Understanding TCPDump Output

intrusion-preventiontcpdump

Bellow I show the output of my tcpdump
What does the first two mean lines means(what are all the question-marks meaning is this a sign of a intruder)?

I am especially intrested in the meaning of what this mean:
_airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)

06:58:18.995368 IP 192.168.2.22.5353 > 224.0.0.251.5353: 0 [15q] PTR (QM)? _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)
06:58:19.004888 IP 192.168.2.22.5353 > 224.0.0.251.5353: 0 [15q] PTR (QM)? _airplay._tcp.local. PTR (QM)? _raop._tcp.local. PTR (QM)? _sleep-proxy._udp.local. PTR (QM)? _uscan._tcp.local. PTR (QM)? _uscans._tcp.local. PTR (QM)? _ippusb._tcp.local. PTR (QM)? _scanner._tcp.local. PTR (QM)? _ipp._tcp.local. PTR (QM)? _ipps._tcp.local. PTR (QM)? _printer._tcp.local. PTR (QM)? _pdl-datastream._tcp.local. PTR (QM)? _ptp._tcp.local. PTR (QM)? _googlecast._tcp.local. PTR (QM)? _airport._tcp.local. PTR (QM)? _privet._tcp.local. (247)
06:58:21.294223 IP 192.168.2.22.52089 > 239.255.255.250.1900: UDP, length 174
06:58:21.300872 IP 192.168.2.22.52089 > 239.255.255.250.1900: UDP, length 174

Best Answer

The first two lines are the system with IP address 192.168.2.22 sending a bunch of mDNS multicast queries for PTR records of various services in the local network.

PTR means the message is about a PoinTeR record, (QM) are the flags in the mDNS request packet (Query and Multicast), and the question mark just makes it easier to see that it's a query.

  • PTR (QM)? _airplay._tcp.local. Any Apple AirPlay-capable video displays here?
  • PTR (QM)? _raop._tcp.local. Any Apple AirPlay-capable audio devices here?
  • PTR (QM)? _sleep-proxy._udp.local. Is there a device that could tell anyone who might ask that I'm still available while I'd doze off for a quick power-save nap?
  • PTR (QM)? _uscan._tcp.local. Any HP-compatible network scanners here?
  • PTR (QM)? _uscans._tcp.local. Any SSL/TLS-capable HP-compatible network scanners here?
  • PTR (QM)? _ippusb._tcp.local. Are there any shared printers that are using the IPP-over-USB protocol, i.e. USB-connected printers shared by a Mac?
  • PTR (QM)? _scanner._tcp.local. Are there any Bonjour-capable scanners?
  • PTR (QM)? _ipp._tcp.local. Are there any printers using the IPP protocol here?
  • PTR (QM)? _ipps._tcp.local. Any SSL/TLS capable IPP printers?
  • PTR (QM)? _printer._tcp.local. Any kinds of shared printers at all?
  • PTR (QM)? _pdl-datastream._tcp.local. Any HP JetDirect-style network printers?
  • PTR (QM)? _ptp._tcp.local. Any devices supporting the Picture Transfer Protocol over this network?
  • PTR (QM)? _googlecast._tcp.local. Is there a ChromeCast-capable device in this network?
  • PTR (QM)? _airport._tcp.local. Any Apple AirPort WiFi APs?
  • PTR (QM)? _privet._tcp.local. Any Google CloudPrint-capable printers or print services?

On the last two lines, the same device is sending out multicast SSDP (a HTTP-like Simple Service Discovery Protocol) messages, but tcpdump does not analyze that protocol deep enough to tell whether it's querying for local services or announcing its own network services. A SSDP query would be the first step in e.g. network uPnP, which might allow an application to request a temporary port forwarding through a NAT automatically if the NAT router has the uPnP feature enabled.

I think those four lines are a fairly typical example of queries a smartphone or a tablet might make when connecting to a WiFi network.

Related Topic