All things related to multicast

[Amel Caldwell <>]

I just had similar problems with this group and even bigger problems with
group 239.255.255.253 which is used by Apple and Novell and a few others for
SLP (Service Locator Protocol).  Given the nature of the traffic and the blurb
that Bill cites below, I decided to filter 239.255.0.0/16 at the subnet level.

(I took the paragraph below to state that if you block any part of 239.255/16
you should block all of it and if you have multiple scopes defined 239.255/16
must be contained within it.  The definition of Local Scope is left to the
Network Administrator.

Amel Caldwell
University of Washington

On Fri, 5 Sep 2003, Bill Owens wrote:

>At 18:30 -0400 9/4/03, Alan Crosswell wrote:
>>Speaking of BCP filtering, look at all this clutter I am getting
>>from hundreds of hosts campus-wide:
>>
>>Frame 1 (175 bytes on wire, 175 bytes captured)
>>Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:7f:ff:fa
>>Internet Protocol, Src Addr: 128.59.193.116 (128.59.193.116), Dst
>>Addr: 239.255.
>>255.250 (239.255.255.250)
>>User Datagram Protocol, Src Port: 3005 (3005), Dst Port: 1900 (1900)
>>Hypertext Transfer Protocol
>>     M-SEARCH * HTTP/1.1\r\n
>>         Request Method: M-SEARCH
>>     Host:239.255.255.250:1900\r\n
>>     ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\n
>>     Man:"ssdp:discover"\r\n
>>     MX:3\r\n
>>     \r\n
>
>Apparently SSDP is a quasi-standard protocol, based on a now expired
>I-D that's still available at the UPnP site:
>http://www.upnp.org/download/draft_cai_ssdp_v1_03.txt
>
>At least it uses an official multicast address ;) It sounds like this
>traffic ought to be scoped to just the local subnet, though I may not
>fully understand the relevant paragraph from RFC 2365:
>
>6.1. The IPv4 Local Scope -- 239.255.0.0/16
>
>    239.255.0.0/16 is defined to be the IPv4 Local Scope.  The Local
>    Scope is the minimal enclosing scope, and hence is not further
>    divisible. Although the exact extent of a Local Scope is site
>    dependent, locally scoped regions must obey certain topological
>    constraints. In particular, a Local Scope must not span any other
>    scope boundary. Further, a Local Scope must be completely contained
>    within or equal to any larger scope. In the event that scope regions
>    overlap in area, the area of overlap must be in its own local scope.
>    This implies that any scope boundary is also a boundary for the Local
>    Scope. The more general topological requirements for administratively
>    scoped regions are discussed below.
>
>Talk about making your head hurt. . .
>
>Bill.
>
>