Re: What does "ICMP to 224.0.0.2" mean?

On 02 Nov 2004, stephen wrote:

> "Mozzy" <> wrote in message
> news:958FE34FC12F351A7E@62.253.162.201...
>> Soon after booting my system and then re-connecting the cable
>> modem lead to the PC (as it had unplugged itself) I got this
>> message from my Sygate firewall
>>
>> "Windows Explorer (explorer.exe) is trying to broadcast an ICMP
>> Type 10 (Router Solicitation) packet to [224.0.0.2]. Do you
>> want to allow this program to access the network?"
>
> icmp is the family of IP protocols that do network maintenance.
>
> The destination address is a local IP multicast - it should
> never be forwarded by a router.
>
> cant remeber which one it is but it is either "all routers" or
> "all hosts" destination - these are used for setup and group
> handling.
>
> the PC is either looking for a service or trying to register a
> multicast address with a local multicast fowarder.
>
> ICMP router solicitation is the PC trying to find a local
> default gateway - maybe you havent configured that on your LAN
> NIC card?

Can someone explain exactly where this is configured or where it is
"unconfigured".

Thanks !

>
> either way it doesnt seem like something a firewall should worry
> about if you are set up to "trust" your local LAN.
>>
>> The IP address does not seem to resolve to ayone in particular.
>> I get some sort of info about "multicast".
>>
>> I am a single home PC attached to the Net. Should I allow this
>> sort of thing through?
> --

Mozzy

Mozzy wrote:

> On 02 Nov 2004, stephen wrote:
>
>> "Mozzy" <> wrote in message
>> news:958FE34FC12F351A7E@62.253.162.201...
>>> Soon after booting my system and then re-connecting the cable
>>> modem lead to the PC (as it had unplugged itself) I got this
>>> message from my Sygate firewall
>>>
>>> "Windows Explorer (explorer.exe) is trying to broadcast an ICMP
>>> Type 10 (Router Solicitation) packet to [224.0.0.2]. Do you
>>> want to allow this program to access the network?"
>>
>> icmp is the family of IP protocols that do network maintenance.
>>
>> The destination address is a local IP multicast - it should
>> never be forwarded by a router.
>>
>> cant remeber which one it is but it is either "all routers" or
>> "all hosts" destination - these are used for setup and group
>> handling.
>>
>> the PC is either looking for a service or trying to register a
>> multicast address with a local multicast fowarder.
>>
>> ICMP router solicitation is the PC trying to find a local
>> default gateway - maybe you havent configured that on your LAN
>> NIC card?
>
> Can someone explain exactly where this is configured or where it is
> "unconfigured".
>
> Thanks !
>
>>
>> either way it doesnt seem like something a firewall should worry
>> about if you are set up to "trust" your local LAN.
>>>
>>> The IP address does not seem to resolve to ayone in particular.
>>> I get some sort of info about "multicast".
>>>
>>> I am a single home PC attached to the Net. Should I allow this
>>> sort of thing through?
>> --


The 224.0.0.2 is multicast to All routers on the subnet.. All is as follows:

224.0.0.1 -all systems
224.0.0.2 -All routers on subnet
224.0.0.5 -OSPF routers
224.0.0.6 -OSPF designated routers?
224.0.0.12-DHCP server or relay

the default gateway is setup in yer nic card ip properties. since you are
on a cable modem network, is the ip you have been assigning yer NIC a
public or private ip? I take it the firewall is a 'software firewall'
installed on your local computer?

k

On Fri, 10 Dec 2004 19:36:21 GMT, Mozzy <> wrote:

>On 02 Nov 2004, stephen wrote:
>
>> "Mozzy" <> wrote in message
>> news:958FE34FC12F351A7E@62.253.162.201...
>>> Soon after booting my system and then re-connecting the cable
>>> modem lead to the PC (as it had unplugged itself) I got this
>>> message from my Sygate firewall
>>>
>>> "Windows Explorer (explorer.exe) is trying to broadcast an ICMP
>>> Type 10 (Router Solicitation) packet to [224.0.0.2]. Do you
>>> want to allow this program to access the network?"
>>
>> icmp is the family of IP protocols that do network maintenance.
>>
>> The destination address is a local IP multicast - it should
>> never be forwarded by a router.
>>
>> cant remeber which one it is but it is either "all routers" or
>> "all hosts" destination - these are used for setup and group
>> handling.
>>
>> the PC is either looking for a service or trying to register a
>> multicast address with a local multicast fowarder.
>>
>> ICMP router solicitation is the PC trying to find a local
>> default gateway - maybe you havent configured that on your LAN
>> NIC card?
>
>Can someone explain exactly where this is configured or where it is
>"unconfigured".
>
>Thanks !

In my case seeing this traffic had to do with the pc having a static
ip-number, and the modem/router the setting 'Auto DHCP' or 'DHCP
Server' at ON.

As I don't need DHCP, I switcht it OFF, and never seen that traffic
anymore, but the traffic is mot harmfull.

