1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

R7000 UDP broadcasts to port 7423

Discussion in 'NETGEAR AC Wireless' started by paraplu, Aug 29, 2014.

  1. paraplu

    paraplu Regular Contributor

    Joined:
    Aug 29, 2014
    Messages:
    134
    My Netgear R7000 seems to be broadcasting every second or so to UDP port 7423. This is currently happening with latest stock firmware, but happened earlier with older stock firmware as well.

    Kong's DDWRT does not show this behavior.

    I have reported this to Netgear Support but they also seem to be surprised. Still waiting for a clue.

    Configured as Access Point only, with default settings.

    Can somebody please explain what this is? Thanks in advance...
     
  2. stevech

    stevech Part of the Furniture

    Joined:
    Mar 13, 2010
    Messages:
    7,007
    Location:
    San Diego
    How do you observe the WAN port to modem signal to know about this UDP traffic?
     
  3. paraplu

    paraplu Regular Contributor

    Joined:
    Aug 29, 2014
    Messages:
    134
    Using Wireshark on any device connected to my subnet, including wireless. Each showing a constant (1-second interval) UDP broadcast to mentioned port, originating from my R7000.

    R7000 configured as an AP with single (WAN) port connection to Netgear switch; no other connections on remaining R7000' LAN switch ports.

    This is the wireshark output from a wireless client (my R7000 being 192.168.1.5):


    No. Time Source Destination Protocol Length Info
    1 0.000000 192.168.1.5 255.255.255.255 UDP 215 Source port: 55764 Destination port: 7423

    Frame 1: 215 bytes on wire (1720 bits), 215 bytes captured (1720 bits)
    Ethernet II, Src: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Internet Protocol Version 4, Src: 192.168.1.5 (192.168.1.5), Dst: 255.255.255.255 (255.255.255.255)
    User Datagram Protocol, Src Port: 55764 (55764), Dst Port: 7423 (7423)
    Data (173 bytes)

    0000 4b 41 4e 4e 4f 55 25 4e 00 00 00 00 00 c4 04 15 KANNOU%N........
    0010 5b bc b3 52 37 30 30 30 00 00 00 00 00 00 00 00 [..R7000........
    0020 00 00 00 52 37 30 30 30 00 00 00 00 00 00 00 00 ...R7000........
    0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    0050 00 00 00 00 00 00 00 31 2e 30 32 2e 34 31 00 00 .......1.02.41..
    0060 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ................
    0070 00 01 00 00 00 02 00 00 00 02 00 00 00 00 00 00 ................
    0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 .............
     
    Last edited: Aug 29, 2014
  4. stevech

    stevech Part of the Furniture

    Joined:
    Mar 13, 2010
    Messages:
    7,007
    Location:
    San Diego
    OK, so the packet is on your LAN, not out your WAN.

    what computer/thing is 192.168.1.5 on your LAN?
     
  5. sfx2000

    sfx2000 Part of the Furniture

    Joined:
    Aug 11, 2011
    Messages:
    13,788
    Location:
    San Diego, CA
    Isn't UPD/7423 QuickTime Media Server?

    Interesting...
     
  6. A8Number10

    A8Number10 New Around Here

    Joined:
    Aug 30, 2014
    Messages:
    1
    I'm seeing the same thing on my R7000 with the most recent firmware, also in AP mode and connected to a GS110TP switch. In addition, I'm seeing Spanning Tree Protocol broadcasts from the R7000 at regular intervals. I'd like to be able to turn both off, but don't see how.

    I'm guessing the UDP 7423 broadcasts are related to USB/ReadyShare services etc., but all of those functions are disabled on my R7000. I'm using it strictly as an Access Point.
     
  7. paraplu

    paraplu Regular Contributor

    Joined:
    Aug 29, 2014
    Messages:
    134
    That's what I thought as well; ReadyShare. The "Basic" option cannot be disabled in the GUI. I have tried the readyshare downloadable utilities (USB control center, Vault) but these were not able to detect a device.

    Maybe it relates to Netgear Genie; as this application detects the R7000 automatically.

    Other netgear devices have the same: http://forum1.netgear.com/showthread.php?t=75139

    D-Link devices seem to have something alike: http://www.dslreports.com/forum/remark,21224552
     
  8. RogerSC

    RogerSC Part of the Furniture

    Joined:
    Oct 18, 2009
    Messages:
    2,248
    I also see UDP broadcast packets going out from the Netgear R7000 router (source is the router's IP address here), to 255.255.255.255 port 7423. I don't have any printers or USB stuff going on with my router, none of the USB stuff is enabled here. UPnP is also off. IPv6 advertising happens on other ports.

    I wonder if this is really a USB-related thing that is left on whether you have any USB functionality or not. Lots of questions about this on the internet, no definitive answer. It doesn't really matter, since I can spare the bandwidth *smile*, just makes one wonder.
     
  9. stevech

    stevech Part of the Furniture

    Joined:
    Mar 13, 2010
    Messages:
    7,007
    Location:
    San Diego
    UPnP disabled?
     
  10. RogerSC

    RogerSC Part of the Furniture

    Joined:
    Oct 18, 2009
    Messages:
    2,248
    Yes, as mentioned above.

    Update: Just flashed Shibby's v122, and not seeing those UDP broadcasts that I saw with the latest stock firmware. Interesting.
     
    Last edited: Aug 31, 2014
  11. sfx2000

    sfx2000 Part of the Furniture

    Joined:
    Aug 11, 2011
    Messages:
    13,788
    Location:
    San Diego, CA
    See his note above - uPNP is disabled...

    My thoughts are that this is the media server inside the platform not getting disabled if the user desires it.

    In other words - a bug...
     
  12. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    29,068
    Location:
    Canada
    7423/UDP is used by Netgear's USB Control Center and readyShare. it's unrelated to DLNA or UPNP.
     
  13. paraplu

    paraplu Regular Contributor

    Joined:
    Aug 29, 2014
    Messages:
    134
    Netgear Support replied that they are unable to simulate this issue in their lab. Weird.

    Two questions:
    1. is it possible to stop this broadcast?
    2. is this broadcast having any influence on mobile wireless devices eg battery?
     
  14. paraplu

    paraplu Regular Contributor

    Joined:
    Aug 29, 2014
    Messages:
    134
    netgear's official reply:

    It’s the readyshare print function. We currently do not have way to turn it off since we need to detect the printer attached without user to turn on feature from GUI.
     
  15. RogerSC

    RogerSC Part of the Furniture

    Joined:
    Oct 18, 2009
    Messages:
    2,248
    i.e. USB printer "hotplug". Not sure that I want to pay the freight for that, shouldn't I have a choice? Okay, they can have it on, so give me the choice to turn it off *smile*.
     
  16. htismaqe

    htismaqe Very Senior Member

    Joined:
    Aug 1, 2010
    Messages:
    1,520
    Location:
    Fly Over Country
    Their answer seems to imply that they don't trust the average user that needs it to be able to turn it ON. Therefore, they can't give the advanced user the ability to turn it off.
     
  17. paraplu

    paraplu Regular Contributor

    Joined:
    Aug 29, 2014
    Messages:
    134
    Just tested: the same 3 second interval broadcast also happens with firmware 1.0.3.80, and also in media bridge mode.

    Message to Netgear: please provide an option in the web interface to disable/enable this printer function. Better: give us telnet/ssh access.