All things related to multicast

[Alan Crosswell <>]

Speaking of BCP filtering, look at all this clutter I am getting from hundreds 
of hosts campus-wide:

Frame 1 (175 bytes on wire, 175 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:7f:ff:fa
Internet Protocol, Src Addr: 128.59.193.116 (128.59.193.116), Dst Addr: 
239.255.
255.250 (239.255.255.250)
User Datagram Protocol, Src Port: 3005 (3005), Dst Port: 1900 (1900)
Hypertext Transfer Protocol
    M-SEARCH * HTTP/1.1\r\n
        Request Method: M-SEARCH
    Host:239.255.255.250:1900\r\n
    ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\n
    Man:"ssdp:discover"\r\n
    MX:3\r\n
    \r\n


wat-edge-1#sho ip mrout 239.255.255.250 summary
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, s - SSM Group, C - Connected, L - Local,
       P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set,
       J - Join SPT, M - MSDP created entry, X - Proxy Join Timer Running
       A - Candidate for MSDP Advertisement, U - URD,
       I - Received Source Specific Host Report
Outgoing interface flags: H - Hardware switched
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 239.255.255.250), 2w6d/00:03:25, RP 128.59.0.15, OIF count: 15, flags: 
SJCF
  (128.59.157.53, 239.255.255.250), 00:04:46/00:02:18, OIF count: 14, flags: 
MT
  (128.59.197.87, 239.255.255.250), 00:08:56/00:02:57, OIF count: 14, flags: 
JT
  (129.85.31.106, 239.255.255.250), 00:00:36/00:02:23, OIF count: 15, flags: J
  (160.39.37.124, 239.255.255.250), 00:05:27/00:02:57, OIF count: 14, flags: 
JT
  (160.39.138.25, 239.255.255.250), 00:03:21/00:02:47, OIF count: 14, flags: T
  (160.39.138.43, 239.255.255.250), 00:02:16/00:02:47, OIF count: 14, flags: 
JT
  (160.39.139.86, 239.255.255.250), 00:02:40/00:02:57, OIF count: 14, flags: 
MT
  (160.39.157.32, 239.255.255.250), 00:05:24/00:02:27, OIF count: 14, flags: 
JT
  (160.39.157.40, 239.255.255.250), 00:00:03/00:02:56, OIF count: 14, flags: 
MT
  (160.39.157.118, 239.255.255.250), 00:03:19/00:02:57, OIF count: 14, flags: 
MT
  (160.39.168.106, 239.255.255.250), 00:05:33/00:02:18, OIF count: 14, flags: 
MT
  (160.39.169.88, 239.255.255.250), 00:02:49/00:02:57, OIF count: 14, flags: 
JT
  (160.39.186.245, 239.255.255.250), 00:03:32/00:02:26, OIF count: 14, flags: 
MT
  (160.39.188.203, 239.255.255.250), 00:05:27/00:02:26, OIF count: 14, flags: 
T
  (160.39.190.160, 239.255.255.250), 00:07:28/00:00:23, OIF count: 14, flags: 
T
  (160.39.192.234, 239.255.255.250), 00:04:59/00:02:26, OIF count: 14, flags: 
T
  (160.39.194.125, 239.255.255.250), 00:04:10/00:02:36, OIF count: 14, flags: 
T
  (160.39.195.78, 239.255.255.250), 00:09:33/00:02:26, OIF count: 14, flags: T
  (160.39.195.184, 239.255.255.250), 00:01:50/00:02:56, OIF count: 14, flags: 
MT
  (160.39.201.18, 239.255.255.250), 00:03:30/00:02:56, OIF count: 14, flags: T
  (160.39.202.110, 239.255.255.250), 00:05:42/00:01:00, OIF count: 14, flags: 
T
  (160.39.202.190, 239.255.255.250), 00:00:41/00:02:56, OIF count: 14, flags: 
JT
  (160.39.208.147, 239.255.255.250), 00:04:14/00:01:48, OIF count: 14, flags: 
JTA
  (160.39.209.62, 239.255.255.250), 00:04:03/00:02:26, OIF count: 14, flags: 
JT
  (160.39.220.101, 239.255.255.250), 00:04:45/00:02:23, OIF count: 14, flags: 
MTA
  (160.39.221.7, 239.255.255.250), 00:00:31/00:02:56, OIF count: 14, flags: JT
  (160.39.225.127, 239.255.255.250), 00:01:43/00:01:49, OIF count: 14, flags: 
FT
  (160.39.244.155, 239.255.255.250), 00:08:19/00:01:48, OIF count: 14, flags: 
T
  (160.39.244.241, 239.255.255.250), 00:04:16/00:01:38, OIF count: 14, flags: 
MT

What I don't get is why was this stuff showing up on a subnet that has no 
members?  I captured the preceding packet on a subnet with one switch and four 
hosts (where I'm trying to debug an intermittent problem with Norton Ghost).

My brain hurts again.  Multicast is *fun* (keep saying it).

/a