Chipheads: A little advice and counsel please

June 03, 2017, 10:34 AM

We are in the throes of a change to the internet here in lower Alabamer; going from the Time-Warner/RR/Brighthouse system to the merged Comcast/Spectrum network.

So far so good until this week.

I'm on a lower speed limb of the system (20 Mbps) and that's fine. However, this week, I noticed something "different" - laggy internet speeds.

Being the good scientist, I investigated.

Checked all the usual culprits, viruses, adware, ran MalwareBytes, Superantispyware, rebooted the modem, router, computer. Laggy.

Opened the Task Manager and took a look at everything.

The wired network ( and the wireless network on a laptop) are getting continual "bumps" from 239.255.255.250 in the sequence of 0 bytes/8 bytes/0 bytes/24 bytes/0 bytes/32 (or more) bytes/0 bytes. This WAS NOT happening before this week.

I'm on IPv4.

Is this some "keep awake" traffic or have they managed to hose the cable network with their transition?

Thanks for any and all advice.

RMD

June 03, 2017, 10:56 AM

mrbill345

Doing a Whois lookup returns this:

quote:
Whois IP 239.255.255.250
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/wh...accuracy/index.xhtml
#

#
# The following results may also be obtained via:
# https://whois.arin.net/rest/ne...et=false&ext=netref2
#

NetRange: 224.0.0.0 - 239.255.255.255
CIDR: 224.0.0.0/4
NetName: MCAST-NET
NetHandle: NET-224-0-0-0-1
Parent: ()
NetType: IANA Special Use
OriginAS:
Organization: Internet Assigned Numbers Authority (IANA)
RegDate: 1991-05-22
Updated: 2013-08-30
Comment: Addresses starting with a number between 224 and 239 are used for IP multicast. IP multicast is a technology for efficiently sending the same content to multiple destinations. It is commonly used for distributing financial information and video streams, among other things.
Comment:
Comment: A full list of IPv4 multicast assignments can be found at:
Comment:
Comment: http://www.iana.org/assignments/multicast-addresses
Comment:
Comment: A document describing the policies for assigning multicast addresses can be found at:
Comment: http://datatracker.ietf.org/doc/rfc5771
Ref: https://whois.arin.net/rest/net/NET-224-0-0-0-1

OrgName: Internet Assigned Numbers Authority
OrgId: IANA
Address: 12025 Waterfront Drive
Address: Suite 300
City: Los Angeles
StateProv: CA
PostalCode: 90292
Country: US
RegDate:
Updated: 2012-08-31
Ref: https://whois.arin.net/rest/org/IANA

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: ICANN
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: email@iana.org
OrgAbuseRef: https://whois.arin.net/rest/poc/IANA-IP-ARIN

OrgTechHandle: IANA-IP-ARIN
OrgTechName: ICANN
OrgTechPhone: +1-310-301-5820
OrgTechEmail: email@iana.org
OrgTechRef: https://whois.arin.net/rest/poc/IANA-IP-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/wh...accuracy/index.xhtml
#

A little more investigating reveals:

quote:
MTRACE.MCAST.NET

224.0.1.32 A multicast version of traceroute.

224.2.0.0-224.2.255.255 The Multicast Backbone on the Internet (MBONE) addresses are reserved for multimedia conference calls, i.e., audio, video, whiteboard, and shared web browsing between many people.

224.2.2.2 Port 9,875 on this address is used to broadcast the currently available MBONE programming. You can look at this with the X Window utility sdr or the Windows/Unix multikit program.

239.0.0.0-239.255.255.255 Administrative scope, in contrast to TTL scope, uses different ranges of multicast addresses to constrain multicast traffic to a particular region or group of routers. For example, the IP addresses from 239.178.0 to 239.178.255 might be an administrative scope for the state of New York. Data addressed to one of those addresses would not be forwarded outside of New York. The idea is to allow the possible group membership to be established in advance without relying on lessthan- reliable TTL values. The exact divisions of this range into particular scopes remains to be defined.

Hope this is somewhat helpful.

June 03, 2017, 01:06 PM

rduckwor

Thanks, it gave me a clue as to where to look.

The range I am getting bumped from is: 239.0.0.0-239.255.255.255 Organization-Local Scope [David_Meyer][RFC2365] 1997-01-01

And this tells me nothing.

I will give them this weekend and then query the tech support people. (Oh God, I hate talking to them!)

Thanks for your help.

RMD

June 03, 2017, 01:14 PM

sigmonkey

Your PC is broadcasting to that IP using Simple Service Discovery Protocol and or Plug and Play services.

Go to services and stop them and see if it helps.

You might need to disable them, then reboot.

June 03, 2017, 01:54 PM

rduckwor

quote:
Originally posted by sigmonkey:
Your PC is broadcasting to that IP using Simple Service Discovery Protocol and or Plug and Play services.

Go to services and stop them and see if it helps.

You might need to disable them, then reboot.

Thanks, but the bump I see is receive, not send. Also, remember I am a stump when it come to IT stuff. "Services?"

Thanks,

RMD

June 03, 2017, 02:35 PM

r0gue

If it's multicast, it's probably just a part of their IPTV delivery mechanism. I seriously doubt small probe-type packets have anything to do with your performance experiences.

June 03, 2017, 02:49 PM

FenderBender

Give them a call, multi-cast and broadcast are different things.

June 03, 2017, 06:29 PM

rduckwor

Thanks. I will call them Monday.

RMD