Please help me block this traffic

I have been trying to disable this functionality for quite some time, but cannot seem to figure it out.

Within a 1 minute interval several packet sniffer tools report constant traffic from all-systems.mcast.net with a set size of 14 bytes.

ubuntu@ubuntu:~$ netstat -g IPv6/IPv4 Group Assignments interface RefZäh Group --------------- ------ --------------------- lo 1 all-systems.mcast.net eth0 1 all-systems.mcast.net lo 1 ip6-allnodes lo 1 ff01::1 eth0 1 ff02::1:ff84:d990 eth0 1 ip6-allnodes eth0 1 ff01::1 

It's designated IP is 224.0.0.1

ubuntu@ubuntu:~$ netstat -ng IPv6/IPv4 Group Assignments interface RefZäh Group --------------- ------ --------------------- lo 1 224.0.0.1 eth0 1 224.0.0.1 lo 1 ff02::1 lo 1 ff01::1 eth0 1 ff02::1:ff84:d990 eth0 1 ff02::1 eth0 1 ff01::1 

I have already managed to stop other multicast packets, namely traffic from 224.0.0.251, using this:

sudo ifconfig eth0 -multicast 

However, this has not stopped the all-systems.mcast.net traffic.

I have also unsuccessfully tried iptables, inspired by a website regarding the opposite of what I am trying to do:

sudo iptables -A INPUT -s 224.0.0.0/4 -j REJECT sudo iptables -A INPUT -d 224.0.0.0/4 -j REJECT sudo iptables -A INPUT -s 240.0.0.0/5 -j REJECT sudo iptables -A INPUT -m pkttype --pkt-type multicast -j REJECT sudo iptables -A INPUT -m pkttype --pkt-type broadcast -j REJECT 

Does anyone know how to stop this 224.0.0.1 / all-systems.mcast.net traffic?

1 Answer

Step 1. Record all traffic with a screenshot/video for one hour

step 2. Shutdown NIC, Router or Modem. (disable internet line temporary)

Step 3. Analyze footage, log all IP addresses.

Step 4. Verify YOUR IP's

Step 5. Use an IP Whitelist or another type of filter to block invalid IP addresses.(document which IP's)

Step 6. Reboot all systems.(computer, router, modem)

Step 7. Test it

Hope this helps :)