Help me figure out what is going in this Wireshark Capture

[Gamingphreek]

http://www.mediafire.com/?v94su1itghlbno7

Over the past year, there have been times when I would my router would seemingly get flooded with requests (ala DDOS attack). At times it would get so bad that components would lose connectivity.

I thought it was Wireless interference based on the fact that I have about 20 networks in range.

Well, the problem went away for a few months and recently came back today. Sure enough by RTT's to the router were >1000ms.

I fired up Wireshark and, in the span of about 10 seconds, I was greeted with >6000 requests coming from my Canon Pixma MP560 wireless printer.

It looks like it is making a multicast DNS request, but I have no idea why and no idea why it would be trying to hit 224.0.0.251. That isn't even in my subnet.

Does this sound like a firmware error on the Printers part, or does it sound like a configuration error on mind?

Thanks,
-Kevin

 

[Nothinman]

I haven't looked at the capture, but if it's doing mDNS why not just turn that off? Are you actually using Bonjour/Avahi/mDNS on your network?

 

[Gamingphreek]

I haven't looked at the capture, but if it's doing mDNS why not just turn that off? Are you actually using Bonjour/Avahi/mDNS on your network?

Nope not that I am aware of. It is just connected wirelessly to the router and OSX can pick it up. To my knowledge, this should simply be a TCP Connection.

-Kevin

Edit: On second thought, I believe OSX connects to the Printer via Bonjour. Is there a way to verify this?

 

[Gamingphreek]

Canon had me disable WSD and LLTD support. Bonjour on the printer is still enabled.

I still have communication with the printer; however, I can't print at all.

-Kevin

 

[Nothinman]

If the Mac is using Bonjour it should show up as a weird address with the MAC in it in the printers control panel.

If it was using straight IPv4 you would've had to have set it up for LPD or HPJD yourself.