[unisog] UPNP Multicast Traffic

John Kristoff jtk at northwestern.edu
Thu Nov 13 03:42:44 GMT 2003

On Wed, 12 Nov 2003 15:38:57 -0700
Lois Lehman <LOIS.LEHMAN at asu.edu> wrote:

> We just started seeing this UPNP scanning from inside our campus and
> from outside destined for the multicast address, 
> Does anyone know why this would be happening?

Are you sure its someone scanning?  This looks like the noisy Windows XP
universal Plug-n-play stuff.  If you're seeing it from the outside, its
probably just that people are not scoping their multicast properly. 
239/8 is administratively scoped and should generally be filtered from
the public multicast-enabled Internet.  You should also scope 239/8
stuff from entering your network from the outside.


More information about the unisog mailing list