Omada ER7206 v2.0 (firmware 2.2.3) mDNS repeater bug causing malformed packets
I have a setup with ER7206 v2.0 (firmware 2.2.3), SG2016P v1.20 (1.20.14), and 3 EAP772(US) v1.0 (1.0.14). All controlled through Omada controller 6.0.0.24 and I believe I've found a bug in the mDNS repeater service.
I have a vlan for my IoT devices and a vlan for my devices, my soundbars are on the IoT vlan (one Samsung, one LG). Tidal connect won't work across vlans in any way shape or form. I've disabled any ACL blocks and added explicit allows already, and can verify traffic is flowing normally between VLANs. I've also set up mDNS service with the IoT as the server and main as the client, as well as added _tidalconnect._tcp.local as a bonjour service. (I actually added it both ways as a troubleshooting option).
However, my phone devices (on the main vlan) still can´t see any of my soundbars on tidal connect, and I believe it is because the mDNS repeater is broadcasting malformed packets. See a relevant packet capture:
My Phone asks about tidalconnect:
0000 01 00 5e 00 00 fb 90 b6 22 fe ba a9 08 00 45 00
0010 00 46 5f 01 40 00 ff 11 75 d9 c0 a8 05 28 e0 00
0020 00 fb 14 e9 14 e9 00 32 f6 6d 00 01 00 00 00 01
0030 00 00 00 00 00 00 0d 5f 74 69 64 61 6c 63 6f 6e
0040 6e 65 63 74 04 5f 74 63 70 05 6c 6f 63 61 6c 00
0050 00 0c 80 01
The mDNS repeater repeats it:
0000 01 00 5e 00 00 fb 24 2f d0 7f b9 c0 81 00 00 06
0010 08 00 45 00 00 46 b6 6a 40 00 ff 11 1d 97 c0 a8
0020 06 01 e0 00 00 fb 14 e9 14 e9 00 32 75 96 00 00
0030 00 00 00 01 00 00 00 00 00 00 0d 5f 74 69 64 61
0040 6c 63 6f 6e 6e 65 63 74 04 5f 74 63 70 05 6c 6f
0050 63 61 6c 00 00 0c 00 01
The soundbar responds:
0000 01 00 5e 00 00 fb c8 a6 ef df 0b 32 81 00 00 06
0010 08 00 45 00 01 42 cf b3 40 00 ff 11 03 33 c0 a8
0020 06 20 e0 00 00 fb 14 e9 14 e9 01 2e ce 78 00 00
0030 84 00 00 00 00 01 00 00 00 06 0d 5f 74 69 64 61
0040 6c 63 6f 6e 6e 65 63 74 04 5f 74 63 70 05 6c 6f
0050 63 61 6c 00 00 0c 00 01 00 00 11 94 00 2c 29 48
0060 57 2d 51 38 30 30 44 2d 37 39 35 65 63 32 35 66
0070 61 30 63 66 63 63 36 34 32 35 62 37 35 39 30 39
0080 30 31 65 36 64 38 66 33 c0 0c c0 30 00 10 80 01
0090 00 00 11 94 00 4b 0b 6d 6e 3d 48 57 2d 51 38 30
00a0 30 44 04 63 61 3d 35 23 69 64 3d 37 39 35 65 63
00b0 32 35 66 61 30 63 66 63 63 36 34 32 35 62 37 35
00c0 39 30 39 30 31 65 36 64 38 66 33 10 66 6e 3d 53
00d0 6f 75 6e 64 62 61 72 20 53 61 6c 61 04 76 65 3d
00e0 31 c0 30 00 21 80 01 00 00 00 78 00 12 00 00 00
00f0 00 c0 52 09 6c 6f 63 61 6c 68 6f 73 74 c0 1f c0
0100 c5 00 01 80 01 00 00 00 78 00 04 c0 a8 06 20 c0
0110 c5 00 1c 80 01 00 00 00 78 00 10 fe 80 00 00 00
0120 00 00 00 ca a6 ef ff fe df 0b 32 c0 30 00 2f 80
0130 01 00 00 11 94 00 09 c0 30 00 05 00 00 80 00 40
0140 c0 c5 00 2f 80 01 00 00 00 78 00 08 c0 c5 00 04
0150 40 00 00 08
The mDNS repeater repeats it with malformed packet:
0000 01 00 5e 00 00 fb 24 2f d0 7f b9 c0 08 00 45 00
0010 01 26 85 3d 40 00 ff 11 4e e4 c0 a8 05 01 e0 00
0020 00 fb 14 e9 14 e9 01 12 b9 6d 00 00 84 00 00 00
0030 00 06 00 00 00 00 0d 5f 74 69 64 61 6c 63 6f 6e
0040 6e 65 63 74 04 5f 74 63 70 05 6c 6f 63 61 6c 00
0050 00 0c 00 01 00 00 11 94 00 2c 29 48 57 2d 51 38
0060 30 30 44 2d 37 39 35 65 63 32 35 66 61 30 63 66
0070 63 63 36 34 32 35 62 37 35 39 30 39 30 31 65 36
