Home / server / Questions / 1005372
Accepted
N S
Asked: 2020-03-03 23:41:16 +0800 CST

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

  • 772

As title states,

Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed.

Additionally My PC is sending SSDP packets to 239.255.255.250 (subnet?) regarding 'M-Search: HTTP/1.1' strings to Chrome OS machine.

MDNS Packet : 192.168.1.65 224.0.0.251 MDNS 119 Standard query 0x000b PTR _674A0243._sub._googlecast._tcp.local, "QM" question PTR _8E6C866D._sub._googlecast._tcp.local, "QM" question PTR _googlecast._tcp.local, "QM" question

SSDP Packet: 192.168.1.67 239.255.255.250 SSDP 216 M-SEARCH * HTTP/1.1

Perhaps its good to mention that i noticed the specified 'User-agent' for these SSDP packets are stated as either 'Google Chrome' or 'Chrome OS'. Is this just a default function of Google chrome to include their DIAL tech.

google wireshark mdns ssdp spoofing

2 Answers

  1. You're observing two different things that are independent from each other.

    • The SSDP traffic is just a general "poll" for devices that matches the search. 239.255.255.250 is a multicast address that is defined in the UPnP standard. SSDP is just the UPnP discovery mechanism that somebody thought should have its own name. Only "subscribers" to 239.255.255.250 will actually receive these messages (the OS network stack filters multicast messages), but as with all multicast packets, the packets themselves are sent to all network devices. Any number of software running on your computer can be the source of the M-SEARCH, some OS'es like Windows will even send these themselves as a part of the built-in "network discovery".
    • mDNS with DNS-SD is an alternative system for doing pretty much the same thing as SSDP. It's also called Bonjour among other things, and it too uses multicast to let network devices discover each other. DNS-SD adds the ability to announce "services" over mDNS or regular unicast DNS. _googlecast._tcp.local is one such "service" that is used by ChromeCasts, Android TVs, Google Home, the Chrome browser and all other things in the "Google ecosystem" that can take part in their "cast" system. I'm not fluid in mDNS, but it seems to me like this is also a "poll" looking for peripherals that support this "service". I assume that Chrome OS also take part in this, so it might be that for example a Chrome browser running on another OS and Chrome OS will "keep in touch" using this system.
    • 4
  2. Best Answer

    The Chrome browser comes with a built in Chromecast plugin to allow tab or screen sharing if a Chromecast compatible is on your local network (e.g. Android TV or Chromecast devices).

    It will search for devices regularly so it can present a list of target devices.

    • 2