-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chance Whaley wrote:
Sorry about that. Didn't look in detail. Saw the UDP port 6257 and
stopped.The mcast is coming from someplace upstream from
fastethernet-0-0.genoa-gw.amplex.net (that is if I did my mcast
MAC to mcast IP conversion right). Without knowing your topology
and seeing more traffic it's kinda hard to figure out.If you want to send more traffic captures I will be happy to look
at them..chance
The destination mac address the routers start using is
01:00:5e:76:6c:7e. The 01:00:5e is the ethernet multicast header.
The 76:6c:7e is supposed to be the lower 23 bits of the Ethernet
multicast address - which translates to 118.108.126. With the 23
bits from the multicast spec for encoding the IP address 118 is the
correct conversion of 246 with the high bit stripped off.
The gateway on this subnet is 64.246.108.126 (netmask is 255.255.255.0
but originally was .128 - hence the odd spot for the gateway).
The routers decided to convert a mangled unicast packet to a multicast
packet - for them to then loop on it is even stranger. It makes for a
pretty good DOS attack. 2 or more of these routers in a broadcast
domain can get ugly in a hurry.
Mark