Multicast traffic from 212.69.63.51

dmgeurts · Apr 13, 2011, 13:24:05

Apr 13 11:51:12 WAN 212.69.63.51 224.0.0.13 PIM
Apr 13 11:51:18 WAN 212.69.63.51 224.0.0.1 IGMP

My firewall is blocking this traffic, what is it and why is IDnet trying to send Multicast traffic to me?

I've seen things about BBC's Multicast service and IDnet supporting it. Is there any benefit to enabling Multicast on my side when using BBC iPlayer for example?

pctech · Apr 13, 2011, 13:35:02

Are you viewing any online video content at present?

dmgeurts · Apr 13, 2011, 14:14:14

Does youtube count? Not BBC's iPlayer afaik.

pctech · Apr 13, 2011, 14:52:20

I don't think Youtube multicasts but will fire up wireshark when I get home and have a look.

dmgeurts · Apr 13, 2011, 15:05:03

I use a pfsense firewall and the blocked packets are never ending for pim and igmp... from that IP address.

Glenn · Apr 13, 2011, 15:29:05

Give support a call, someone there should be able to tell you why you are receiving the multicast traffic.

Is the BBC Multicast trial still active?

dmgeurts · Apr 13, 2011, 15:34:38

Thanks.

However I'm pottering around sorting out my new connectivity etc while on numerous conf calls and other real work stuff. Don't have the time right now to be calling support at the moment, was hoping someone here might know.

Glenn · Apr 13, 2011, 15:41:56

I'm sure there will be a some people along shortly that may know.

Steve · Apr 13, 2011, 16:35:36

I think your going to have to direct that question to support.

Ray · Apr 13, 2011, 16:46:13

dmgeurts · Apr 13, 2011, 16:47:59

Well I've just called support and the guy dismissed it as just random traffic that may be floating around... He then continued that it may be responses to my DNS queries. Clearly I was being fobbed off with gumpf.

- Simple client DNS queries do not use multicast at all
- My firewall is not configured for multicast and as such drops all such traffic in or out (running packet capture just to be sure)
- He denied IDnet having anything when I mentioned Google searches turning up references to "a BBC Multicast service"

So it seems the mystery deepens... you may have guessed, I don't like being being told to not worry about it w/o some proper explanation.

dmgeurts · Apr 13, 2011, 16:49:25

Thank you for all the welcome messages!

I've moved over from Be* and I love the IRC channel they have there, always great to receive quick answers.

dmgeurts · Apr 13, 2011, 17:03:27

Packet captures show no out bound Multicast. They did tell me what kind of Multicast packets I receive from IDnet.

The PIM packets are sent every 30 seconds: PIMv2 Hello
The IGMP packets are sent every 60 seconds: V2 Membership Query, general

Steve · Apr 13, 2011, 17:18:46

Are we any the wiser though? I'm not.

dmgeurts · Apr 13, 2011, 17:23:07

Neither am I and I'm not holding my breath waiting for an answer to my email to support either $:-\$

Steve · Apr 13, 2011, 17:26:40

Are we just seeing an IGMP enabled router(IDNet) but no actual multicast service.

dmgeurts · Apr 13, 2011, 17:31:46

I'm currently figuring out how to get pfSense to proxy Multicast traffic so I can query the machine

If I can join I might be able to see what groups it has on offer. IGMPv1 though so not expecting anything.

Steve · Apr 13, 2011, 17:34:04

Not that I know anything but can you ask to "leave" or does that have to be done by the IDNet router?

Simon_idnet · Apr 13, 2011, 17:34:15

That's just Multicast adjacency traffic and can be safely ignored. Applications such as Virgin Radio would use it and the BBC were using Multicast but I think they've stopped now as they're concentrating on iPlayer.

dmgeurts · Apr 13, 2011, 17:50:11

Simon_idnet,

That's nice to know, thank you. Why though is it still enabled on the CPE side if it's currently not used?

* dmgeurts goes to figure out how to drop these messages from pfsense's logging...

Simon_idnet · Apr 13, 2011, 17:57:27

There are other uses (e.g. Virgin Radio) and it doesn't hurt anything to leave it there as a service for any customers who want to use it.

dmgeurts · Apr 13, 2011, 18:01:58

Is there documentation on this and how to make use of it?

Technical Ben · Apr 13, 2011, 18:57:56

No doubt it's one of those services and systems that needs a huge outlay just to buy the documentation!

Steve · Apr 13, 2011, 19:12:57

Virgin mulitcast seems to be now Absolute radio http://www.multicast.org.uk/absoluteradio/

http://www.bbc.co.uk/multicast/radio/

pctech · Apr 13, 2011, 19:18:52

Multicast is used mainly for broadcast traffic that does not require acknowledgement and is designed to reduce network load by allowing the router to replicate the packets so only one upstream connection is made for bandwidth heavy traffic.

Unless you want to broadcast something you would not normally need to think about multicast.