Results 1 to 4 of 4

Thread: outbound multicasts

  1. #1
    Senior Member
    Join Date
    Nov 2001

    outbound multicasts

    i have some xp pro machines on my network that are giving me this:

    Permitted: Out protocol [2], localhost->igmp.mcast.net [], Owner: Tcpip Kernel Driver

    Permitted: Out UDP, localhost:1090->, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE

    on searching around for some info on it ive come accross a broad spectrum of answers


    this person seems to attribute it to microsoft calling home but this:

    igmp broadcast to IGMP.MCAST.NET [x.x.x.x ->] (ttl = 1)
    wont make it past a router

    i was wondering if anyone here could shead some light on it. it doesn't seem to be anything to be concerned with but id like to understand whats going on

    i know i could change to 'deny' but the purpose of these firewalls is just to send messages to a syslogd for my viewing pleasure and not controll traffic in any way
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  2. #2
    Senior Member
    Join Date
    Mar 2004

    As for

    Due to [1], as you already stated: IGMP. So, what
    you see is a request of some programm to create, join or leave
    a host group - probably.
    "IGMP is used by IP hosts to register their dynamic multicast
    group membership. It is also used by connected routers to discover
    these group members."[2]. And what for?
    Multicasting ist good if all clients of that host group want the
    identical data simultaneously eg distributed updates/patching,
    streams (audio, video) etc.
    Remark: Via internet it's not very practical, since every router or
    switch between receiver and sender must be multicast-enabled.
    So its (usually?) not routed outside (TTL 1). The corresponding RFC is 988[3]
    (IP Multicasting) and 2236[4] (IGMP)

    As for

    "The administratively scoped IPv4 multicast address space is defined
    to be the range to", see technical details
    in [5]. Well, ...
    In XP, Universal Plug and Play devices are looked for by the
    SSDP discovery service using
    If some device answers, the so called control
    point (your service) learns about the device capabilities, like
    its address and discovers the device itself (get URL for description), ...

    Although I am not sure about all the points I have written, I think
    it gives you an idea.

    [1] http://www.iana.org/assignments/multicast-addresses
    [2] http://www.networksorcery.com/enp/protocol/igmp.htm
    [3] http://rfc.net/rfc988.html
    [4] http://rfc.net/rfc2236.html
    [5] http://rfc.net/rfc2365.html
    If the only tool you have is a hammer, you tend to see every problem as a nail.
    (Abraham Maslow, Psychologist, 1908-70)

  3. #3
    Just Another Geek
    Join Date
    Jul 2002
    Rotterdam, Netherlands
    UDP/1900 is UPnP/SSDP.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  4. #4
    Hi mom!
    Join Date
    Aug 2001
    You should be safe if you disallow multicast traffic from your network to the internet (but that's almost natural behavior of multicast traffic, given the low TTL values), and vica versa. While on it, disallow traffic from private address space (,, from anywhere but your own network. You could also disallow from anywhere but the local loopback interface.
    I wish to express my gratitude to the people of Italy. Thank you for inventing pizza.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts