On Wed, Apr 17, 2002 at 12:15:22PM +0200, David Gardi wrote: > Hi to all, > I have recently changed dialup ISP, and since then tcpdump is reporting > strange packets going to a variety of 224.0.0.0/4 addresses from > apparently the dialup node I'm connect to. Here are a two examples: > > tcpdump: listening on ppp0 > 00:48:43.928630 195.130.232.243 > 224.0.0.1: igmp query v2 [tos 0xc0] > [ttl 1] > 00:48:44.958630 195.130.232.243 > 224.0.0.13: pim v2 Hello (Hold-time > 1m45s) (OLD-DR-Priority: 1) (State Refresh Capable ?0x1000000?) [tos > 0xc0] [ttl 1]
I have had the same problem. Maybe that are multicasts used by rouer to exchange information. You shoud not see this and be able to "take over" the router ;-) In short call the Provider to configure his router correct!!! > I have tried to DROP such packets by telling the kernel using iptables: > Here is the listing: > > Chain INPUT (policy ACCEPT) > target prot opt source destination > DROP all -- Fe0-0-0.NAS-FI-1.net.tiscali.it BASE-ADDRESS.MCAST.NET/4 > > but of course this didn't work. > somebody told me the ppp-timecounter is reseted before iptables see the packages so !maybe! you should use an other kernelfeature (2.4) works with pppd to filter packages. I am sorry i can't find the feature yet but i think in a new pppd man-page there is a hint. > > Thanks, > David. > HTH Andreas Grabner -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
