Strange behavior - IoT

[IanMZimmermann]

Hello everyone, recently I set up a PfSense laboratory with GrayLog for testing purposes. I have observed an unusual behavior in my network where certain IoT devices, including a Smart TV, computer, and TP-Link router, continuously send packets to broadcast addresses:

224.0.0.251
255.255.255.255
239.255.255.250
224.0.0.7
192.168.9.255 (broadcast address of my network)

The TP-Link, Smart TV, and computer are the ones that constantly communicate with 192.168.9.255. The other IPs mentioned above are destinations of requests made by IoT devices. I suspect that other IoT devices may be experiencing issues due to this intensive communication, potentially because of memory constraints.

Has anyone experienced a similar situation? Do you have any suggestions on what can be done?

I use an RT-AC86U router with Merlin firmware connected to the ONT as my main router.

I apologize if this is not the appropriate place and/or if there is already a forum discussing this topic.

 

[Paliv]

This might help:
Post in thread 'FAQ - Reserved Characters/Names - SSID/Passwords/Hostnames/Domains'
https://www.snbforums.com/threads/f...passwords-hostnames-domains.31273/post-792076

 

[Crimliar]

Or see RFC3171

 

[ColinTaylor]

... continuously send packets to broadcast addresses:

Most of those are multicast addresses not broadcast. In particular mDNS.

https://www.rfc-editor.org/rfc/rfc6762.txt

 

[sfx2000]

224.0.0.251
255.255.255.255
239.255.255.250
224.0.0.7
192.168.9.255 (broadcast address of my network)

This is normal traffic - as noted above in the FAQ link..

One thing on pfSense - enable the bogon detection, and let it update - there are threat actors that try to use either reserved addresses or link-local addresses from the WAN side, which shouldn't happen.

bogon networks - Google Suche

pfSense is pretty good about handling the bogon's there...