Re: Strange 224.0.0.251 address being accessed on bootup
On Monday 27 August 2007 03:52, Douglas A. Tutty wrote:
> On Sun, Aug 26, 2007 at 10:42:51PM +0200, Nigel Henry wrote:
> > I've had this problem for a while. When booting Debian Lenny, and perhaps
> > Etch as well. When booting up I've had the following output trying to
> > access 224.0.0.251.
> >
> > eth0: link up, 100Mbps, full-duplex, lpa 0x45E1
> > NET: Registered protocol family 10
> > lo: Disabled Privacy Extensions
> > lp0: using parport0 (interrupt-driven).
> > ppdev: user-space parallel port driver
> > eth0: no IPv6 routers present
> > DROPPED IN= OUT=eth0 SRC=192.168.0.8 DST=224.0.0.22 LEN=40 TOS=0x00
> > PREC=0xC0 TTL=1 ID=0 DF OPT (94040000) PROTO=2
> > DROPPED IN= OUT=eth0 SRC=192.168.0.8 DST=224.0.0.251 LEN=257 TOS=0x00
> > PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=237
> >
> >
> > According to RFC 3171 this block of addresses (224.0.0.x) is reserved for
> > special purposes.
> >
> > 192.168.0.8 is the static address of my Lenny install, and 224.0.0.251 is
> > the mystery address.
> >
> > There are 2 daemons that are running and looking for a response at
> > bootup. Ntpd is directed towards my other machine that is getting it's
> > time from the Internet. That is across the LAN, not the Internet. That's
> > not the problem.
> >
> > The only thing accessing the Internet at boot up is freshclam, and that
> > once the ethernet connection is up.
>
> It looks like its happening as the ethernet connection comes up. What
> happens if you ifdown eth0 and then ifup eth0 ?
I started tail -f /var/log/messages, then in another terminal did an ifdown,
and ifup, and got the same string of messages pointing to the odd IP address.
Then Avi Rozen's message turned up. First line mentioned Zeroconf, which I've
had a run in with before, when Gkrellm was displaying the wrong IP address
for the machine. Someone on the list suggested purging it, which I did, and
got the proper address showing again in Gkrellm. I didn't realise there were
other things trying to use zeroconf. I stopped the avahi daemon, ran ifdown,
ifup again, and bye bye messages. Last thing was disable the avahi daemon
using sysv-rc-conf. Job done, apart from having to do the same on my Etch,
and Sarge installs.
>
> Check in /etc/network/if-up.c and /etc/network/if-pre-up.d for anything
> that may try to run.
>
> On my system, shorewall starts immediatly after networking in
> /etc/rcS.d. I don't know why you appear to be getting errors from a
> firewall unless your firewall script runs before networking comes up.
Networking is S 40, and Guarddog is S 65, which is 11 places further down the
list.
>
> Since this is all happening in /etc/rcS.d, I'd suggest booting with
> init=/bin/sh and running the /etc/rcS.d scripts manually one at a time
> to try to track it down. If you can get a shell while these errors are
> happening, perhaps you can see what processes are running.
I havn't tried that before. Is that going to be similar to the interactive
boot up that you can do on Fedora?
>
> Doug.
Thanks, as always for your help Doug.
Nigel.
Reply to: