Какое-то устройство посылает в сетку пакеты по IGMP протоколу, которые заставляют замирать входящее IPTV. Нужно обнаружить это устройство либо во внутренней сети, либо в сети провайдера. IP адрес розыскиваемого IP=172.20.57.2
# tcpdump -i eth0.146 igmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0.146, link-type EN10MB (Ethernet), capture size 96 bytes
11:21:19.122177 IP 172.20.57.2 > 239.1.1.15: igmp query v3 [max resp time 10s] [gaddr 239.1.1.15]
11:21:20.414155 IP 10.0.0.1 > all-routers.mcast.net: igmp leave 239.1.1.15
11:21:20.430817 IP 10.0.0.1 > 239.1.1.15: igmp v2 report 239.1.1.15
11:21:21.071795 IP 10.0.0.1 > 239.1.1.15: igmp v2 report 239.1.1.15
11:21:24.121463 IP 172.20.57.2 > all-systems.mcast.net: igmp query v3 [max resp time 50s]
11:21:29.703564 IP 10.0.0.1 > 239.1.1.15: igmp v2 report 239.1.1.15
11:21:34.125285 IP 172.20.57.2 > all-systems.mcast.net: igmp query v3 [max resp time 50s]
11:21:44.121621 IP 172.20.57.2 > all-systems.mcast.net: igmp query v3 [max resp time 50s]
11:21:49.127643 IP 172.20.57.2 > 239.1.1.15: igmp query v3 [max resp time 10s] [gaddr 239.1.1.15]
11:21:50.122103 IP 172.20.57.2 > 239.1.1.15: igmp query v3 [max resp time 10s] [gaddr 239.1.1.15]
11:21:53.399854 IP 10.0.0.1 > all-routers.mcast.net: igmp leave 239.1.1.15
11:21:54.121186 IP 172.20.57.2 > all-systems.mcast.net: igmp query v3 [max resp time 50s]
11:22:04.121256 IP 172.20.57.2 > all-systems.mcast.net: igmp query v3 [max resp time 50s]
11:22:14.122080 IP 172.20.57.2 > all-systems.mcast.net: igmp query v3 [max resp time 50s]
# tethereal -n -i eth0.146 -V host 172.20.57.2
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0.146
Frame 1 (60 bytes on wire, 60 bytes captured)
Arrival Time: Nov 25, 2011 11:22:44.121551000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:igmp]
Ethernet II, Src: 00:16:4d:71:b1:42 (00:16:4d:71:b1:42), Dst: 01:00:5e:00:00:01 (01:00:5e:00:00:01)
Destination: 01:00:5e:00:00:01 (01:00:5e:00:00:01)
Address: 01:00:5e:00:00:01 (01:00:5e:00:00:01)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: 00:16:4d:71:b1:42 (00:16:4d:71:b1:42)
Address: 00:16:4d:71:b1:42 (00:16:4d:71:b1:42)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Trailer: 00000000000000000000
Internet Protocol, Src: 172.20.57.2 (172.20.57.2), Dst: 224.0.0.1 (224.0.0.1)
Version: 4
Header length: 24 bytes
Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)
1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 36
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 1
Protocol: IGMP (0x02)
Header checksum: 0x1efc [correct]
[Good: True]
[Bad : False]
Source: 172.20.57.2 (172.20.57.2)
Destination: 224.0.0.1 (224.0.0.1)
Options: (4 bytes)
Router Alert: Every router examines packet
Internet Group Management Protocol
IGMP Version: 3
Type: Membership Query (0x11)
Max Response Time: 5.0 sec (0x32)
Header checksum: 0xecc3 [correct]
Multicast Address: 0.0.0.0 (0.0.0.0)
QRV=2 S=Do not suppress router side processing
.... 0... = S: Do not suppress router side processing
.... .010 = QRV: 2
QQIC: 10
Num Src: 0
1 packet captured
# ifconfig | grep 00:16:4d:71:b1:42
#