Multicast

1 Oct 2006 9:46 AM

Marbles

Hello

How do you configure XP to disable the accepting of multicast broadcasts ?

1 Oct 2006 9:50 AM

Richard G. Harper

You don't. By definition a multicast packet is sent to all devices on the
network. What they do with it at that point is up to the computer and/or
its client software. Can you explain, with detail, why you would consider
this a good thing to do and/or why you're trying to do it?

--
Richard G. Harper [MVP Shell/User] rghar***@gmail.com
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

Show quoteHide quote

"Marbles" <Marb***@discussions.microsoft.com> wrote in message
news:2B0E2F61-3ADE-4578-8444-C71E986B6BD2@microsoft.com...
>
> Hello
>
> How do you configure XP to disable the accepting of multicast broadcasts ?

1 Oct 2006 10:24 AM

Marbles

Trouble shooting some strange happennings on the LAN. Stuff that never use to
happen now does ... like DHCP releasing way too often sometimes with in a
half hour. Where it was static for weeks before. I imagine a clown sitting at
the other end pressing a big red plastic button.

Hhmm what else .. oh streaming ARP requests pouring in by the thousands per
minute, that are ethertype 806 & 800 encapsulated toghether. Sign of A VPN
with that mixture of ethertypes. Which I am no vpn host or client...any
suggestions on this one ???

Both broadcast ARP and multicast...?

Multicast should only be used on a network if all client machines are able
to accept it. Other wise it will cause slow downs for all traffic.

Is it possible to turn off multicast and whats your thoughts on the
encapsulated 800 & 806 ethertypes ?

Just trying to narrow down a few suspects.

1 Oct 2006 8:09 PM

Richard G. Harper

Personally, I think you're heading in the wrong direction. If you're
getting unexpected traffic on your network you need to install an analyzer
or packet sniffer and find out where it's coming from rather than trying to
block it. You may have a rogue (unauthorized) or renegade (badly configured
or reset to default conditions) device out there handing out DHCP leases and
generating traffic.

You can't "turn off" multicast - whatever device is sending the mcast
packets is the one you need to find and strangle. You don't want to anyway,
since DHCP itself uses multicast to look for a DHCP server and get a lease
offer.

--
Richard G. Harper [MVP Shell/User] rghar***@gmail.com
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

Show quoteHide quote

"Marbles" <Marb***@discussions.microsoft.com> wrote in message
news:75CE221D-424B-4991-A40E-CAA96BD076F2@microsoft.com...
> Trouble shooting some strange happennings on the LAN. Stuff that never use
> to
> happen now does ... like DHCP releasing way too often sometimes with in a
> half hour. Where it was static for weeks before. I imagine a clown sitting
> at
> the other end pressing a big red plastic button.
>
> Hhmm what else .. oh streaming ARP requests pouring in by the thousands
> per
> minute, that are ethertype 806 & 800 encapsulated toghether. Sign of A VPN
> with that mixture of ethertypes. Which I am no vpn host or client...any
> suggestions on this one ???
>
> Both broadcast ARP and multicast...?
>
> Multicast should only be used on a network if all client machines are able
> to accept it. Other wise it will cause slow downs for all traffic.
>
> Is it possible to turn off multicast and whats your thoughts on the
> encapsulated 800 & 806 ethertypes ?
>
> Just trying to narrow down a few suspects.

2 Oct 2006 5:35 PM

Marbles

Yup I have ran a sniffer proggie and when speaking to my ISP techs. Several
didnt know the true gateway IPs and another said they couldnt give out that
info..huh?. No big deal you can easily obtain the current gateway by using
command prompt and typing ipconfig /all. Which will list all current
info..all fine and dandy.

It's a crucial to know the exact gateway that the ISP say is their gateway
IP. Without that I don't know if my current gateway IP is legit or not. It
would also narrow down the source of possibilities The big help would If my
ISP techs would know or find out and give out what the ISP legit gateways
range of IP numbers.

Also note that with ethertype 800 (IVp4) & 806 (ARP) encapsulated it is
possible for someone on the other side of a gateway to spoof a gateway's IP
and send its load to the internal network /lan.

Im missing 1 crucual piece of info to finally know the source.

Strangling the culprit is a bit violent for me.
.....Thou I would'nt mind talking a Nerf bat to him.

Thanks for your help Richard

2 Oct 2006 8:53 PM

Richard G. Harper

Glad I was able to help out.

--
Richard G. Harper [MVP Shell/User] rghar***@gmail.com
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

Show quoteHide quote

"Marbles" <Marb***@discussions.microsoft.com> wrote in message
news:E7EDFA87-BF33-4882-8B71-3F7C6E525B0F@microsoft.com...
> Yup I have ran a sniffer proggie and when speaking to my ISP techs.
> Several
> didnt know the true gateway IPs and another said they couldnt give out
> that
> info..huh?. No big deal you can easily obtain the current gateway by using
> command prompt and typing ipconfig /all. Which will list all current
> info..all fine and dandy.
>
> It's a crucial to know the exact gateway that the ISP say is their
> gateway
> IP. Without that I don't know if my current gateway IP is legit or not. It
> would also narrow down the source of possibilities The big help would If
> my
> ISP techs would know or find out and give out what the ISP legit gateways
> range of IP numbers.
>
> Also note that with ethertype 800 (IVp4) & 806 (ARP) encapsulated it is
> possible for someone on the other side of a gateway to spoof a gateway's
> IP
> and send its load to the internal network /lan.
>
> Im missing 1 crucual piece of info to finally know the source.
>
> Strangling the culprit is a bit violent for me.
> ....Thou I would'nt mind talking a Nerf bat to him.
>
> Thanks for your help Richard