>> either way it doesnt seem like something a firewall should worry
>> about if you are set up to "trust" your local LAN.
>>>
>>> The IP address does not seem to resolve to ayone in particular.
>>> I get some sort of info about "multicast".
>>>
>>> I am a single home PC attached to the Net. Should I allow this
>>> sort of thing through?

Manuel

Manuel Otto

Mozzy wrote:
>
> Can someone explain exactly where this is configured or where it is
> "unconfigured".
>
> Thanks !


WHAT VERSION OF WINDOZE ARE YOU USING?

T. Sean Weintz

Mozzy wrote:

> On 02 Nov 2004, stephen wrote:
>
>> "Mozzy" <> wrote in message
>> news:958FE34FC12F351A7E@62.253.162.201...
>>> Soon after booting my system and then re-connecting the cable
>>> modem lead to the PC (as it had unplugged itself) I got this
>>> message from my Sygate firewall
>>>
>>> "Windows Explorer (explorer.exe) is trying to broadcast an ICMP
>>> Type 10 (Router Solicitation) packet to [224.0.0.2]. Do you
>>> want to allow this program to access the network?"
>>
>> icmp is the family of IP protocols that do network maintenance.
>>
>> The destination address is a local IP multicast - it should
>> never be forwarded by a router.
>>
>> cant remeber which one it is but it is either "all routers" or
>> "all hosts" destination - these are used for setup and group
>> handling.
>>
>> the PC is either looking for a service or trying to register a
>> multicast address with a local multicast fowarder.
>>
>> ICMP router solicitation is the PC trying to find a local
>> default gateway - maybe you havent configured that on your LAN
>> NIC card?
>
> Can someone explain exactly where this is configured or where it is
> "unconfigured".
>
> Thanks !
>
>>
>> either way it doesnt seem like something a firewall should worry
>> about if you are set up to "trust" your local LAN.
>>>
>>> The IP address does not seem to resolve to ayone in particular.
>>> I get some sort of info about "multicast".
>>>
>>> I am a single home PC attached to the Net. Should I allow this
>>> sort of thing through?
>> --


Of coarse you do not IP routing enabled right?

Michael J. Pelletier

On 10 Dec 2004, T. Sean Weintz wrote:

> Mozzy wrote:
>>
>> Can someone explain exactly where this is configured or where
>> it is "unconfigured".
>>
>> Thanks !
>
>
> WHAT VERSION OF WINDOZE ARE YOU USING?


I am using XP Pro.

I have got all essential microsoft patches applied as well as SP1
(but not SP2).

Does that help you to explain where I can set or unset "ICMP router
solicitation"?

Mozzy

I am Mozzy, the original poster for this thread. I have tried up the
quoting on this post so it reads better.


>>> "Mozzy" <> wrote in message
>>>>
>>>> Soon after booting my system and then re-connecting the cable
>>>> modem lead to the PC (as it had unplugged itself) I got this
>>>> message from my Sygate firewall
>>>>
>>>> "Windows Explorer (explorer.exe) is trying to broadcast an
>>>> ICMP Type 10 (Router Solicitation) packet to [224.0.0.2].
>>>> Do you want to allow this program to access the network?"


>> On 02 Nov 2004, stephen wrote:
>>>
>>> icmp is the family of IP protocols that do network
>>> maintenance.
>>>
>>> The destination address is a local IP multicast - it should
>>> never be forwarded by a router.
>>>
>>> cant remeber which one it is but it is either "all routers" or
>>> "all hosts" destination - these are used for setup and group
>>> handling.
>>>
>>> the PC is either looking for a service or trying to register a
>>> multicast address with a local multicast fowarder.
>>>
>>> ICMP router solicitation is the PC trying to find a local
>>> default gateway - maybe you havent configured that on your LAN
>>> NIC card?


> Mozzy wrote:
>>
>> Can someone explain exactly where this is configured or where
>> it is "unconfigured".
>>
>> Thanks !


>>> either way it doesnt seem like something a firewall should
>>> worry about if you are set up to "trust" your local LAN.

>>> "Mozzy" <> wrote in message
>
>>>> The IP address does not seem to resolve to ayone in
>>>> particular. I get some sort of info about "multicast".
>>>>
>>>> I am a single home PC attached to the Net. Should I allow
>>>> this sort of thing through?



On 10 Dec 2004, k wrote:
>
> The 224.0.0.2 is multicast to All routers on the subnet.. All is
> as follows:
>
> 224.0.0.1 -all systems
> 224.0.0.2 -All routers on subnet
> 224.0.0.5 -OSPF routers
> 224.0.0.6 -OSPF designated routers?
> 224.0.0.12-DHCP server or relay
>
> the default gateway is setup in yer nic card ip properties.
> since you are on a cable modem network, is the ip you have been
> assigning yer NIC a public or private ip?

Hmmm, I do not know what your question means. if I use a utility
like IP2 from http://keir.net then I get two different IP addresses:

LAN IP=81.105.206.69
WAN IP=62.255.64.6 (popl-cache-3.server.ntli.net)


> I take it the firewall
> is a 'software firewall' installed on your local computer?

Yes it is. I am using Sygate Personal Firewall.

Mozzy