Raspberry Pi flooding my network with SSDP discovery messages

[Mike Lussier]

I have been chasing a problem for a few days at home. This only recently started, so I knew it was something new. That new device was a raspberry Pi 3B+ running direwolf and Pat. 

for some reason Its broadcasting UDP 1900 on a multicast address of 239.255.255.250 and this is at a rate at times of several hundred a minute. I have no windows devices on my network. no reason for this traffic. 

The real interesting part is that it is also sending those discovery packets over the RF. I came down to the shack for our net this evening and saw the red transmit light come on on my DRA50 interface and when I looked up I saw the radio transmitting. I looked into the logs on  the pi and found part of what I have been tracking for the past few days. 

The radio is off for now until I get my head wrapped around this. 

and multiple other Pi's that are in service  to look at now. 

Has anyone else seen this ? 

[Chris Keller]

Mike,

I haven't experienced that myself, but SSDP is sort of infamous for causing problems: see this CloudFlare blog post from a couple of years ago. Scary that it was going out on RF, but I suppose that's the goal of libax25: make it look like any other network port. It might be worth setting up iptables firewall rules to keep those contained while you track down the source. What else is installed besides Direwolf and Pat?

73, Chris K0SWE

--
You received this message because you are subscribed to the Google Groups "pat-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pat-users+...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/pat-users/208a6990-daa8-4420-a325-bab83e5d9031n%40googlegroups.com.

[Michael Lussier]

Good morning Chris, 

This is a fresh OS install with AX25, direwolf and Pat. Nothing extra was added to it. This is my VHF station. 

I have another pi that is identical for HF Pat. 

This only difference is one is a SignaLink and the other is a DRA50

I will have to look at the idea of iptables for now. 

Sent from iPhone plus. Misspelling are due to the auto correction methods used by Apple. 

On Sep 30, 2021, at 22:14, Chris Keller <xyl...@gmail.com> wrote: