All things related to multicast

[Gary Parker <>]

We received a couple of abuse reports for one of our hosts from a University in the States (don't want to go into any more detail just yet) over the weekend. It appears to be an automatically generated message and, if I'm right, there may be quite a few folk on this list who have received the same alert. The abuse report is complaining of large amounts of connections on UDP port 9875 to an address in the 224.x.x.x range. So, two odd things there: UDP 9875 is, I believe, the port SAP announces are made on and it looks like they've got a machine configured with a multicast group address.

As I said, if my theory is correct there are probably quite a few people who have received these automated messages recently (I'm guessing anyone who's sending out SAP announce that are reaching this institution). Please let me know (off- or on-list) if you've been contacted about this.

---
/-Gary Parker-----------------------------------------f-\
|    IT Services Specialist, Network & Security Team    |
n         Loughborough University, IT Services          |
|          http://www.lboro.ac.uk/computing/            o
|     Telephone: 01509 226044 Mobile: 07989 172258      |
\r----------------------------------------------------d-/