Wii Network Traffic

If the Wii is configured to obtain its IP information via DHCP, then it will send out UDP datagrams to obtain that information from a DHCP server.

If you were capturing the data sent from/to the WII with a packet analyzer, aka, sniffer, when you examine the IP portion of the Ethernet frames transmitted, you would see 17 for the protocol, which indicates a UDP datagram. The source port would be 68 and the destination port would be 67.

The Wii would send a DHCP request datagram and the DHCP server would respond with a DHCP acknowledgement datagram. As an example, the response might look something like that below:

DHCP: Message type = DHCPACK
DHCP: IP Address Lease Time = 259200 seconds
DHCP: DHCP Server Identifier = 192.168.0.1
DHCP: Subnet Mask = 255.255.255.0
DHCP: Router at = 192.168.0.1
DHCP: DNS Servers at = 192.168.0.53
DHCP: DNS Servers at = 208.67.222.222
DHCP: DNS Domain Name = example

The DHCP server at address 192.168.0.1 responds with a datagram with a source port of 67 and a destination port of 68, telling the Wii it is also the gateway address, i.e. router, and providing two DNS server addresses.

The Wii will need to obtain the MAC address of the domain name server at IP address 192.168.0.53, which is on the same LAN as the Wii in this case, by sending out an ARP request for it. The DNS server will send an ARP reply providing its hardware address.

Once the Wii has the MAC address for the DNS server, it will send a UDP datagram to port 53 on the primary DNS server asking for the IP address of rcw.wc24.wii.com. The DNS server will reply that the IP address for rcw.wc24.wii.com is 125.199.254.50. An authoritative name server for rcw.wc24.wii.com is nstd01.mesh.ad.jp, i.e. a name server in Japan (the country code for Japan is "jp").

Once the Wii has obtained the IP address for rcw.wc24.wii.com, it will attempt to contact that system on TCP port 80, i.e. it is attempting to contact a webserver at that address.

When the webserver acknowledges the Wii's connection attempt, the Wii will request the URL http://rcw.wc24.wii.com/cgi-bin/check.cgi.

HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: POST /cgi-bin/check.cgi HTTP/1.1
HTTP: Host: rcw.wc24.wii.com
HTTP: User-Agent: WiiConnect24/2.2.255.0
HTTP: Connection: close
HTTP: Content-Type: application/x-www-form-urlencoded
HTTP: [...]
HTTP:

Also, when the Wii is first turned on, I've observed it sending a DNS query for the IP address for nus.shop.wii.com. The IP address for that system is 209.67.106.201 and authoritative name servers for it are noa3dns-w.nintendo.com and noa3dns-e.nintendo.com. The Wii will attempt to establish an HTTPS connection to that system on TCP port 443 and, if successful, there will be an exchange of encrypted data.

The Wii may then submit a DNS query for the IP address for ccs.shop.wii.com. The IP address returned by the DNS server is 209.67.106.200. The authoritative name servers for it are the same as for nus.shop.wii.com. The Wii will attempt to establish an HTTPS connection to ccs.shop.wii.com on TCP port 443. When successful, the Wii exchanges encrypted data with that system.

The Will then submits a DNS query for nus.cdn.shop.wii.com. The IP addresses associated with that address are 8.21.193.9 and 8.21.193.19, i.e. the Wii could use either address when contacting the system. The Fully Qualified Domain Name (FQDN) nus.cdn.shop.wii is an alias. The canonical name is nus.cdn.shop.wii.com.edgesuite.net. The canonical name for nus.cdn.shop.wii.com.edgesuite.net is in turn a339.g.akamai.net. Akamai Technologies provides content caching services for other companies. See What's 'akamai', and why is my firewall alerting me about it? , if you would like further details on how Akamai servers are used.

The Wii will establish an HTTP connection on port 80 to that system.

HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: GET /ccs/download/0000000100000002/0000007a HTTP/1.1
HTTP: Host: nus.cdn.shop.wii.com
HTTP: Accept: text/html, image/gif, image/jpeg, */*
HTTP: Content-type: text/xml; charset=utf-8
HTTP: Connection: Keep-Alive
HTTP:

After the above download, I saw the Wii connect to the URL shown below.

HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: GET /ccs/download/0000000100000002/0000007b HTTP/1.1
HTTP: Host: nus.cdn.shop.wii.com
HTTP: Accept: text/html, image/gif, image/jpeg, */*
HTTP: Content-type: text/xml; charset=utf-8
HTTP: Connection: Keep-Alive
HTTP:

The Wii may also perform a DNS query for cfh.wapp.wii.com (Canonical Name: cfh.wapp.wii.com.edgesuite.net, which in turn has Canonical Name: a1390.g.akamai.net). The IP addresses I've seen returned for that system are 8.21.193.33, 8.14.105.88, and 8.14.105.97. There might possibly be others returned. Once the Wii has the IP address for that system, it will establish an HTTP connection to TCP port 80.

HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: GET /announce/049/1/4.bin HTTP/1.1
HTTP: Host: cfh.wapp.wii.com
HTTP: User-Agent: WiiConnect24/2.2.255.0
HTTP: If-Modified-Since: Fri, 04 Jul 2008 00:52:00 GMT
HTTP: Connection: Close
HTTP: [...]
HTTP:

If you go into the Internet settings menu and choose to do a connection test, the Wii will request an IP address via DHCP, if it is configured to use a DHCP-provided address rather than a static IP address. It will then perform a DNS query on conntest.nintendowifi.net. Even though the host name has "wifi" in it, the Wii will perform the query for this host name even if you are using a wired connection, instead of a wireless one. The IP address associated with that system is 192.195.204.216. The Wii will attempt to establish an HTTP connection to port 80 on that system.

HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: GET / HTTP/1.1
HTTP: Host: conntest.n
HTTP:

The server will respond with information similar to what is shown below:

HTTP: ----- HyperText Transfer Protocol -----
HTTP:
HTTP: HTTP/1.1 200 OK
HTTP: Date: Sun, 16 Aug 2009 21:08:20 GMT
HTTP: Server: GameCube
HTTP: Last-Modified: Tue, 07 Mar 2006 15:53:42 GMT
HTTP: ETag: "c9c3-f6-40e69a5bfad80"
HTTP: [...]
HTTP:

I've then seen the Wii perform a DNS lookup on the following host names with the relevant DNS server responses shown as well.

I've then seen the Wii send a UDP datagram to port 27901 on 207.38.11.12, 207.38.11.13 and 207.38.11.90 and those systems respond to the Wii using 27901 as the source UDP port with the destination port on the Wii being the same UDP port the Wii used for the source port port when the Wii sent data.

Refurbished Wii