All things related to multicast

[John Kristoff <>]

On Wed, 5 Mar 2003 00:14:56 +0100
Simon Leinen 
<>
 wrote:

> Looking at the SA cache, I see a lot of source announcements for group
> 224.0.1.76 (IAPP.MCAST.NET), which is registered for an "Inter-Access
> Point Protocol".  Seems to be used to support handover etc. for
> multi-AP IEEE 802.11 networks.

That address appears to be widely used by the Lucent/Avaya access points
(and perhaps others).  We've been filtering that here for awhile.

> Toerless, do you think this should be added to your standard filters?

I'd also recommend the following groups that often show up:

224.0.1.1 (ntp)
224.1.0.1 (cisco access points)

and it might not be a bad idea to block reserved groups such as:

225/8 through 231/8 and 234/8 through 238/8.

John