0

I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the device. Is anybody familiar with expected traffic patterns with the Google Home Hub and the use of port 8009 (ajp13)?

192.168.1.1 = Desktop
192.168.1.254 = Google Home Hub

Netstat

Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        
(state)
tcp4       0      0  192.168.1.1.49358   192.168.1.254.8009    ESTABLISHED

PCAP

listening on en1, link-type EN10MB (Ethernet), capture size 262144 bytes
18:51:28.225716 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [P.], seq 1583784968:1583785085, ack 1115420831, win 2048, options [nop,nop,TS val 1046561108 ecr 14907794], length 117
18:51:28.235826 IP 192.168.1.254.8009 > 192.168.1.1.49358: Flags [P.], seq 1:118, ack 117, win 503, options [nop,nop,TS val 14909048 ecr 1046561108], length 117
18:51:28.235984 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [.], ack 118, win 2046, options [nop,nop,TS val 1046561118 ecr 14909048], length 0
18:51:33.237845 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [P.], seq 117:234, ack 118, win 2048, options [nop,nop,TS val 1046566111 ecr 14909048], length 117
18:51:33.381583 IP 192.168.1.254.8009 > 192.168.1.1.49358: Flags [P.], seq 118:239, ack 117, win 503, options [nop,nop,TS val 14910311 ecr 1046561118], length 121
18:51:33.381611 IP 192.168.1.254.8009 > 192.168.1.1.49358: Flags [P.], seq 239:356, ack 234, win 503, options [nop,nop,TS val 14910334 ecr 1046566111], length 117
18:51:33.382851 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [.], ack 239, win 2046, options [nop,nop,TS val 1046566253 ecr 14910311], length 0
18:51:33.382855 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [.], ack 356, win 2044, options [nop,nop,TS val 1046566253 ecr 14910334], length 0
18:51:33.382856 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [P.], seq 234:351, ack 356, win 2048, options [nop,nop,TS val 1046566253 ecr 14910334], length 117
18:51:33.562669 IP 192.168.1.254.8009 > 192.168.1.1.49358: Flags [.], ack 351, win 503, options [nop,nop,TS val 14910347 ecr 1046566253], length 0
18:51:38.382824 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [P.], seq 351:468, ack 356, win 2048, options [nop,nop,TS val 1046571242 ecr 14910347], length 117
18:51:38.393287 IP 192.168.1.254.8009 > 192.168.1.1.49358: Flags [.], ack 468, win 503, options [nop,nop,TS val 14911587 ecr 1046571242], length 0
18:51:38.393296 IP 192.168.1.254.8009 > 192.168.1.1.49358: Flags [P.], seq 356:473, ack 468, win 503, options [nop,nop,TS val 14911587 ecr 1046571242], length 117
18:51:38.393390 IP 192.168.1.1.49358 > 192.168.1.254.8009: Flags [.], ack 473, win 2046, options [nop,nop,TS val 1046571252 ecr 14911587], length 0
18:51:41.978304 IP 192.168.1.254.mdns > 224.0.0.251.mdns: 0 PTR (QM)? _googlezone._tcp.local. (40)
18:51:41.978911 IP 192.168.1.254.mdns > 224.0.0.251.mdns: 0*- [0q] 1/0/3 PTR 6ac9122c-8567-a19d-ed90-a8dce567cc26._googlezone._tcp.local. (226)
  • Have you tried to run Wireshark to inspect the content of the packets that are being sent to your Google Home Hub? – Aura Apr 27 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.