[unisog] UPNP Multicast Traffic
jtk at northwestern.edu
Thu Nov 13 03:42:44 GMT 2003
On Wed, 12 Nov 2003 15:38:57 -0700
Lois Lehman <LOIS.LEHMAN at asu.edu> wrote:
> We just started seeing this UPNP scanning from inside our campus and
> from outside destined for the multicast address, 126.96.36.199.
> Does anyone know why this would be happening?
Are you sure its someone scanning? This looks like the noisy Windows XP
universal Plug-n-play stuff. If you're seeing it from the outside, its
probably just that people are not scoping their multicast properly.
239/8 is administratively scoped and should generally be filtered from
the public multicast-enabled Internet. You should also scope 239/8
stuff from entering your network from the outside.
More information about the unisog