Re: How do I chase down who is doing a multicast?

ToddAndMargo <[email protected]> Fri, 6 Apr 2018 18:00:12 -0700
Newsgroups gmane.comp.security.nmap.devel
Message-ID <[email protected]>
On 04/06/2018 04:25 PM, ToddAndMargo wrote:
> On 04/06/2018 04:23 PM, ToddAndMargo wrote:
>> Hi All,
>>
>> How do I use namp to chase down who is doing a multicast
>> (224.0.0.252) on my local network.
>>
>> My Windows Security log is gobsmacked with the following:
>>
>> Network Information:
>>      Direction:        Inbound
>>      Source Address:        224.0.0.252
>>      Source Port:        5355
>>      Destination Address:    192.168.202.215
>>      Destination Port:        52860
>>      Protocol:        17
>>
>> This gets me no where:
>>
>> # nmap -A -T4 -Pn 224.0.0.252
>>
>> Starting Nmap 7.60 ( https://nmap.org ) at 2018-04-06 16:22 PDT
>> Nmap done: 1 IP address (0 hosts up) scanned in 0.85 seconds
>>
>>
>> Many thanks,
>> -T
> 
> My firewall shows no traffic outbound to 224.0.0.252

Follow up:

It transpires that this was being caused by Windows
clients running the default Link-Local_Multicast_Name_
Resolution (LLMNR).  The vclue was port 5355.

So basically, EVERYONE was running it.  Fortunately,
LLMNR is not routable.

I turned LLMNR off on all the clients.  Let me know if
you want me notes on how to do this.

I would still love to know if there is a way to trace
back a particular offender.

-T

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/