Re: Anybody seen this before?

From:
Date: 11/12/02 

Date: Tue, 12 Nov 2002 19:48:05 +0000 (UTC)

On Tue, 12 Nov 2002 00:58:18 GMT, James Wyatt <nobody@nowhere.com> wrote:
>I noticed some irregular traffic on my server. I did a tcp dump and this
>is what I got:
>> 17:48:16.149837 10.0.1.1.1901 > 239.255.255.250.1900: udp 266
>First of all: Who is 239.255.255.250? It looks a broadcast, but not
>quite. I tried to do a reverse dns lookup, no luck. I tried to nmap
>them, but the address does not appear up.
>Second: Why am I sending udp packets on port 1901? Any legitimate reason
>for me to send them?

The source is 10.0.1.1 and it is going to MULTICAST address
239.255.255.250. Someone is running some multicast software
(ntp uses multicast, some cisco routers do also, mbone traffic)
on your lan. Multicast can be used as a point to group broadcast
when you want (for example) video to go to a group of computers
but to be ignored by the rest.

If you use regular broadcast for this, every machine would see the
packets and have to process them. With multicast, some hardware can
drop unwanted packets (tulip driver for one) without bothering the
computer at all.

Relevant Pages

  • Packet reordering and blocking problem at gigabit with 2.4 kernel
    ... I am developing application level multicast router with Xeon processor. ... The system lost lots of packets and reordered the packets, ... Every channel sends 6Mbps with 2048 bytes packet. ... I heard that SMP machines has inherant reordering issues, ...
    (Linux-Kernel)
  • Re: UDP multicast packets not seen on listening interface in BETA5
    ... > I'm having a bit of trouble with a program I wrote to listen for ... > the multicast packets, ... > Also I verified the program is indeed listening with sockstat: ...
    (freebsd-current)
  • Re: Anybody seen this before?
    ... I think its probably ntp. ... Why am I sending udp packets on port 1901? ... Someone is running some multicast software ... Multicast can be used as a point to group broadcast ...
    (comp.os.linux.security)
  • Re: Spoofing multicast addresses
    ... }>> connections and it wasteful to do unnecessary checking on these packets. ... reducing the overhead of multicast packets wouldn't make ... doing the PCB lookup before the source address check, then the attacker ... able to keep things in the non-optimal state by varying the packet stream. ...
    (FreeBSD-Security)
  • Re: Multiple multicast apps
    ... Looks like an error in the multicast filter setup for your network ... Rather than having to take all multicast packets off the ... It's a bug and I would assume it has been fixed later in the 4.x ...
    (comp.unix.bsd.freebsd.misc)