Wireshark: traces for PopCorn Hour

Now that i have a PopCorn on the network, I wanted to measure it’s impact on my local network:

  • 160 packets at boot within 1mn30

It mainly generates multicast DNS (mDNS) and SSDP. Stopping their own myihome protocol reduce a lot these broadcasts.

Surprise, my pc start to send request to PopCorn using UDP, every 30 seconds on port 427 (srvloc), but the PopCorn refuses through icmp unreachable:

TCPView shows up the process who listen on this port on my PC, but we only get the hosting process, svchost:

wireshark_popcorn_tcpview

Process Explorer ends up the mystery:

wireshark_popcorn_procexp

So it’s my HP driver that sends these requests every 30 seconds, even if this one answer with an icmp unreachable….HP never quit….Argh!

Here is a Wireshark filter to quickly find a PopCorn on the network:

http.server contains "Syabas myiBox

Leave a Comment