All things related to multicast

[Bill Owens <>]

Anybody know what these hosts have in common?

DOORSTOP2003.MIT.EDU.
DOORSTOP2004.MIT.EDU.
rcsb-snap-appliance-1.rutgers.edu.
tropicalis.MCB.Berkeley.EDU.
snap1.is.rice.edu.
kandel.bme.columbia.edu.
udarstore.udar.columbia.edu.
udarstore02.udar.columbia.edu.
herring.net.isc.upenn.edu.
nas.oit.ucsb.edu.
nas06.library.umass.edu.
nasfilesvr02.library.umass.edu.
viterbistorage.usc.edu.
cartman.uscard.usc.edu.
sdm256.sdm.buffalo.edu.
129-79-86-110.dhcp-bl.indiana.edu.
hopper.gti.ed.ac.uk.
microscopysnap.WISTAR.UPENN.EDU.
SpeicherSnap.wistar.upenn.edu.
i5200pc7.seas.upenn.edu.
math31.ucsd.edu.
in-info-video2.informatics.iupui.edu.
odin.lrdc.pitt.edu.
vectra.lrdc.pitt.edu.
a61756.education.louisville.edu.
css.bradley.edu.
host-241.subnet-65.med.umich.edu.
qg4400-gab1.mat.ucm.es.
topaz.its.unc.edu.
cwbusvrduc.chapel.duke.edu.
cwbusvrduc.chapel.duke.edu.
cwbusvratc.oit.duke.edu.
samplf04.ece.ohio-state.edu.
oscar.pathology.northwestern.edu.
fa-snap01.Rutgers.EDU.
aresnap.ucdavis.edu.
centaurus.Stanford.EDU.

I can say one thing for sure, they're all sending traffic to 224.3.4.5, port 
2599. It looks like this:

User Datagram Protocol, Src Port: 2599 (2599), Dst Port: 2599 (2599)
    Source port: 2599 (2599)
    Destination port: 2599 (2599)
    Length: 280
    Checksum: 0xa8dd [correct]
Data (272 bytes)

0000  4f 70 75 73 00 01 00 00 00 00 00 00 78 da 6d 50   Opus........x.mP
0010  cd 4a 03 31 10 9e da 5d ad a8 ad be 80 08 9e 1d   .J.1...]........
0020  66 26 d9 d8 06 2f ae e2 51 0b 05 0f 5e fc ab 20   f&.../..Q...^.. 
0030  88 50 58 f6 0d 7c 22 5f c0 97 f1 e4 cd 37 e8 24   .PX..|"_.....7.$
0040  bb ec b6 ae 13 be 7c 5f be 49 66 c2 00 1c df dd   ......|_.If.....
0050  2c ca 02 00 7a 8a 69 c5 db 0f 00 e9 8f ea a4 f6   ,...z.i.........
0060  fb b0 49 9f f5 39 c4 b7 62 a3 46 8c cb 37 ff 15   ..I..9..b.F..7..
0070  45 7a 9b 07 da ff bd 3a 0b 7c f8 11 dd 5e 53 a7   Ez.....:.|...^S.
0080  05 fc d1 ab f7 5a 0c e7 af cf 0b 2c df 1f 8b 02   .....Z.....,....
0090  5f e6 25 a4 d7 e7 33 12 48 6c 46 04 03 ca 90 18   _.%...3.HlF.....
00a0  55 8d c8 19 ca 05 1b 63 c7 22 a1 c8 f8 68 36 65   U......c."...h6e
00b0  e8 87 2d 31 39 a9 64 14 d8 65 b4 c8 f7 c4 27 4f   ..-19.d..e....'O
00c0  6a 1d 10 f9 0b f2 b9 f3 e4 bc 51 21 30 62 19 23   j.........Q!0b.#
00d0  f3 04 d9 29 9f 0a ec 49 96 61 05 6d b2 9e 97 cc   ...)...I.a.m....
00e0  c2 b0 31 88 90 27 b0 45 18 57 27 d1 9e 9d 43 6b   ..1..'.E.W'...Ck
00f0  56 2b 39 ed 64 e2 18 3a 3f 32 f5 7c d6 5e b3 fd   V+9.d..:?2.|.^..
0100  af 4d 95 e8 c4 a0 9d 31 85 a1 2f 01 cc 78 41 8e   .M.....1../..xA.

The names suggest something about SAN, and they all have the string 'Opus' at 
the beginning of each packet. Google is less than helpful, and I don't recall 
seeing this one running around before. Ethereal doesn't know how to parse it, 
which is odd considering that Ethereal knows how to parse quite a few 
protocols that I've never even heard of ;) Any guesses?

Bill.