O que esses endereços IP da IANA estão fazendo nas minhas configurações de firewall?

Question

Estou executando um Raspberry Pi com Raspbian, que está conectado à WAN por meio de um serviço de VPN.

Eu estava monitorando meu tráfego de rede Ethernet eth0 usando iftop para garantir que o tráfego passasse de vpn em vez de eth0 .

No tráfego eth0 , vejo tráfego conectando-se aos endereços IP 224.0.0.251 e 239.255.255.250 . Uma pesquisa de endereço revela que eles pertencem à Autoridade de números atribuídos da Internet .

Por incrível que pareça, ao listar iptables -L , vejo que meu ufw firewall tem regras de 'aceitação' para esses endereços IP.

Chain ufw-before-input (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ufw-logging-deny  all  --  anywhere             anywhere             state INVALID
DROP       all  --  anywhere             anywhere             state INVALID
ACCEPT     icmp --  anywhere             anywhere             icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere             icmp source-quench
ACCEPT     icmp --  anywhere             anywhere             icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere             icmp parameter-problem
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc
ufw-not-local  all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251          udp dpt:mdns
ACCEPT     udp  --  anywhere             239.255.255.250      udp dpt:1900
ufw-user-input  all  --  anywhere             anywhere      

Eu mesmo nunca adicionei essas regras desde que instalei o ufw ou alguma vez antes, então estou pensando quais são e se elas devem permanecer seguramente onde estão.

    

Answer 1

Eu vejo tráfego conectando-se aos endereços IP 224.0.0.251 e 239.255.255.250

224.0.0.251 e 239.255.255.250 são Endereços multicast :

A multicast address is a logical identifier for a group of hosts in a computer network, that are available to process datagrams or frames intended to be multicast for a designated network service.

Multicast addressing can be used in the Link Layer (Layer 2 in the OSI model), such as Ethernet multicast, and at the Internet Layer (Layer 3 for OSI) for Internet Protocol Version 4 (IPv4) or Version 6 (IPv6) multicast.

Mais informações são fornecidas abaixo, mas esse tipo de atividade é normal.

O que é 224.0.0.251 ?

224.0.0.251 é um endereço DNS multicast (mDNS) .

the multicast Domain Name System (mDNS) resolves host names to IP addresses within small networks that do not include a local name server.

It is a zero-configuration service, using essentially the same programming interfaces, packet formats and operating semantics as the unicast Domain Name System (DNS).

Fonte DNS multicast (mDNS)

I've seen those types of requests before - those certainly look much like Bonjour / mDNS requests to me. They use multicast IP address 224.0.0.251 and port 5353.

The most likely source for this is Apple iTunes, which as you know comes pre-installed on Mac computers and is a popular install on Windows machines.

UPDATE: if this is a Linux box (not a Mac or Windows box), that's probably the Avahi daemon then. Its ZeroConf/Bonjour compatible. Its installed by default, but if you don't use DNS-SD or mDNS, it can be disabled.

Fonte o que faz o multicast no 224.0. 0.251? responda por suman

O que é 239.255.255.250 ?

239.255.255.250 é um endereço Protocolo de descoberta de serviço simples .

The Simple Service Discovery Protocol (SSDP) is a network protocol based on the Internet Protocol Suite for advertisement and discovery of network services and presence information.

It accomplishes this without assistance of server-based configuration mechanisms, such as the Dynamic Host Configuration Protocol (DHCP) or the Domain Name System (DNS), and without special static configuration of a network host.

SSDP is the basis of the discovery protocol of Universal Plug and Play (UPnP) and is intended for use in residential or small office environments.

Fonte Protocolo de Localização do Serviço

Leitura Adicional

• o que faz o multicast em 224.0.0.251 ?