On Thu, Feb 03, 2000 at 05:26:37PM -0500, FAB wrote:
> diald is holding the link up for packets that look like this in tcpdump:
>
> 01:31:30.728360 170.222.244.1 > 224.0.0.5: OSPFv2-hello 44: rtrid
> 192.168.150.121 area 0.0.2.188 [tos 0xc0] [ttl 1]
>
> looks like it has something to do with named, since 224.0.0.5 is a root name
> server, but its not over tcp/ip nor udp, since specifying these protos with
> tcpdump shows nothing...so what are they?...i need to know a protocol and a
> port so i can filter it out...
>
> can anyone help?
This is similar to the recent report of IGRP packets keeping a user's link
up. OSPF is a protocol on top of IP, with protocol number 89.
You can use ipchains (if you have a Linux system that is ipchains-capable):
ipchains -A input -p 89
or with diald
ignore ip ip.proto=89
If you have a line in /etc/protocols like this:
ospf 89 OSPF OSPFIGP
you can use the symbolic names ospf, OSPF, or OSPFIGP, instead of the number
89.
It's doubtful this has anything to do specifically with named. As far as I
know, OSPF is a protocol used by routers and routing daemons. The 224.0.0.5
IP address is reserved for multicast OSPF routers, so says RFC1700 (Assigned
Numbers). It looks like you're receiving multicast routing packets for some
reason.
Michael
--
Administrator www.shoebox.net
Programmer, System Administrator www.gallanttech.com
--
-
To unsubscribe from this list: send the line "unsubscribe linux-diald" in
the body of a message to [EMAIL PROTECTED]
