«

Why is Indexing Service filter daemon wishing to access the internet /
network and who or what is at ff.ff.ff.ff.ff.ff


Parent Process :
C:\WINDOWS\system32\cisvc.exe
Parent Version : 5.1.2600.2180
Parent Description : Content Index service
Parent Process ID : 0x9C (Heximal) 156 (Decimal)


File Version : 5.1.2600.0
File Description : Indexing Service filter daemon (cidaemon.exe)
File Path : C:\WINDOWS\system32\cidaemon.exe
Process ID : 0x994 (Heximal) 2452 (Decimal)

Connection origin : local initiated
Protocol : Raw Ethernet
Local Address : 0.0.0.0
Local Port : 0
Remote Name :
Remote Address : 0.0.0.0
Remote Port : 0

Ethernet packet details:
Ethernet II (Packet Length: 56)
Destination: ff-ff-ff-ff-ff-ff
Source: 00-26-54-10-da-49
Type: ARP (0x0806)
Address Resolution Protocol (ARP)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: Request
Sender hardware address: 00-26-54-10-da-49
Sender IP address: 192.168.0.2
Target hardware address: 00-00-00-00-00-00
Target IP address: 192.168.0.3

Binary dump of the packet:
0000: FF FF FF FF FF FF 00 26 : 54 10 DA 49 08 06 00 01 |
........&T..I....
0010: 08 00 06 04 00 01 00 26 : 54 10 DA 49 C0 A8 00 02 |
........&T..I....
0020: 00 00 00 00 00 00 C0 A8 : 00 03 F3 5F 60 D4 A0 10 |
............_`...
0030: FF FF E6 5F 00 00 01 01 : | ..._....
Parent Process :
--
Zaax
http://www.ukgatsos.com

zaax wrote:

> Why is Indexing Service filter daemon wishing to access the internet /
> network and who or what is at ff.ff.ff.ff.ff.ff

The file itself is a valid windows file intended on making file searching
faster.
However, some viruses have found ways to utilize it.
You may want to scan your machine for a virus.

On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:

|> Why is Indexing Service filter daemon wishing to access the internet /
|> network and who or what is at ff.ff.ff.ff.ff.ff

|> Sender hardware address: 00-26-54-10-da-49
|> Sender IP address: 192.168.0.2
|> Target hardware address: 00-00-00-00-00-00
|> Target IP address: 192.168.0.3

You got two computers set-up here?


--

In article <>,
writes
>On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:
>
>|> Why is Indexing Service filter daemon wishing to access the internet /
>|> network and who or what is at ff.ff.ff.ff.ff.ff
>
>|> Sender hardware address: 00-26-54-10-da-49
>|> Sender IP address: 192.168.0.2
>|> Target hardware address: 00-00-00-00-00-00
>|> Target IP address: 192.168.0.3
>
>You got two computers set-up here?
Yes on a network via a Router. That's a thing.
Why is it trying to access another computer on the net work.
BTW Norton says it's not virus infected.
--
Zaax
http://www.ukgatsos.com

On Thu, 9 Dec 2004 19:35:20 +0000, zaax <> wrote:

|> In article <>,
|> writes
|> >On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:
|> >
|> >|> Why is Indexing Service filter daemon wishing to access the internet /
|> >|> network and who or what is at ff.ff.ff.ff.ff.ff
|> >
|> >|> Sender hardware address: 00-26-54-10-da-49
|> >|> Sender IP address: 192.168.0.2
|> >|> Target hardware address: 00-00-00-00-00-00
|> >|> Target IP address: 192.168.0.3
|> >
|> >You got two computers set-up here?
|> Yes on a network via a Router. That's a thing.
|> Why is it trying to access another computer on the net work.

Right off hand I'd say it's index'g with the other. Maybe you have it
set up to SYNC with it, or you've got FAST FIND enable'd.


|> http://www.ukgatsos.com

Nice public service by the way.


--

gotta go with penny on this one:
the ff´s are a broadcast address so if it's broadcasting on the lan side ,
it's prolly a fast find thing in this case. lil help on the opsys, but i'm
guessing 2k or xp, so just get into services and tweak that sucka. ergo:
admin tools->services->indexing service-> and then stop, disable, or set to
manual on the general tab.

o and i ain't sure what internet slash network is supposed to mean, but if
it means that the broadcasts are showing up at the router, it could be cause
your arp cache aint resolving the 2nd target hw address (hence the 12
"0's").
arp "who-has" packets are vital to the proper functioning of a local
area network--it's how each host finds the MAC address associated with
each IP on the network.
I've seen some viruses lately trying to forge their ip/mask, maybe this
is the cause, so make sure you're clean,and then
disabling the service should put ya back in the land of mu...


--
Bob Shivers, MCSE
Boligens Bredbånd Installation (BBI)
A Division Of
Shivers Systems Security Corp. (3SC)
Telefon / Fax : 35 39 35 45
Mobile : 26 53 27 07
CVR Nr. : 2708 4273
www.bbi.3sc.dk/pr01.htm

<> wrote in message
news:...
> On Thu, 9 Dec 2004 19:35:20 +0000, zaax <> wrote:
>
> |> In article <>,
> |> writes
> |> >On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:
> |> >
> |> >|> Why is Indexing Service filter daemon wishing to access the
internet /
> |> >|> network and who or what is at ff.ff.ff.ff.ff.ff
> |> >
> |> >|> Sender hardware address: 00-26-54-10-da-49
> |> >|> Sender IP address: 192.168.0.2
> |> >|> Target hardware address: 00-00-00-00-00-00
> |> >|> Target IP address: 192.168.0.3
> |> >
> |> >You got two computers set-up here?
> |> Yes on a network via a Router. That's a thing.
> |> Why is it trying to access another computer on the net work.
>
> Right off hand I'd say it's index'g with the other. Maybe you have it
> set up to SYNC with it, or you've got FAST FIND enable'd.
>
>
> |> http://www.ukgatsos.com
>
> Nice public service by the way.
>
>
> --