Close
Q: 'Mysterious' Airplay traffic to BSSID 00:25:00:FF:94:73
-
Oct 1, 2014 5:40 PMby iToaster,Your users could also be using software like airserver, reflector etc that mimics appletv
Or https://annotate.net which can mirror to ios devices
I guess it's possible an app the user has installed is doing something with AirPlay
-
Oct 2, 2014 12:15 PMby throw_away,After looking at this a bit more, I think this traffic is related to either Peer-to-Peer AirPlay (half-way down: Use AirPlay to wirelessly stream content from your iPhone, iPad, or iPod touch), or an Apple device 'probing' for an Airplay receiver.
Here's why:
- We only see traffic from the devices to 00:25:00:FF:94:73 -- nothing coming from 00:25:00:FF:94:73 to any device (presumably b/c its not in use).
- The traffic is unencrypted and contains an Apple device name
- Based on search results the MAC address (00:25:00:FF:94:73) is not unique, so I'm thinking it is somehow defined in software
- This iPhone 5 boot crash shows the phone setting its BSSID to 00:25:00:FF:94:73 (http://pastebin.com/4Wa4xVbr, line 428)
- The traffic is on 2.4 GHz on channel 6 (http://chambersdaily.com/bradleychambers/2014/9/19/technical-details-of-peer-to- peer-airplay)
- There are IPv6 multicast packets that contain "_airplay._tcp.local._raop" or "_raop._tcp.local._airplay" (http://community.arubanetworks.com/t5/Unified-Wired-Wireless-Access/AirPlay-mirr oring/m-p/28950/highlight/true#M9923)
Can anyone confirm or deny this?
