What, or who is MCAST.NET?

[Chuck57]

Just loaded the new PCTools Firewall to try and this shows up in a long string. In 2 hours, there have been over 400 UDP requests. The address is for something called MCAST. I did a search for MCAST but nothing I found really explained it in language I could understand. Is this something I should be worried about?

Source address: 192.168.254.254

Destination address: 239.255.255.250

source port: 2616
destination port: 1900

data: 0000:4E 4F 54 49 46 59 20 2A NOTIFY *
0008:20 48 54 54 50 2F 31 2E HTTP/1.
0010:31 0D 0A 48 6F 73 74 3A 1..Host:
0018:32 33 39 2E 32 35 35 2E 239.255.
0020:32 35 35 2E 32 35 30 3A 255.250:
0028:31 39 30 30 0D 0A 43 61 1900..Ca
0030:63 68 65 2D 43 6F 6E 74 che-Cont
0038:72 6F 6C 3A 6D 61 78 2D rol:max-
0040:61 67 65 3D 31 32 30 30 age=1200
0048:0D 0A 4C 6F 63 61 74 69 ..Locati
0050:6F 6E 3A 68 74 74 70 3A on:http:
0058:2F 2F 31 39 32 2E 31 36 //192.16
0060:38 2E 32 35 34 2E 32 35 8.254.25
0068:34 3A 38 30 2F 64 65 76 4:80/dev
0070:69 63 65 64 65 73 63 2E icedesc.
0078:78 6D 6C 0D 0A 4E 54 3A xml..NT:
0080:75 72 6E 3A 73 63 68 65 urn:sche
0088:6D 61 73 2D 75 70 6E 70 mas-upnp
0090:2D 6F 72 67 3A 73 65 72 -org:ser
0098:76 69 63 65 3A 4C 41 4E vice:LAN
00A0:48 6F 73 74 43 6F 6E 66 HostConf
00A8:69 67 4D 61 6E 61 67 65 igManage
00B0:6D 65 6E 74 3A 31 0D 0A ment:1..
00B8:4E 54 53 3A 73 73 64 70 NTS:ssdp
00C0:3A 61 6C 69 76 65 0D 0A :alive..
00C8:53 65 72 76 65 72 3A 70 Server:p
00D0:58 2F 32 2E 30 20 55 50 X/2.0 UP
00D8:6E 50 2F 31 2E 30 20 53 nP/1.0 S
00E0:70 65 65 64 53 74 72 65 peedStre
00E8:61 6D 2F 31 2E 30 0D 0A am/1.0..
00F0:55 53 4E 3A 75 75 69 64 USN:uuid
00F8:3A 75 70 6E 70 2D 4C 41 :upnp-LA
0100:4E 44 65 76 69 63 65 2D NDevice-
0108:31 5F 30 2D 30 30 31 33 1_0-0013
0110:61 33 36 31 32 32 37 38 a3612278
0118:2D 31 3A 3A 75 72 6E 3A -1::urn:
0120:73 63 68 65 6D 61 73 2D schemas-
0128:75 70 6E 70 2D 6F 72 67 upnp-org
0130:3A 73 65 72 76 69 63 65 :service
0138:3A 4C 41 4E 48 6F 73 74 :LANHost
0140:43 6F 6E 66 69 67 4D 61 ConfigMa
0148:6E 61 67 65 6D 65 6E 74 nagement
0150:3A 31 0D 0A 0D 0A :1....

[Rmus]

It refers to multicasting which WinXP supports.

http://www.urs2.net/rsj/computing/imgs/mcast.gif

EDIT: I forgot to add it's also IGMP (224.0.0.22 - Protocol 2)

http://www.urs2.net/rsj/computing/imgs/mcast-1.gif
___________________________________________________________

See:

http://www.iana.org/assignments/multicast-addresses

You can just set a block rule for port 1900 connecting out, and a block rule for IGMP to stop that traffic.


regards,

-rich