B.I.S.S. Forums > what do you all make of this ?

Full Version: what do you all make of this ?

B.I.S.S. Forums > Internet Security Forum > Internet Security Discussion

Angelus

Dec 30 2007, 08:18 PM

hi all

i been watching protowall recently and i noticed something, its been blocking packets being sent to these places and iam not sure what or why something is sending packets there

QUOTE

Packet to "IANA Reserved, Bogon, IANA - Multicast" ( 239.255.255.250 ) blocked. [protocol: IGMP - src: -- / dst: --]

Packet to "IANA Reserved, Bogon, IANA - Multicast" ( 239.255.255.250 ) blocked. [protocol: UDP - src: 4115 / dst: 1900]

Packet to "IBM Corporation, IANA - Private Use [RFC1918], A..." ( 10.0.0.255 ) blocked. [protocol: UDP - src: 138 / dst: 138]

Packet to "IBM Corporation, IANA - Private Use [RFC1918], A..." ( 10.0.0.255 ) blocked. [protocol: UDP - src: 137 / dst: 137]

Packet to "IANA Reserved, Bogon, IANA - Multicast" ( 239.255.255.250 ) blocked. [protocol: UDP - src: 4169 / dst: 1900]

2007/12/30 22:27:17 [<-] BLOCKED [!] - Destination is IANA Reserved, Bogon, IANA - Multicast (224.0.0.2) [Protocol: IGMP - src: -- / dst: --]

it says "packet to" which to me means that something is trying to send packets to them.

is this something to worry about u think ?

thanks for the help

Aaron.Walkhouse

Dec 30 2007, 10:52 PM

Looks like routine housekeeping traffic between your PC and routers and your ISP.
The traffic in 10.x to ports 137 and 138 is probably another computer you
have plugged in or just your router. That traffic can't go any farther than that
because all the addresses are for short-range local traffic only.

You can just turm off the multicast and private filters if you aren't sharing your
connection with a lot of people.

alien51

Dec 31 2007, 12:11 AM

You've got cable, right? This sort of thing does not happen with ADSL. I've had similar blocks on those ranges and they were all related to how the internet by cable works to distribute IPs. I investigated this a long time ago so my memory is quite greyish but cable companies setup customers as if it were a huge "local" network. There are broadcasts to get you a new IP (which is what those packets to 239.255.255.250 are) and there are central gateways which are at 10.0.0.255 type addresses. There is not one way to do things which explains why some cable assign fixed IPs and others are dynamic.

Or something of that nature... Again, this was a long time ago and I forgot most of it, lol!

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.