I have been trying to disable this functionality for quite some time, but cannot seem to figure it out.
Within a 1 minute interval several packet sniffer tools report constant traffic from all-systems.mcast.net with a set size of 14 bytes.
ubuntu@ubuntu:~$ netstat -g
IPv6/IPv4 Group Assignments
interface RefZäh Group
--------------- ------ ---------------------
lo 1 all-systems.mcast.net
eth0 1 all-systems.mcast.net
lo 1 ip6-allnodes
lo 1 ff01::1
eth0 1 ff02::1:ff84:d990
eth0 1 ip6-allnodes
eth0 1 ff01::1
It's designated IP is 224.0.0.1
ubuntu@ubuntu:~$ netstat -ng
IPv6/IPv4 Group Assignments
interface RefZäh Group
--------------- ------ ---------------------
lo 1 224.0.0.1
eth0 1 224.0.0.1
lo 1 ff02::1
lo 1 ff01::1
eth0 1 ff02::1:ff84:d990
eth0 1 ff02::1
eth0 1 ff01::1
I have already managed to stop other multicast packets, namely traffic from 224.0.0.251, using this:
sudo ifconfig eth0 -multicast
However, this has not stopped the all-systems.mcast.net traffic.
I have also unsuccessfully tried iptables, inspired by a website regarding the opposite of what I am trying to do:
sudo iptables -A INPUT -s 224.0.0.0/4 -j REJECT
sudo iptables -A INPUT -d 224.0.0.0/4 -j REJECT
sudo iptables -A INPUT -s 240.0.0.0/5 -j REJECT
sudo iptables -A INPUT -m pkttype --pkt-type multicast -j REJECT
sudo iptables -A INPUT -m pkttype --pkt-type broadcast -j REJECT
Does anyone know how to stop this 224.0.0.1 / all-systems.mcast.net traffic?
1 Answer
Step 1. Record all traffic with a screenshot/video for one hour
step 2. Shutdown NIC, Router or Modem. (disable internet line temporary)
Step 3. Analyze footage, log all IP addresses.
Step 4. Verify YOUR IP's
Step 5. Use an IP Whitelist or another type of filter to block invalid IP addresses.(document which IP's)
Step 6. Reboot all systems.(computer, router, modem)
Step 7. Test it
Hope this helps :)
