Subject: Multicast catching too much?
To: None <email@example.com>
From: Michael Graff <firstname.lastname@example.org>
Date: 11/20/1994 04:02:38
I noticed that a NetBSD machine on an ethernet with a lot of traffic
seems to really catch a lot of multicast packets. Is it perhaps
catching too much?
They are coming in at about 50-100 per second, and are mostly DECnet,
LAT, etc. to addresses I should be caring about:
03:56:33.929310 aa:0:4:0:d0:fc ab:0:0:3:0:0 decnet 46:
03:56:34.488367 aa:0:4:0:23:fc 9:0:2b:0:0:f lat 84:
03:56:34.468974 aa:0:4:0:25:fc ab:0:4:1:78:0 6007 114:
03:57:25.094407 8:0:2b:39:f7:f1 ab:0:0:2:0:0 moprc 46:
I know nothing about these protocols, but is it possible that someone
can listen (the interface was in nonpromiscious mode when I sampled
the ethernet) in on others' traffic? If so, then there has to be some
sort of filtering done at a higher level than what is is now. I can
imagine DEC protocols to be chatty and brag that they exist a lot, but
I don't believe there is all that much DECnet trafic on this subnet...
Michael Graff <email@example.com> NetBSD is the way to go!
PGP key on a key-server near you! Rayshade the world!