224.0.0.13 Pim-routers.mcast.net.

perfect_circle · 04-25-2005, 08:09 AM

Does anybody know What this is?
I'm getting snort alerts every 30 seconds:
BAD-TRAFFIC IP Proto 103 PIM, from packets our router sends to this address. I think it's a special perpose address but I cannont figer out what it is. Is this a local reserved address like 127.0.0.1,0.0.0.0 or 192.164.x.x ?

Can somebody tell me what is going on?

okmyx · 04-25-2005, 08:25 AM

Found these links that refer to Multicast-addresses (224.0.0.0 range), 224.0.0.13 is assigned to 'All PIM Routers' so i'm guessing its some kind of heart beat ip packet.

http://www.iana.org/assignments/multicast-addresses

http://www.tldp.org/HOWTO/Multicast-HOWTO-2.html

perfect_circle · 04-25-2005, 09:04 AM

I had already read the first link but you know how the RFC's are. They don't help a lot to understand what's exactly going on.
The second link from the Linux Documentation Project is really cool.
Thanks a lot.

perfect_circle · 04-25-2005, 09:06 AM

I guess i need to create a new rule, to make snort not alert for this pair of source-destination.