I suggest using Microsoft Network Monitor (http://www.microsoft.com/en-us/download/details.aspx?id=4865) to identify the processing sending out that traffic.
Frank -----Original Message----- From: ipv6-ops-bounces+frnkblk=iname....@lists.cluenet.de [mailto:ipv6-ops-bounces+frnkblk=iname....@lists.cluenet.de] On Behalf Of Gert Doering Sent: Tuesday, February 25, 2014 4:08 AM To: ipv6-ops@lists.cluenet.de Subject: interesting multicast packet Hi, my google-fu is failing me, but maybe one of you knows. After some troubleshooting around a Juniper SSG cluster today, we found that a windows server on the trust side of the SSG cluster is emitting UDP packets towards ff08::2.8083 (UDP, payload length 21) ff08::2 = "all routers, organization-scoped" These packets are sent about every 61 minutes, and caused some interesting issues here as the *passive* SSG leaked them out towards the router, leading to "the NSRP MAC address showing up on the wrong switch port", causing short hickups. But that's not what I'm wondering about - I'm more curious about that sort of packet - what is that? What is it used for? Which process is emitting it, and what is it trying to achieve? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279