interesting multicast packet

[Gert Doering]

Hi,

On Tue, Feb 25, 2014 at 11:07:34AM +0100, Gert Doering wrote:
> After some troubleshooting around a Juniper SSG cluster today, we found
> that a windows server on the trust side of the SSG cluster is emitting
> UDP packets towards
> 
>   ff08::2.8083  (UDP, payload length 21)
> 
> ff08::2 = "all routers, organization-scoped"

Here's a hexdump of the packet...  source IPv6 address mangled, source
MAC is the netscreen NSRP vMAC, dest address is the default router.

11:46:47.456845 00:10:db:ff:20:60 > 00:d0:01:f3:6c:00, ethertype IPv6 (0x86dd), 
+length 83: 2001:608:xxx:xx::yyy.62029 > ff08::2.8083: UDP, length 21
        0x0000:  6000 0000 001d 117f 2001 0608 0xxx 00xx  `...............
        0x0010:  0000 0000 0000 0yyy ff08 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0002 f24d 1f93 001d 62ef  .........M....b.
        0x0030:  5245 4c41 5245 4c41 595f 5245 5350 4f4e  RELARELAY_RESPON
        0x0040:  4452 454c 41                             DRELA

still doesn't ring any bell...

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279