Priscilla Oppenheimer wrote: > > How do you know that is RIP though? It could be any IP > broadcast? Just being picky. Sorry! :-) > > A 52-byte RIPv1 packet would have a 20-byte IP header, an > 8-byte UPP header, an 8-byte RIP header, and one route. So that > could be a clue... Also, if RIPv1 is the only thing you have > that uses 255.255.255.255, that could be a clue.
Thanks for the clarification. :) > > > > 07:35:49: BR0/0 DDR: ip (s=192.168.0.1, d=224.0.0.9), 52 > bytes, > > outgoing interesting (ip PERMIT) > > That's a little more recognizable because of 225.0.0.9. But is > RIPv2 the only thing that uses that? Just wondering.... Yes. "The range of addresses between 224.0.0.0 and 224.0.0.255, inclusive, is reserved for the use of routing protocols and other low-level topology discovery or maintenance protocols, such as gateway discovery and group membership reporting. Multicast routers should not forward any multicast datagram with destination addresses in this range, regardless of its TTL." (http://www.iana.org/assignments/multicast-addresses) Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=65518&t=65482 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
