topic Re: Masses of Multicast stream started/ended/leave/join events in EE router log in Broadband & Landline

Masses of Multicast stream started/ended/leave/join events in EE router log

ConfusedRaccoon — Fri, 18 Nov 2022 19:17:12 GMT

As title, my PC x.x.x.13 is spamming masses of Multicast events, joining, leaving every 10 seconds or so.

18:54:53, 18 Nov. Multicast event client leave group:224.168.100.1 client:192.168.1.13
18:54:53, 18 Nov. Multicast stream ended by client 192.168.1.13
18:54:43, 18 Nov. Multicast stream started by client 192.168.1.13
18:54:43, 18 Nov. Multicast event client join group:224.168.100.1 client:192.168.1.13
18:54:43, 18 Nov. Multicast stream request. client:192.168.1.13 group:224.168.100.1
18:54:43, 18 Nov. Multicast stream started by client 192.168.1.13

It's constant, and hits the Limit of MCST log after 15 minutes or so.

~~I have no idea what the 224.168.100.1 is~~ The unknown IP seems to be part of a multicast network, but I've no idea what or why it's happening. Is there any way I can track it down? Maybe something like Grammerly is trying to update its data base or something, I don't know.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

Mustrum — Fri, 18 Nov 2022 20:15:09 GMT

According to a quick look, it is connecting to About us (iana.org)

Not sure who tho. I would disconnect from the internet and run virus checkers and Malwarebytes to see if anything is picked up.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

XRaySpeX — Fri, 18 Nov 2022 20:36:49 GMT

@Mustrum : No, it isn't! They are the peeps who have overall control & management of all domains & IPs. They assign them but they don't run them.

The OP's PC is connecting as a client to a Multicast host, whose IPs has been reserved by IANA for just that purpose.

As the OP I would thoroughly check what programs are running on his PC. The command netstat -b 5 might assist.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

ConfusedRaccoon — Fri, 18 Nov 2022 21:47:15 GMT

Thanks for the replies, watching the netstat -b 5 now. Seeing a lot of nvidia and firefox. A couple of somerthings called gwctlsrv.exe and gwidlmon.exe, but they seem to be windows services. A handful of search app.exe which is the windows search iirc? and

Malwarebytes just flagged cheatengine and and old file used for nicehash

Netlimiter isn't showing anything that seems supisious, lots of stuff I don't understand.

Could it be DNS related? I've got cloudfare as default and then googles as secondary.

I'm also skimming through the windows firewall rules to see if anything stands out, but... not much.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

XRaySpeX — Fri, 18 Nov 2022 22:52:43 GMT

Does netstat show the IP 224.168.100.1 as a Foreign Addy?

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

ConfusedRaccoon — Fri, 18 Nov 2022 23:06:29 GMT

I'm not seeing 224.168.100.1 on the netstat.

I'm seeing it on the EE tech log: Multicast event client join group:224.168.100.1 client:192.168.1.13 -edit- thinking about it, that's just a group and there are no other ip's grouped apart from my local machine, so probably not the culprit. This is the first time I've come across this sort of thing, so learning as I'm going, hopfully. I may post to reddit as well, as it seems like it may not be an EE thing, but rather something else I need to dig out. Maybe.

This is what the netstat looks like.

Not sure what this searchapp is or what it's doing, I'm not activly searching for anything and Cortana is turned as off as I could get it without gutting windows 10. I should mention, Raccoon-War is my PC's name, Raccoon-Warren, but windows cut's it short.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

XRaySpeX — Fri, 18 Nov 2022 23:15:45 GMT

In computer networking, multicast is group communication where data transmission is addressed to a group of destination computers simultaneously, the others of which you wouldn't be aware of.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

ConfusedRaccoon — Sat, 19 Nov 2022 00:34:37 GMT

Ok thanks.

I'm not sure if I should be worried about this, how can I stop this behaviour? Find the culprit and delete it or can I disable the ability somewhere?

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

XRaySpeX — Sat, 19 Nov 2022 03:28:29 GMT

No, but it would be nice to have an explanation.

