Connectivity
Connectivity and managing Your Comcast Business network
Male IT Specialist Holds Laptop and Discusses Work with Female Server Technician. They're Standing in Data Center, Rack Server Cabinet is Open.
Highlighted
Frequent Contributor

DPC3939B traffic to 224.0.0.1

Greetings,

I have noticed traffic coming from the DPC3939B gateway to 224.0.0.0 this seem to be multicast but multicast is blocked at the gateway and also blocked at server level. under my circunstances is this traffic normal? is there a way to stop it? thank you.

May 15 10:38:24 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24871 PROTO=2
May 15 10:40:28 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24873 PROTO=2
May 15 10:42:34 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24875 PROTO=2
May 15 10:44:39 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24877 PROTO=2
May 15 10:46:44 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24879 PROTO=2
May 15 10:48:49 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24881 PROTO=2
May 15 10:50:53 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24883 PROTO=2
May 15 10:52:59 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24885 PROTO=2
May 15 10:55:03 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24887 PROTO=2
May 15 10:57:09 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24889 PROTO=2
May 15 10:59:14 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24891 PROTO=2
May 15 11:01:19 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24893 PROTO=2
May 15 11:03:23 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24895 PROTO=2
May 15 11:05:29 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24897 PROTO=2
May 15 11:07:33 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24899 PROTO=2
May 15 11:09:38 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24901 PROTO=2
May 15 11:11:44 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24903 PROTO=2
May 15 11:13:49 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24905 PROTO=2
May 15 11:15:54 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24907 PROTO=2
May 15 11:17:59 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24909 PROTO=2
May 15 11:20:04 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24911 PROTO=2
May 15 11:22:09 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24913 PROTO=2
May 15 11:24:14 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24915 PROTO=2
May 15 11:26:19 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24917 PROTO=2
May 15 11:28:24 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24919 PROTO=2
May 15 11:30:29 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24921 PROTO=2
May 15 11:32:34 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24923 PROTO=2
May 15 11:34:38 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24925 PROTO=2
May 15 11:36:44 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24927 PROTO=2
May 15 11:38:49 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24929 PROTO=2
May 15 11:40:54 src=GA.TE.WAY.IP DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=24931 PROTO=2

 

0 Kudos
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Frequent Contributor

Re: DPC3939B traffic to 224.0.0.1

Rich I turned off wifi on that second router and the trafic coming from the gateway is still coming to 224.0.0.1. something else is keeping it going but I do not see the source.

View solution in original post

5 REPLIES 5
Trusted Forum Contributor

Re: DPC3939B traffic to 224.0.0.1

Hello aic,

 

From what device and facility are you seeing this coming in on?  This could be multicast from one of your wifi devices broadcasting functions that is not totally disabled. 

0 Kudos
Highlighted
Frequent Contributor

Re: DPC3939B traffic to 224.0.0.1

Hello Rich, thanks for taking this on.

 

all wifi on the gateway is off, private and public.

I do provide Wifi but is provided from another router thru an assigned a public ip.

the traffic I am concerned comes from the cisco gateway, one way, I see no reason for this traffic

0 Kudos
Highlighted
Frequent Contributor

Re: DPC3939B traffic to 224.0.0.1

Rich I turned off wifi on that second router and the trafic coming from the gateway is still coming to 224.0.0.1. something else is keeping it going but I do not see the source.

View solution in original post

Highlighted
Trusted Forum Contributor

Re: DPC3939B traffic to 224.0.0.1

What you are seeing is the Cisco gateway attempting to participate in the "Internet Group Management Protocol (IGMP. See wikipedia http://en.wikipedia.org/wiki/Internet_Group_Management_Protocol )

 

I see the same thing. Here is a packet trace:

 

[root@pLAN9-Server2 /]# tcpdump -pni external ip dst 224.0.0.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on external, link-type EN10MB (Ethernet), capture size 262144 bytes
13:04:47.163084 IP 10.1.10.1 > 224.0.0.1: ICMP router advertisement lifetime 22:30 1: {10.1.10.1 0}, length 16
13:04:47.164068 IP 10.1.10.1 > 224.0.0.1: ICMP router advertisement lifetime 22:30 1: {50.252.78.6 0}, length 16
13:05:55.390668 IP 10.1.10.1 > 224.0.0.1: igmp query v3
13:05:55.394290 IP 50.252.78.6 > 224.0.0.1: igmp query v3

As far as I can tell, there is no way to disable it. It doesn't really hurt anything or cause trouble, but if you are running your own routers, they will likely not be responding to these requests, and so the Cisco just keeps spewing these requests out out.

Highlighted
Frequent Contributor

Re: DPC3939B traffic to 224.0.0.1

Thanks train_wreck for taking this on.

 

The server firewall is dropping that traffic but is filling up the logs, the second router has a way to turn of IGMP and is off.

The cisco probably has a way to turn it off too, but is not user configurable, perhaps Comcast_Jon or Comcast_Jacob can check/confirm the IGMP setting and turn off if requested, I am hereby requesting it.

 

http://en.wikipedia.org/wiki/IGMP_snooping

 

http://en.wikipedia.org/wiki/Multicast_Listener_Discovery

 

http://www.networksorcery.com/enp/protocol/igmp.htm

 

thanks in advance @support