interesting multicast packet

[Stig Venaas]

Hi

On 2/27/2014 8:16 AM, Gert Doering wrote:
> Hi,
>
> On Wed, Feb 26, 2014 at 10:57:07PM -0600, Frank Bulk wrote:
>> I suggest using Microsoft Network Monitor
>> (http://www.microsoft.com/en-us/download/details.aspx?id=4865) to identify
>> the processing sending out that traffic.
>
> We did.  It says "unknown"...
>
> But I think Daniel's find is spot-on, as
>
>   https://malwr.com/analysis/ZDg2MzhjNmJhOGIxNGNiM2I2NmRkMTMzODBkZjllYmY/
>
> shows the string we saw in the packet (click on "static analysis" ->
> "strings" -> "RELARELAY_RESPONDRELA"), a "McAffee Framework Service" is
> indeed installed and that "seems to be a known side effect" - though
> nobody seems to have observed this on IPv6 yet...

Sorry for this late reply, but it doesn't make much sense that it is
sent to the all routers address.

Stig

> Gert Doering
>          -- NetMaster
>