[Dshield] Multicast traffic on my Linksys router

Laurent saplairoles at telus.net
Fri Jun 20 10:36:11 GMT 2003

Hello all and thank you for your replies on my question.

On 16 Jun 2003 at 9:29, David McGaughey wrote:
> Greetings!
> I have two of these BEFSR41's on two different nets.  I see the exact
> same traffic to the exact same addresses on both.  I've captured
> packets and looked at them, but can't really make an sense out of
> them.

I think I have found how to neutralize that useless UPnP multicast traffic.

On the 'password' page of the Linksys interface, there is a 'enable/disable UPnP' 
option. Setting it to disable instantly stops the chit-chat, saving you a few Kb of 
bandwidth and headaches about unidentified traffic.

However, if any of your machines uses UPnP, then you might need to let this option 
enabled. I have a relatively small network and knows pretty well what's supposed to 
navigate on it and what features I use on my computers, so I know I'm fine.

> >>> lsaplai at telus.net 06/16/03 03:17AM >>>
> Hello all
> I am turning to the Dshield common knowledge to try to shed some light
> on a problem I am meeting:
> I have noticed some traffic going on on my local network (192.168.1.x)
> that simply shouldn't be there. My network is behind a Linksys BEFSR41
> that have recently upgreaded to the latest firmware (Dec 2002).
> Basically, what I am seeing is TCP packets (HTTP1.1) going from the
> Linksys internal adapter ( to the multicast address:
> The type of packet is SSDP (I can post packets
> to the list if you want)
[snipping my original description of the situation]

Thank you again for your help and your insight.

Sacha Guitry (1895 - 1957)
Si ceux qui disent du mal de moi savaient exactement ce que je pense d'eux, ils en 
diraient bien davantage.

More information about the list mailing list