230.100.100.100 UDP Multicast Desination Port 2000

[admin_2]

I was wondering if there is a possibility that of a cisco device causing UDP Multicast on your network. We have 12 machines with that send out the a UDP multicast of destionation 230.100.100.100, souce port number 3359 (port numbers very), destination port 2000. The destination also has a mac address of 01:00:5e:64:64:64. Any help would be appreciated.

[sstudsdahl]

If you are seeing this multicast traffic come from 12 different sources, I would suspect an application running on those systems that would be generating the traffic. Multicast typically is one source many receivers. Traffic that would be generated by a cisco router is usually going to be destined to be in the 224.0.0.0/24 range and would be administrative traffic such as routing protocol updates.

[Richard Burts]

It is possible that Cisco routers are the source of the multicast, but I doubt it. If someone had configured a multicast join on the router for that address, it might explain the traffic. But I think it is much more likely that someone is running an application which is generating the traffic.

I think the fact that the source port varies and the destination port is always 2000 also sounds like an application running.

The destination MAC is not surprising and in fact is entirely dependent on the multicast IP address. In the MAC the 01:00:5e is the standard vendor code adopted for IP multicast, and the MAC 64:64:64 is based on the IP address (64 is the hexadecimal equivalent of 100 decimal)