<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Zarafa WebAccess v7.1.1-37812">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>suricata and 224.0.0.252</title>
<style type="text/css">
body
{
font-family: Arial, Verdana, Sans-Serif ! important;
font-size: 12px;
padding: 5px 5px 5px 5px;
margin: 0px;
border-style: none;
background-color: #ffffff;
}
p, ul, li
{
margin-top: 0px;
margin-bottom: 0px;
}
</style>
</head>
<body>
<p>Hi,</p><p> </p><p>New to this list, so I hope you can help out.</p><p> </p><p>Suricata reports a prio 1 on my internal network, multicast from a single station to 224.0.0.252. According to suricata, this is emule traffic. According to google, this is link local multicast name resolution.</p><p> </p><p>It is a windows 7 pc (the only one on that network), suricata is version 1.1.1 (ubuntu 12.04lts)</p><p> </p><p>The reported payload indicates it is llmnr. There is no trace of emule on that PC.</p><p> </p><p>Any other confirmations I can check to ensure it is llmnr?</p><p> </p><p>Thanks</p><p>Paul</p>
</body>
</html>