On Apr 7, 6:06 pm, Dennis wrote:
> I'm trying to understand better why programs sometimes multicast to
> 224.0.0.2.... sleezy programs that should never, ever, require any
> network access. It would be very easy to just set the firewall to
> block it and forget it, but I am in the industry and would like to
> understand exactly what is going on.
>
> Specific Questions:
>
> 1) From what I understand (http://en.wikipedia.org/wiki/Multicast_address
> ) the multicast is intended for all routers on the subnet. So I assume
> the program is looking for the gateway to the internet?

Yes.

> 2) If it wanted that info couldn't it just tell what Windows default
> gateway is set to and use that? So why waste bandwidth and polute my
> LAN with 224 multicasts??? Again, not that I'm worried about it, I
> just want to understand.

The default gateway may not support things like UPnP while another
gateway might.

> 3) Regarding the 224.0.0.1 multicast address... I notice on the above
> wikipedia page that it is intended for all hosts on the subnet. As is
> the 255.255.255.255 broadcast address. So Im a bit confused about the
> difference between them, they both go to all hosts, can anyone clarify
> without using big words?

224.0.0.1 means all hosts in the multicast domain while
255.255.255.255 means all hosts in the broadcast domain. These may not
be the same thing.

DS

On Apr 7, 9:06*pm, Dennis wrote:

> 3) Regarding the 224.0.0.1 multicast address... I notice on the above
> wikipedia page that it is intended for all hosts on the subnet. As is
> the 255.255.255.255 broadcast address. So Im a bit confused about the
> difference between them, they both go to all hosts, can anyone clarify
> without using big words?

I agree with David's replies, but wanted to add something to this one.

Turns out, IPv6 does exactly what you ask. IPv6 gets rid of the "all
1s" broadcast, and replaces it with a multicast to all "on-link
hosts."

The difference between the two is that an all 1s broadcast maps
algorithimically to an all 1s MAC broadcast address. Which means that
every host in the Ethernet is interrupted. In the days before IP was
the universal L3 protocol, this meant that all DECnet, IPX, Appletalk,
SNA, etc. hosts on the L2 network were interrupted by something that
was irrelevant to them.

Instead, if a multicast address like 224.0.0.1 is used, it maps to a
MAC multicast address which only IP hosts would monitor. As things are
today, perhaps the difference is not so important anymore.

Bert