TCP/IP Multicast Address Handling Remote DoS (spank.c)

saidin

Hi,

We are using Nessus scanners to scan all our devices for potential security breaches.

We got a finding for one of our devices with this vulnerability

In internet the solution suggested is to filter out multicast IP addresses (224.0.0.0/4). So, I have created this rule:

Interfaces : WAN and LAN

I wonder if the community has another workaround/solution for this vulnerability.

Regards
Said

dennypage

@saidin Honestly, the stuff at that tenable link is meaningless, and appears to have been written by someone who simply did not understand what multicast is.

johnpoz

@saidin that isn't even the right rule if you wanted to block that.

" host responds to TCP packets that are coming from a multicast IP "

saidin

@johnpoz So, the Source should be 224.0.0.0/4 and Destination any. And the rule must be applied for LAN and WAN?

If so, let me invert the configuration.

Thanks

Regards
Said

saidin

@dennypage well, in any case I need to identify a way to block this thing

Thanks for your reply

Regards
Said

johnpoz

@saidin if your goal is block scanner from triggering this finding.

Where are you running the scanner from? outside or inside? but yeah the would need to be source not destination.

dennypage

@saidin said in TCP/IP Multicast Address Handling Remote DoS (spank.c):

@dennypage well, in any case I need to identify a way to block this thing

Before you can block anything, you need to understand what’s actually happening. The information at that link might sound good, but is rather meaningless (like an AI summary). 🫣

I would recommend capturing packets to determine what is actually happening. This is the only way to make an informed decision.