All things related to multicast

["Roberts, Michael J. (IATS)" <>]

I am pretty sure that this is a WinXP type service called SSDP, which
can be disabled in a user's control panel. I am almost positive that it
is enabled by default.  Unless you are taking advantage of it, I would
filter it at layer 3 boundaries or close to the user if possible.  We
have found it to be a nuisance.

-mike

-----Original Message-----
From: Alan Crosswell 
[mailto:]
 
Sent: Thursday, September 04, 2003 5:31 PM
To: wg-multicast
Subject: SSDP to 239.255.255.240


Speaking of BCP filtering, look at all this clutter I am getting from
hundreds 
of hosts campus-wide:

Frame 1 (175 bytes on wire, 175 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:7f:ff:fa Internet
Protocol, Src Addr: 128.59.193.116 (128.59.193.116), Dst Addr: 239.255.
255.250 (239.255.255.250) User Datagram Protocol, Src Port: 3005 (3005),
Dst Port: 1900 (1900) Hypertext Transfer Protocol
     M-SEARCH * HTTP/1.1\r\n
         Request Method: M-SEARCH
     Host:239.255.255.250:1900\r\n
     ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\n
     Man:"ssdp:discover"\r\n
     MX:3\r\n
     \r\n


wat-edge-1#sho ip mrout 239.255.255.250 summary
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, s - SSM Group, C - Connected, L - Local,
        P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set,
        J - Join SPT, M - MSDP created entry, X - Proxy Join Timer
Running
        A - Candidate for MSDP Advertisement, U - URD,
        I - Received Source Specific Host Report
Outgoing interface flags: H - Hardware switched
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 239.255.255.250), 2w6d/00:03:25, RP 128.59.0.15, OIF count: 15,
flags: SJCF
   (128.59.157.53, 239.255.255.250), 00:04:46/00:02:18, OIF count: 14,
flags: MT
   (128.59.197.87, 239.255.255.250), 00:08:56/00:02:57, OIF count: 14,
flags: JT
   (129.85.31.106, 239.255.255.250), 00:00:36/00:02:23, OIF count: 15,
flags: J
   (160.39.37.124, 239.255.255.250), 00:05:27/00:02:57, OIF count: 14,
flags: JT
   (160.39.138.25, 239.255.255.250), 00:03:21/00:02:47, OIF count: 14,
flags: T
   (160.39.138.43, 239.255.255.250), 00:02:16/00:02:47, OIF count: 14,
flags: JT
   (160.39.139.86, 239.255.255.250), 00:02:40/00:02:57, OIF count: 14,
flags: MT
   (160.39.157.32, 239.255.255.250), 00:05:24/00:02:27, OIF count: 14,
flags: JT
   (160.39.157.40, 239.255.255.250), 00:00:03/00:02:56, OIF count: 14,
flags: MT
   (160.39.157.118, 239.255.255.250), 00:03:19/00:02:57, OIF count: 14,
flags: MT
   (160.39.168.106, 239.255.255.250), 00:05:33/00:02:18, OIF count: 14,
flags: MT
   (160.39.169.88, 239.255.255.250), 00:02:49/00:02:57, OIF count: 14,
flags: JT
   (160.39.186.245, 239.255.255.250), 00:03:32/00:02:26, OIF count: 14,
flags: MT
   (160.39.188.203, 239.255.255.250), 00:05:27/00:02:26, OIF count: 14,
flags: T
   (160.39.190.160, 239.255.255.250), 00:07:28/00:00:23, OIF count: 14,
flags: T
   (160.39.192.234, 239.255.255.250), 00:04:59/00:02:26, OIF count: 14,
flags: T
   (160.39.194.125, 239.255.255.250), 00:04:10/00:02:36, OIF count: 14,
flags: T
   (160.39.195.78, 239.255.255.250), 00:09:33/00:02:26, OIF count: 14,
flags: T
   (160.39.195.184, 239.255.255.250), 00:01:50/00:02:56, OIF count: 14,
flags: MT
   (160.39.201.18, 239.255.255.250), 00:03:30/00:02:56, OIF count: 14,
flags: T
   (160.39.202.110, 239.255.255.250), 00:05:42/00:01:00, OIF count: 14,
flags: T
   (160.39.202.190, 239.255.255.250), 00:00:41/00:02:56, OIF count: 14,
flags: JT
   (160.39.208.147, 239.255.255.250), 00:04:14/00:01:48, OIF count: 14,
flags: JTA
   (160.39.209.62, 239.255.255.250), 00:04:03/00:02:26, OIF count: 14,
flags: JT
   (160.39.220.101, 239.255.255.250), 00:04:45/00:02:23, OIF count: 14,
flags: MTA
   (160.39.221.7, 239.255.255.250), 00:00:31/00:02:56, OIF count: 14,
flags: JT
   (160.39.225.127, 239.255.255.250), 00:01:43/00:01:49, OIF count: 14,
flags: FT
   (160.39.244.155, 239.255.255.250), 00:08:19/00:01:48, OIF count: 14,
flags: T
   (160.39.244.241, 239.255.255.250), 00:04:16/00:01:38, OIF count: 14,
flags: MT

What I don't get is why was this stuff showing up on a subnet that has
no 
members?  I captured the preceding packet on a subnet with one switch
and four 
hosts (where I'm trying to debug an intermittent problem with Norton
Ghost).

My brain hurts again.  Multicast is *fun* (keep saying it).

/a