Security Incidents mailing list archives

Re: Odd addresses on my wireless network


From: "Michael T. Babcock" <mike () triplepc com>
Date: Thu, 25 Nov 2004 08:37:20 -0500

Ron wrote:

Windows computers, and some routers, have an obsession with sending traffic to "239.255.255.253" for something to do with upnp connectivity. I didn't even realize this was happening until I set up Snort on my Linux box, and discovered packets destined for that (unroutable) address every second or so. If either of your routers had upnp enabled, and you don't know what that is or don't use it, then I would recommend disabling it.


First off, those address ranges are primarily multicast ranges and therefore perfectly routable, if your routers / network support it (and they probably do).

239.255.255.253 is the service location protocol address, 224.0.1.22 is SLGM and 224.0.1.35 is DADM.

For a short reference, I found http://www.networksorcery.com/enp/protocol/slp.htm on Google for you.

I recommend a search of "239.255.255.253 multicast"

--
Michael T. Babcock
Triple PC Ltd.


Current thread: