1

My Ubuntu keeps sending out IGMP Query requests for following IPs: 239.255.255.255.253, 224.1.1.7 and 234.55.66.77. I figured this out from Wireshark. As per IGMP spec, I believe query requests are sent only by routers. So,

  1. Why is my machine sending these packets (i.e. behaving like a router)?
  2. Which process sends these packets? I checked there is no mrouted or XORP or Quagga installed.
Manish
  • 111
  • 1
  • 4
  • Are those addresses in same subnet as your machine or public ip? Or belong to any websites your visiting? It looks like its not a router protocol but rather a wan multicast protocol. http://en.wikipedia.org/wiki/Internet_Group_Management_Protocol – Robert Sep 25 '12 at 23:12

1 Answers1

2

I would suggest you monitor the netstat to find out the 'culprit':

watch 'netstat -natp | grep 234.55.66.77'

There are some things you can check:

  1. IGMP snooping feature is enabled:

    cat /sys/class/net/br0/bridge/multicast_snooping
  2. you're using corosync in multicast mode
quanta
  • 50,327
  • 19
  • 152
  • 213
  • 2. I couldn't find corosync installed in my machine. – Manish Sep 21 '12 at 15:46
  • How about `netstat` and `multicast_snooping`? – quanta Sep 21 '12 at 15:47
  • Wanted to edit above comment to below but had 5 mins restriction. watch didn't return anything. Moreover, -t gives only tcp connections right? IGMP info may not come in this command. 1. AFAIK, IGMP snooping is only supposed to listen packets and not send them 2. I couldn't find corosync installed in my machine. (dpkg -l | grep corosync returned nothing) – Manish Sep 21 '12 at 15:58
  • 1
    multi_cast snooping is enabled. – Manish Sep 21 '12 at 15:59
  • `ps -ef | grep corosync`? Disable `multicast_snooping` to see if this problem go away. – quanta Sep 21 '12 at 16:00
  • No corosync processes running. Surprisingly, the problem seems to have vanished now. It is not sending query messages. Thanks a lot for your help. – Manish Sep 21 '12 at 16:04