From owner-freebsd-questions  Tue Jul 10 13:10:32 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from blueyonder.co.uk (pcow029o.blueyonder.co.uk [195.188.53.123])
	by hub.freebsd.org (Postfix) with ESMTP id DABB137B401
	for <questions@freebsd.org>; Tue, 10 Jul 2001 13:10:28 -0700 (PDT)
	(envelope-from jfm@blueyonder.co.uk)
Received: from lexx.my.domain ([62.31.194.122]) by blueyonder.co.uk  with Microsoft SMTPSVC(5.5.1877.687.68);
	 Tue, 10 Jul 2001 21:10:23 +0100
From: John Murphy <jfm@blueyonder.co.uk>
To: Arcady Genkin <a.genkin@utoronto.ca>
Cc: questions@FreeBSD.ORG
Subject: Re: IPF questions
Date: Tue, 10 Jul 2001 21:10:44 +0100
Organization: poor
Reply-To: jfm@blueyonder.co.uk
Message-ID: <2tlmktktbevo5ibr7t5n1t7tgc60rbscp3@4ax.com>
References: <87g0c5p56j.fsf@tea.thpoon.com> <3B4B4089.412E1D3@activemessage.com> <r1z66d0zmap.fsf@gnu.cdf.toronto.edu>
In-Reply-To: <r1z66d0zmap.fsf@gnu.cdf.toronto.edu>
X-Mailer: Forte Agent 1.8/32.548
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Arcady Genkin <a.genkin@utoronto.ca> wrote:

>
>Michael Loftis <mike@activemessage.com> writes:
>
>> Arcady Genkin wrote:
>> >=20
>> > I have three questions about my IPF setup.
>> >=20
>> > ,----[ ipf.log ]
>> > | 10/07/2001 03:20:48.425070 ed0 @0:35 b 24.43.35.1 -> \
>> > |                                       224.0.0.1 PR igmp len 24 =
(32) IN
>>=20
>> Originator: 24.43.35.1 -- most probably a router.
>> Destination: 224.0.0.1 Class D Multicast
>> PR I asume means PRotocol to follow....
>> igmp -- Internet Group Multicast Protocol or something similar
>> payload 24 octets, total 32 octets, INput.
>
>Michael, thanks for your reply.
>
>So, do I want to be blocking those packets?  I ges I do, since
>224.0.0.1 has nothing to do with my IP address.
>
>I wonder how those packets find their way to me, anyways...  I've
>dropped close to a thousand in ten hours.  My external subnet is
>24.42.106.0/24.

I block similar packets from my cable modem to 224.0.0.1 but the source
address is RFC1918.  I've no idea what yours are coming from.

You can stop logging them of course with a specific block in quick rule:
block in quick proto igmp on ed0 from 24.43.35.1/32 to 224.0.0.1/32

John.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message