This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

packet filter rule works except for one packet

HansDampf2008 over 16 years ago

I've got a firewall rule, that drops automatically all Multicasts in my network without logging it.

It works fine, except for one of four packet. I switched on the logging to compare these packets, but I can't see any differences.

10:04:51 Packetfilter rule #12 2 192.168.100.2 → 224.0.0.1 len=36 ttl=1 tos=0x00 srcmac=00:1f:3a:41:87:18 dstmac=00:0d:89:cc:c0:09



10:04:51 Packetfilter rule #12 2 192.168.100.2 → 224.0.0.1 len=36 	ttl=1 tos=0x00 srcmac=00:1f:3a:41:87:18 dstmac=00:0d:89:cc:c0:09



10:04:51 Default DROP 	2 192.168.100.2 → 224.0.0.1 len=36 ttl=1 tos=0x00 srcmac=00:1f:3a:41:87:18 dstmac=00:0d:89:cc:c0:08



10:04:52 Packetfilter rule #12 2 192.168.100.2 → 224.0.0.1 len=36 	ttl=1 tos=0x00 srcmac=00:1f:3a:41:87:18 dstmac=00:0d:89:cc:c0:09

This happens all 2 minutes.

Regards,
Hans

This thread was automatically locked due to age.

0 BAlfson over 16 years ago

It is strange that you have packets with ttl=1.
Cancel
Vote Up 0 Vote Down

Cancel
0 HansDampf2008 over 16 years ago in reply to BAlfson

These are Multicasts, they have often a ttl = 1 :-)

Multicast - Wikipedia, the free encyclopedia
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to HansDampf2008

Thanks, Hans. I just googled "ttl=1" and found a Cisco document that suggests setting ttl to 16 for multicasts.

Now I'm curious, what packet filter rule drops multicasts?
Cancel
Vote Up 0 Vote Down

Cancel
0 HansDampf2008 over 16 years ago in reply to BAlfson

I defined a Multicast-list with all my known multicast IP addresses. So my packet-filter-rule filters (drops) everything from source-IP to 224.0.0.1.
Cancel
Vote Up 0 Vote Down

Cancel
0 atarso over 16 years ago in reply to HansDampf2008

The destination mac addresses are different...Does that help identify an avenue of cause?
Cancel
Vote Up 0 Vote Down

Cancel
0 HansDampf2008 over 16 years ago in reply to atarso

Hmmm, I defined the rule with the destination IP address, so it makes no sense...
But thanks for that hint, I did not recognize that they are different.
Cancel
Vote Up 0 Vote Down

Cancel