Disable Locate Directory Server Packets

[Perazim]

Running an Option Quad lite obtained from Vodacom. Pay as you go. Windows 2000 Pro SP4 with all hotfixes. Running the Ethereal capture software, I can see non ip packets transmitted every ten second but nothing in response from Vodacom. Ethereal says these are broadcasts looking for a directory server. Since there is no response, it just keeps going for the entire time online. These are 177 bytes each. That is 177 bytes x 6/minute x 60/hour x 24/day x 30/month = 45.878.400 bytes! At R2/MB that is R91/month for this traffic.

How does one disable this behavior?

This is not the same as PPP keep-alive packets. PPP keep-alive packets receive an answer from the other end.

Below is the Ethereal output

No. Time Source Destination Protocol Info
6 10.014400 fe:c9:20:52:41:53 Locate-Directory-Server LLC U, func=UI; DSAP LLC Sub-Layer Management Group, SSAP LLC Sub-Layer Management Command

Frame 6 (197 bytes on wire, 197 bytes captured)
Arrival Time: Nov 29, 2005 09:35:19.007299000
Time delta from previous packet: 2.543658000 seconds
Time since reference or first frame: 10.014400000 seconds
Frame Number: 6
Packet Length: 197 bytes
Capture Length: 197 bytes
Protocols in frame: eth:llc:data
IEEE 802.3 Ethernet
Destination: Locate-Directory-Server (03:00:00:00:00:02)
Source: fe:c9:20:52:41:53 (fe:c9:20:52:41:53)
Length: 180
Trailer: 000000
Logical-Link Control
DSAP: LLC Sub-Layer Management (0x02)
IG Bit: Group
SSAP: LLC Sub-Layer Management (0x02)
CR Bit: Command
Control field: U, func=UI (0x03)
000. 00.. = Command: Unnumbered Information (0x00)
.... ..11 = Frame type: Unnumbered frame (0x03)
Data (177 bytes)

0000 03 00 00 00 00 02 fe c9 20 52 41 53 00 b4 03 02 ........ RAS....
0010 03 52 54 53 53 03 00 00 00 00 00 a8 00 01 00 00 .RTSS...........
0020 00 cb 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 00 00 00 00 00 00 fe c9 20 52 41 53 fe ........... RAS.
0060 c9 20 52 41 53 00 00 00 00 00 00 00 00 00 00 00 . RAS...........
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00c0 00 00 00 00 00 .....

 

[cyberbob]

These are 177 bytes each. That is 177 bytes x 6/minute x 60/hour x 24/day x 30/month = 45.878.400 bytes! At R2/MB that is R91/month for this traffic.

ouch!

 

[VodaGuy]

Firewall

Hi

An idea is to stop these transmissions via a firewall client such as zonealarm.Of course this only treats the symptom. The logs should give you more information. It would be interesting to find out what is doing this and why.

Cheers

 

[biometrics]

Some clues here: http://www.ethereal.com/lists/ethereal-users/200511/msg00000.html