore they will never change or modify them.

[Elazar]

I am very much sure that the avahi daemon is not at all silently ignoring these packets, therefore I personally believe that it is the main reason for all mess up. I am not sure but I guess Cisco themselves are using these packets for the proprietary functions so therefore they will never change or modify them.

But if Cisco is using the these packets for the proprietary functions surely they are violating the mDNS specifications. As already been said that there is a more possibility that it’s a bug.

[Suigetsu]

The main bug is that the source port for the multicast DNS is not always 5353. If you have a clear look at your or any of the problematic E4200 router you would find that it is somewhat randomly numbered. In my case it is 32774when I checked in my current log. There the capability with the correctly implemented software is broken which are programmed in order to just ignore the mDNS that are coming from the port except for 5353, software such as Avahi.