0

I have a server running pacemaker with corosync and some standard services as mails, web, ssh...

When I run wireshard in my network I keep getting those packets that my server is sending to the IP 226.99.1.1 (which is not in my local network, and which I know nothing about). Wireshark tells me that the source port is hpoms-dps-lstn, and the destination one : netsupport.

I would like to know what this packet are about?

Clement Roblot
  • 157
  • 7

2 Answers2

1

In fact after some time, I found out that this IP is the one used by corosync. It is configured in the /etc/corosync/corosync.conf under the mcastaddr option.

Clement Roblot
  • 157
  • 7
0

226.0.0.0/8 is reserved for multicast: http://www.cidr-report.org/as2.0/reserved-ipv4.html You will need to use process monitoring tools to find the specific process that is sending that traffic out.

Ingram
  • 153
  • 1
  • 2
  • 7