WAC510 sends packets to Port UDP 7788

[star0815]

Hi comminuty,

just discovered that my WAC510s are sending to 192.168.1.1:7788 UDP via eth0.

Port 7788 is not authorized to be used by IANA.

Can anyone please clarify?

Firmware V4.0.7.3

10.10.101.43 is WAC510, getting response from gateway 10.10.100.80.

Firmware V1.2.1.6 send same packets, but 14 data bytes instead of 36. Is it NETGEAR related?

Thanks and best regards.

[RaghuHR · Accepted solution]

Hi @star0815

This issue is addressed in the new firmware v4.2.0.11. Kindly follow the link to get new firmware. 

https://kb.netgear.com/000059508/WAC505-WAC510-Firmware-Version-4-2-0-11

Thanks,

Raghu

[DaneA]

Hi @star0815,

Let us try to upgrade the firmware to the latest version which is v4.2.0.9.  You can download it here.  Be sure to perform a factory reset on the WAC510 after upgrading the firmware then reconfigure the settings from scratch in order to start clean using the latest firmware version.  Then, check if same concern will occur. 

Regards,

DaneA

NETGEAR Community Team

[RaghuHR]

Can you confirm your WAC510 is managing with Insight Manager App? or Is it standalone mode?

[star0815]

Hi @DaneA,

they are running in standalone mode, have not tried Insight Manager App, yet.

Will also perform a firmware upgrade and post results.

Thanks!

[star0815]

Hi @DaneA,

have upgraded to latest firmware and performed a factory reset afterwards, then configured only neccesary settings (IP, password).

While no SSID is configured (or Day Zero configured one) no packets (7788/udp) are send out over eth0.

Packets are only sent when there is a configured SSID and clients are connected.

Will try some SSID-specific settings, but this config is used so far (default settings omitted):

IP LAN static (IP, Subnet, Gateway, DNS1+2)

NTP client=on, custom NTP server by hostname (and it is reachable)

Management mode=local (standalone)

UPnP=off

SSID "Guest":

Client Isolation=on

Band Steering=on

VLAN ID=99

802.11w (PMF)=on

One more thing: device is trying to query public NTP servers regardless of setting "use custom NTP server".

Best regards.

[RaghuHR]

Hi @star0815

Please download detailed logs from monitoring page and send it. BTW - Are there any chance that those wireless clients are used for any online gaming? Basically I would like to know what kind of traffic going?

Thanks,

Raghu

[star0815]

Hi @RaghuHR,

The devices are used in office environment, but is an public Wifi also. Android traffic to Internet is mostly seen.

I will send pcap also as private message.

Thanks and best regards!

[star0815]

After some tests it looks like udp/7788 packets are only sent when there are two SSIDs configured. After removing second SSID there are no more packets in pcap. Also tried to have different configurations of first/second SSID.

So the config I just sent might not reproduce that behavior, just add a second SSID.

I have also seen my custom NTP server is not responding to device, so querying other NTP servers should be OK despite "use custom NTP server" is checked?

Thanks a lot!

Edit: Just verified, when adding a second SSID (all default values) it starts to send udp/7788 packets.

[RaghuHR]

Hi @star0815

We have identifed the root cause and will be fixing this in our upcoming releases.

Thanks,

Raghu

[star0815]

Hi @RaghuHR,

glad you found the issue.

Many thanks and best regards!

[RaghuHR · Accepted solution]

Hi @star0815

This issue is addressed in the new firmware v4.2.0.11. Kindly follow the link to get new firmware. 

https://kb.netgear.com/000059508/WAC505-WAC510-Firmware-Version-4-2-0-11

Thanks,

Raghu