0080 64 38 66 33 c0 0c 09 6c 6f 63 61 6c 68 6f 73 74
0090 c0 1f 00 2f 80 01 00 00 00 78 00 08 c0 c5 00 04
00a0 40 00 00 08 c0 30 00 2f 80 01 00 00 11 94 00 09
00b0 c0 30 00 05 00 00 80 00 40 c0 5c 00 01 80 01 00
00c0 00 00 78 00 04 c0 a8 06 20 c0 30 00 21 80 01 00
00d0 00 00 78 00 08 00 00 00 00 c0 52 c0 5c c0 30 00
00e0 10 80 01 00 00 11 94 00 4b 0b 6d 6e 3d 48 57 2d
00f0 51 38 30 30 44 04 63 61 3d 35 23 69 64 3d 37 39
0100 35 65 63 32 35 66 61 30 63 66 63 63 36 34 32 35
0110 62 37 35 39 30 39 30 31 65 36 64 38 66 33 10 66
0120 6e 3d 53 6f 75 6e 64 62 61 72 20 53 61 6c 61 04
0130 76 65 3d 31
The other soundbar also responds:
0000 01 00 5e 00 00 fb 44 27 45 4d 5b ee 81 00 00 06
0010 08 00 45 00 01 67 d1 35 40 00 ff 11 01 a0 c0 a8
0020 06 0c e0 00 00 fb 14 e9 14 e9 01 53 15 7b 00 00
0030 84 00 00 00 00 01 00 00 00 07 0d 5f 74 69 64 61
0040 6c 63 6f 6e 6e 65 63 74 04 5f 74 63 70 05 6c 6f
0050 63 61 6c 00 00 0c 00 01 00 00 11 94 00 29 26 53
0060 39 30 54 59 2d 66 63 32 36 61 63 31 32 64 64 39
0070 35 34 30 61 36 36 65 32 36 39 64 37 31 30 35 36
0080 31 32 32 66 65 c0 0c c0 30 00 10 80 01 00 00 11
0090 94 00 4a 08 6d 6e 3d 53 39 30 54 59 04 63 61 3d
00a0 34 23 69 64 3d 66 63 32 36 61 63 31 32 64 64 39
00b0 35 34 30 61 36 36 65 32 36 39 64 37 31 30 35 36
00c0 31 32 32 66 65 04 76 65 3d 31 12 66 6e 3d 53 6f
00d0 75 6e 64 62 61 72 20 53 75 c3 ad 74 65 c0 30 00
00e0 21 80 01 00 00 00 78 00 1f 00 00 00 00 07 e3 16
00f0 6c 67 65 2d 73 74 2d 63 34 61 2d 65 6d 6d 63 2d
0100 6d 74 37 36 36 38 c0 1f c0 c1 00 01 80 01 00 00
0110 00 78 00 04 c0 a8 06 0c c0 c1 00 1c 80 01 00 00
0120 00 78 00 10 fe 80 00 00 00 00 00 00 46 27 45 ff
0130 fe 4d 5b ee c0 c1 00 1c 80 01 00 00 00 78 00 10
0140 fd 5c 0d cd 86 2d 12 ae 46 27 45 ff fe 4d 5b ee
0150 c0 30 00 2f 80 01 00 00 11 94 00 09 c0 30 00 05
0160 00 00 80 00 40 c0 c1 00 2f 80 01 00 00 00 78 00
0170 08 c0 c1 00 04 40 00 00 08
The mDNS repeater repeats it also with malformed packet:
0000 01 00 5e 00 00 fb 24 2f d0 7f b9 c0 08 00 45 00
0010 01 3d 85 40 40 00 ff 11 4e ca c0 a8 05 01 e0 00
0020 00 fb 14 e9 14 e9 01 29 7d 19 00 00 84 00 00 00
0030 00 06 00 00 00 00 26 53 39 30 54 59 2d 66 63 32
0040 36 61 63 31 32 64 64 39 35 34 30 61 36 36 65 32
0050 36 39 64 37 31 30 35 36 31 32 32 66 65 0d 5f 74
0060 69 64 61 6c 63 6f 6e 6e 65 63 74 04 5f 74 63 70
0070 05 6c 6f 63 61 6c 00 00 10 80 01 00 00 11 94 00
0080 4a 08 6d 6e 3d 53 39 30 54 59 04 63 61 3d 34 23
0090 69 64 3d 66 63 32 36 61 63 31 32 64 64 39 35 34
00a0 30 61 36 36 65 32 36 39 64 37 31 30 35 36 31 32
00b0 32 66 65 04 76 65 3d 31 12 66 6e 3d 53 6f 75 6e
00c0 64 62 61 72 20 53 75 c3 ad 74 65 16 6c 67 65 2d
00d0 73 74 2d 63 34 61 2d 65 6d 6d 63 2d 6d 74 37 36
00e0 36 38 c0 46 00 2f 80 01 00 00 00 78 00 08 c0 c1
00f0 00 04 40 00 00 08 c0 0c 00 2f 80 01 00 00 11 94
0100 00 09 c0 30 00 05 00 00 80 00 40 c0 a1 00 1c 80
0110 01 00 00 00 78 00 10 fd 5c 0d cd 86 2d 12 ae 46
0120 27 45 ff fe 4d 5b ee c0 a1 00 01 80 01 00 00 00
0130 78 00 04 c0 a8 06 0c c0 0c 00 21 80 01 00 00 00
0140 78 00 08 00 00 00 00 07 e3 c0 a1
I've added a wireshark packet cap attached for visibility too. There are various reports across the internet of tidal connect not working with Omada mDNS and I believe this malformation of packet is the cause.
