All things related to multicast

[Bill Owens <>]

OK, this one doesn't implicate any particular campus, or network; it's 
squarely in the lap of the programmers. And it does represent at least a 
potential information leakage situation that campus network security folks 
might be interested in, because it is. . . security software!

Someone at Spybot/Safer-Networking, Ltd. thinks that multicast is, and I 
quote, "a special reserved address for broadcasting purposes". They took a 
"special reserved address" - specifically, an address that IANA has reserved, 
226.178.217.5, and wired it into their software. As of right now here are 
~400 machines out there, banging away with their system names and the 
plaintive query, "Someone else out there?" The good news is that this one 
sits squarely in the middle of a nice contiguous block of reserved addresses, 
so I've already blocked it. However, if you are the sort of person who 
doesn't want your security software constantly announcing itself, you may 
want to block it yourself, and/or have a talk with the vendor about how 
multicast actually works.

Bill.