[ILUG] Why is Indigo sending me igmp packets ????

[Glen Gray]

Hi guys,

I recently moved my HAN server to a 2.4 based distro so that I could
utilize Netfilter. Updated my rules to use iptables and noticed that I
was getting DROP'd log entries ever 30 seconds or so. 

I Presumed I had setup my rules wrong and switched back to using my
ipcahins scripts. However I was still getting these DROP'd packets. I've
not really had the time or inclination to look at this for a few weeks
but last night I decided to take another look.

Seems that the dial-in server for indigo is sending me multicast
broadcasts. I don't know much about igmp data but I presume it's router
specific stuff. Why are they sending this info to me.

This is basically why my ppp connection no longer times out on idle.
It's never idle anymore. Every 30 secs or so I receive igmp data from
ts11.dublin.indigo.ie (or what ever server I've dialed into).

Is there anything I can do to stop this data coming down. I tried
accepting it in the iptables script. I no longer saw the DROP logs but
the data kept on coming. I was kind of hoping that once I'd accepted it,
it would stop. It didn't.

Here is some data from, firstl my /var/log entries, secondly my
ifcoonfig for ppp0 and finally a tcpdump -i ppp0

1)/var/log/messages

Jan 29 22:25:43 ironsauage kernel: IN=ppp0 OUT= MAC= SRC=194.125.145.98
DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 
Jan 29 22:26:43 ironsauage kernel: IN=ppp0 OUT= MAC= SRC=194.125.145.98
DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 
Jan 29 22:27:44 ironsauage kernel: IN=ppp0 OUT= MAC= SRC=194.125.145.98
DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 
Jan 29 22:28:45 ironsauage kernel: IN=ppp0 OUT= MAC= SRC=194.125.145.98
DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 

2) ifconfig ppp0
ppp0      Link encap:Point-to-Point Protocol  
          inet addr:194.125.134.36  P-t-P:194.125.145.98 
Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:32 errors:4 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:17 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:4254 (4.1 Kb)  TX bytes:1343 (1.3 Kb)


3) tcpdump -i ppp0
00:19:00.307110 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:19:13.397138 194.125.145.98 > 224.0.0.1: igmp query v2 [tos 0xc0] 
[ttl 1]
00:19:30.607118 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:20:00.957154 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:20:14.107148 194.125.145.98 > 224.0.0.1: igmp query v2 [tos 0xc0] 
[ttl 1]
00:20:31.437120 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:21:01.757123 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:21:14.917159 194.125.145.98 > 224.0.0.1: igmp query v2 [tos 0xc0] 
[ttl 1]
00:21:31.117157 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:22:01.497119 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:22:15.677161 194.125.145.98 > 224.0.0.1: igmp query v2 [tos 0xc0] 
[ttl 1]
00:22:31.867148 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]
00:23:02.257105 194.125.145.98 > 224.0.0.2: igmp pimv1 Query Sparse-mode
[tos 0xc0]  [ttl 1]

-- 
_______________________________________
Glen Gray             Software Engineer
a n t e f a c t o     t: +353 1 8586006
www.antefacto.com     f: +353 1 8586014
181 Parnell Street - Dublin 1 - Ireland