ALL ROUTERS.MCAST.NET .....???????

[discogail]

I would really appreciate a simple explanation for what's going on...To
explain to someone why...Tiny Firewall warns him every 3-4 minutes.........
"Application from your computer wants to send ICMP packet to
ALL ROUTERS.MCAST.NET (224.0.0.2)"
Detalis of application: TCPIP kernel driver

I know it has to do with multicasting...multicast routers.... along his
network..... which advertise their IP addresses along the subnet..... And
that the all-systems multicast address is 224.0.0.1 .
........& that apparently this is a normal act of the operating system
looking for any
routers in the area.
But I really lack the expertise & understanding to put this all together to
lay it out in plain, simple terms.. Thanks for the help.

[Jim Williamson]

"discogail" <disco...@hustle.com> wrote:

I'll be watching for replies here too. I have one system reporting the
same thing with ZA.

[Lars M. Hansen]

On Sat, 10 Aug 2002 11:10:35 -0400, discogail spoketh

Here's a likely candidate:

http://www.microsoft.com/windows2000/en/server/help/sag_TCPIP_ovr_newfeatures.htm

And another:

http://www.microsoft.com/windows2000/en/datacenter/help/sag_tcpip_und_multicasting.htm

Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'lars' in e-mail address)

[Chris Harrison]

discogail <disco...@hustle.com> declared forth unto the newsgroup:

:: I would really appreciate a simple explanation for what's going

Multicasting is some magic which allows multiple people to listen to the
same packet flow. (Saving a separate connection for each client.) In this
way a single flow can be sent all the way up to the last router, where it is
split for each client (as opposed to a separate connection from the source
for each concurrent connection).

Multicasting uses IP addresses from 224.0.0.0 onwards. It is based on a
subscription system. That is, to listen to a particular stream, you must
first subscribe. This helps routers as they can know if there are clients
subscribed downstream, and if they need to relay that multicast stream
onwards. If they don't need to relay anything, they pass that message
upstream saving themselves the bandwidth.

To get this subscription system working, your machine queries the routers
for active streams or channels to listen on. It does this via the 224.0.0.?
IP addresses. If the upstream routers are multicast capable, they will
respond with what streams or channels they have available. From there the
computer can send a message to subscribe...

Multicasting has benefits in that it can save on the bandwidth upstream.
Some ISP's that charge via volume might consider multicast free traffic as
they only need to download it once, regardless of how many peers subscribe
to the stream.

There have been some security concerns over the use of multicasting, so it
isn't as well documented or supported as it should be. Multicasting isn't
used very much at the moment, and you can probably quite happily live
without it in many cases. It is a part of IPv6 though, so it's popularity
should return when that is implemented.
--
Chris
Geek for Hire - Linux, Networking, Security, Disaster Recovery
http://ii.net/~theguru
(Insert _'s to email me)