Re: Cisco EIGRP "Hello"
From: The Saint (gur_fnvag_at_crgvgzbegr.arg)
Date: 10 Dec 2003 11:52:26 -0600
> I'm curious as to what I'm seeing in ethereal lately. I see a lot of EIGRP
>"Hello" packets from 172.28.9x.x, 10.x.x.x, etc. The packets are IP
>packets, always having destination as my multicast (22.214.171.124). There are
>no flags set, Protocol 0x58 (EIGRP), no flags and no sequence numbers. I'm
>seeing this on a machine that only has very specific tcp/udp rules per
>port, with IPTables default policy for all being DROP, and only about 15
>different ports allowed through (and the rules are STRICT). I'm not really
>worried, it's just annoying to see that many, and from what I consider
You apparently have (Charter) cable broadband. I'm curious why you
would allow private addresses from the outside into your network. I'm
also curious why you're not using a Linux box as your border firewall/
Also, if you're talking about the ruleset you posted earlier, you
didn't have a default policy set.
> Well anyways, I think they're somehow related to multicast, since they were
>flooding ethereal's logs with the router set to allow multicast to pass
>through, and now with it off, I'm not seeing all this anymore. However, I
>still want to know how to deny multicast to be sent to this machine using
>IPTables, and I'm finding it weird that IPTables just allows those through
>when it's not set to.
It would be easy if you had a Linux box as your border firewall/