239.192.142.10

cabling

New Member
Jun 19, 2018
15
0
1
48
Hello friends

I need help. I have a local network with 5 proxmox nodes and a cluster. observing the network traffic with wireshark I see an excessive traffic that has as a destion:
dst: 239.192.142.10
port src: 5404
port dst: 5405

I understand that ports 5404 and 5405 are used for multicast CMAN and COROSYNC.

I don't understand why that IP address is used and why there is excessive traffic.

The ip source is from the nodes

I don't have wireshark installed on proxmox, run under windows

21:59:34 2020; UDP; enp6s0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; enp8s0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap501i0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap503i1; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i1; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr1; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; enp8s0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap501i0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap503i1; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i1; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr1; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 148 bytes; from 172.26.0.113:5404 to 172.26.0.97:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 148 bytes; from 172.26.0.113:5404 to 172.26.0.97:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405



Thanks for the help
 
Last edited:

spirit

Famous Member
Apr 2, 2010
3,939
214
83
www.odiso.com
This is a multicast address, as corosync (on proxmox5),use multicast.

If you don't have multicast feature on your physical switch, like "igmp snooping", the multicast traffic is send to all ports everywhere on your network.

(proxmox6 use corosync3, without multicast anymore)
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE and Proxmox Mail Gateway. We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!