You could try taking down the non-Windows processes 1 by 1 and see if it goes away.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

ConfusedRaccoon — Sat, 19 Nov 2022 03:21:25 GMT

I'll keep this tab open and post if/when I get an answer. Thanks.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

ConfusedRaccoon — Thu, 27 Apr 2023 13:09:01 GMT

Interesting, or not, developement. I started to reinvestigate this little enigma last night as I saw my IP sending these Multicast events nearly twice a second.

Looking like this:

13:29:20, 27 Apr. A device disconnected from Ethernet port 1
13:29:20, 27 Apr. Wire Lan Port 1 down, Speed 10 Mbps
13:29:18, 27 Apr. Multicast stream started by client 192.168.1.13
13:29:18, 27 Apr. Multicast event client join group:224.168.100.1 client:192.168.1.13
13:29:18, 27 Apr. Multicast stream request. client:192.168.1.13 group:224.168.100.1
13:29:17, 27 Apr. Multicast stream started by client 192.168.1.13
13:29:17, 27 Apr. Multicast event client join group:224.168.100.1 client:192.168.1.13
13:29:17, 27 Apr. Multicast stream request. client:192.168.1.13 group:224.168.100.1
13:29:17, 27 Apr. Multicast event client leave group:224.168.100.1 client:192.168.1.13
13:29:17, 27 Apr. Multicast stream ended by client 192.168.1.13
13:29:08, 27 Apr. Multicast stream started by client 192.168.1.13
13:29:08, 27 Apr. Multicast event client join group:224.168.100.1 client:192.168.1.13
13:29:08, 27 Apr. Multicast stream request. client:192.168.1.13 group:224.168.100.1
13:29:07, 27 Apr. Multicast stream started by client 192.168.1.13
13:29:07, 27 Apr. Multicast event client join group:224.168.100.1 client:192.168.1.13
13:29:07, 27 Apr. Multicast stream request. client:192.168.1.13 group:224.168.100.1
13:29:07, 27 Apr. Multicast event client leave group:224.168.100.1 client:192.168.1.13
13:29:07, 27 Apr. Multicast stream ended by client 192.168.1.13

I unpluged my ethernet cable and my wife's PC started pinging these events. Roughly every minute:

13:35:10, 27 Apr. Lan IPv6 Neighbour Discovery events: NEIGHBOR_SOLICIT
13:34:06, 27 Apr. Multicast stream started by client 192.168.1.6
13:34:06, 27 Apr. Multicast event client join group:224.3.2.1 client:192.168.1.6
13:34:06, 27 Apr. Multicast stream request. client:192.168.1.6 group:224.3.2.1
13:32:06, 27 Apr. Multicast stream started by client 192.168.1.6
13:32:06, 27 Apr. Multicast event client join group:224.3.2.1 client:192.168.1.6
13:32:06, 27 Apr. Multicast stream request. client:192.168.1.6 group:224.3.2.1
13:30:52, 27 Apr. Receive a DHCP request
13:30:52, 27 Apr. Lan IPv6 Neighbour Discovery events: NEIGHBOR_SOLICIT
13:29:58, 27 Apr. Multicast stream started by client 192.168.1.6
13:29:58, 27 Apr. Multicast event client join group:224.3.2.1 client:192.168.1.6
13:29:58, 27 Apr. Multicast stream request. client:192.168.1.6 group:224.3.2.1
13:29:54, 27 Apr. Receive a DHCP request
13:29:54, 27 Apr. Lan IPv6 Neighbour Discovery events: NEIGHBOR_SOLICIT

I've plugged my Ethernet cable back in and it's remained "quiet". While my Wifes PC still sends these out every minute or so. Still no idea what or why or even if it's something to worry about. I play a fair few online games and I wonder sometimes if this might be why sometimes I struggle with ping and latency? But I might be grasping at straws.

Re: Masses of Multicast stream started/ended/leave/join events in EE router log

neomic — Wed, 10 May 2023 16:01:49 GMT

I Had the same problem and after a bit of investigation.

In my case, It was my network Printer Broadcasting its IP and looking for printjobs.

hope this helps