239.192.142.10

[cabling]

Hello friends

I need help. I have a local network with 5 proxmox nodes and a cluster. observing the network traffic with wireshark I see an excessive traffic that has as a destion:
dst: 239.192.142.10
port src: 5404
port dst: 5405

I understand that ports 5404 and 5405 are used for multicast CMAN and COROSYNC.

I don't understand why that IP address is used and why there is excessive traffic.

The ip source is from the nodes

I don't have wireshark installed on proxmox, run under windows

21:59:34 2020; UDP; enp6s0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; enp8s0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap501i0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap503i1; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i1; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr1; 116 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; enp8s0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap501i0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap503i1; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; tap502i1; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr1; 452 bytes; from 172.26.0.111:5404 to 239.192.142.10:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 148 bytes; from 172.26.0.113:5404 to 172.26.0.97:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 148 bytes; from 172.26.0.113:5404 to 172.26.0.97:5405
Fri Feb 7 21:59:34 2020; UDP; vmbr0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405
Fri Feb 7 21:59:34 2020; UDP; enp6s0; 148 bytes; from 172.26.0.97:5404 to 172.26.0.110:5405



Thanks for the help

 

[spirit]

This is a multicast address, as corosync (on proxmox5),use multicast.

If you don't have multicast feature on your physical switch, like "igmp snooping", the multicast traffic is send to all ports everywhere on your network.

(proxmox6 use corosync3, without multicast anymore)