In message <199411201002.EAA00481@packrat.vorpal.com>, Michael Graff writes:

>I noticed that a NetBSD machine on an ethernet with a lot of traffic
>seems to really catch a lot of multicast packets.  Is it perhaps
>catching too much?
>
>They are coming in at about 50-100 per second, and are mostly DECnet,
>LAT, etc. to addresses I should be caring about:
>
>3:56:33.929310 aa:0:4:0:d0:fc ab:0:0:3:0:0 decnet 46: 

Message from DECnet node 63.208 to DECnet Level 1 and 2 routers.
Routing information or "I'm still alive" messages.

>03:56:34.488367 aa:0:4:0:23:fc 9:0:2b:0:0:f lat 84:

Message from DECnet node 63.25 to LAT-servers, announcing service
is a good guess.

>03:56:34.468974 aa:0:4:0:25:fc ab:0:4:1:78:0 6007 114:

Message from DECnet mode 63.27 to a Local Area VaxCluster.

>03:57:25.094407 8:0:2b:39:f7:f1 ab:0:0:2:0:0 moprc 46:

Seems to be a "I'm still alive" message from a terminalserver ?

>I know nothing about these protocols, but is it possible that someone
>can listen (the interface was in nonpromiscious mode when I sampled
>the ethernet) in on others' traffic?  If so, then there has to be some
>sort of filtering done at a higher level than what is is now.  I can
>imagine DEC protocols to be chatty and brag that they exist a lot, but
>I don't believe there is all that much DECnet trafic on this subnet...

The problem is DEC is heavy users of multicast, and offen their protocols
ain't routeable. If you have more than one segment with LAT traffic the
traffic must be spread to all segments using LAT. To my knowledge none
of the multicast messages contains any sencetive information. This if
you don't think DECnet routing information a big secret. The only protocol
I'm not sure about is the LAVC protocol, I've not seen a spec of the
protocol.

>Thanks,
>-Michael
>
>--
>Michael Graff <explorer@vorpal.com>       NetBSD is the way to go!
>PGP key on a key-server near you!         Rayshade the world!

-moj

------------------------------------------------------------------------------
Mats O Jansson, CelsiusTech Systems, Jaerfaella, Sweden
email: maja@celsiustech.se (or moj@stacken.kth.se)