https://elvis.hcw.ac.at/wiki/index.php?action=history&feed=atom&title=File%3AWireshark_tether_app_device_decovery.png 2026-09-10T19:26:43Z Revision history for this page on the wiki MediaWiki 1.41.5 https://elvis.hcw.ac.at/wiki/index.php?title=File:Wireshark_tether_app_device_decovery.png&diff=4314&oldid=prev 2020-07-01T20:13:50Z

<p>Before establishing an SSH session, the Tether app sends an multicast discovery UDP packet to &lt;code&gt;255.255.255.255&lt;/code&gt; on port &lt;code&gt;20002&lt;/code&gt;. This message gets send 4 times. After that, the Tether app send another unicast message to responding...</p> <p><b>New page</b></p><div>== Summary ==<br /> Before establishing an SSH session, the Tether app sends an multicast discovery UDP packet to &lt;code&gt;255.255.255.255&lt;/code&gt; on port &lt;code&gt;20002&lt;/code&gt;. This message gets send 4 times. After that, the Tether app send another unicast message to responding devices on port &lt;code&gt;20002&lt;/code&gt;. The syntax of the payload is mostly unclear, an change after a restart. Anyway a device will still respond to any payload captured at any time. I assume that this discovery process is used to get device capatibilities and to finally initialize a secure channel via SSH. How the SSH tunnel gets initiated is also unkown at this state of research.</div>

JPDoe