[nos-bbs] Please explain

[N8OUZ]

224.anything is "multicast"

Things like IGMP, OSPF, DHCP, PIM, VRRP, HSRP on the network "service protocol" side of things by your providers or infrastructure can cause this traffic to show.
Also, other things running application- or device-wise can cause this traffic. video or audio broadcasty stuff, usually. 


http://www.networksorcery.com/enp/protocol/ip/multicast.htm



On Nov 1, 2011, at 7:37 PM, Michael Fox - N6MEF wrote:

> I’m seeing the same thing, too.
>  
> Someone has started up OSPF on their AMPRnet tunnels.  OSPF is a very chatty protocol, with “HELLO” messages that go out every 10 seconds (by default).
>  
> M
>  
> From: nos-bbs-bounces at tapr.org [mailto:nos-bbs-bounces at tapr.org] On Behalf Of Don Moore
> Sent: Tuesday, November 01, 2011 3:59 PM
> To: nos-bbs
> Subject: [nos-bbs] Please explain
>  
>  
>  
> Can someone please explain why this is happening?
> 44.135.90.2 is my address the 44.208.0.1 is coming from Italy.
> Why am I seeing 224.0.0.5 traffic?
> I am getting these lines constantly now for two days...
>  
> thanks and 73
> Don - ve3zda
>  
> ps: it is not an english (44.208.0.1) site as I've telnet to it without being able to sign in successfully.
>  
>  
>  
> 22:51:29.197176 IP 94.101.48.134 > 192.168.1.150: IP 44.208.0.1 > 224.0.0.5: OSPFv2, Hello, length: 56 (ipip-proto-4)
> 22:51:29.197339 IP 94.101.48.134 > 192.168.1.150: IP 44.208.0.1 > 224.0.0.5: OSPFv2, Hello, length: 56 (ipip-proto-4)
> 22:51:29.197361 IP 94.101.48.134 > 192.168.1.150: IP 44.208.0.1 > 224.0.0.5: OSPFv2, Hello, length: 56 (ipip-proto-4)
> 22:51:29.197398 IP 94.101.48.134 > 192.168.1.150: IP 44.208.0.1 > 224.0.0.5: OSPFv2, Hello, length: 56 (ipip-proto-4)
> 22:51:29.197560 IP 94.101.48.134 > 192.168.1.150: IP 44.208.0.1 > 224.0.0.5: OSPFv2, Hello, length: 56 (ipip-proto-4)
> 22:51:29.201663 IP 192.168.1.150 > 94.101.48.134: IP 44.135.90.2 > 44.208.0.1: ICMP time exceeded in-transit, length 36 (ipip-proto-4)
> 22:51:29.207256 IP 192.168.1.150 > 94.101.48.134: IP 44.135.90.2 > 44.208.0.1: ICMP time exceeded in-transit, length 36 (ipip-proto-4)
> 22:51:29.212844 IP 192.168.1.150 > 94.101.48.134: IP 44.135.90.2 > 44.208.0.1: ICMP time exceeded in-transit, length 36 (ipip-proto-4)
> 22:51:29.218382 IP 192.168.1.150 > 94.101.48.134: IP 44.135.90.2 > 44.208.0.1: ICMP time exceeded in-transit, length 36 (ipip-proto-4)
> 22:51:29.223957 IP 192.168.1.150 > 94.101.48.134: IP 44.135.90.2 > 44.208.0.1: ICMP time exceeded in-transit, length 36 (ipip-proto-4)
>  
> 
> _______________________________________________
> nos-bbs mailing list
> nos-bbs at tapr.org
> https://www.tapr.org/cgi-bin/mailman/listinfo/nos-bbs

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.tapr.org/pipermail/nos-bbs_lists.tapr.org/attachments/20111102/b23926e4/attachment.html>