what is 224.0.0.22? 1

[ockerb]

hi
I am running a computer with win xp pro. I have been trying to set up a small 2 computer network using a small hub and cat 5 cables. After I set up the network and rebooted the system the firewall on one of the computers has come up with 2 files, alg.exe and explorer.exe wanting to connect to 224.0.0.22. I am not connected to the internet at this stage with this network. Any ideas please

Ockerb

 

[colem]

Not sure what firewall software you are using, but not all of them allow networking by default. If you are unsure about what a process is, you can do a google search and you will soon learn what those processes are, and that they are to be expected. And as far as your firewall is concerned, you will need to train it to allow certain things. There may be a setting within the firewall configuration area to allow home or office networks.

The more I learn, the more I know I don't know enough.
<order>chicken w/garlic sauce combo</order>
For those about to rock, we salute you.
NO DISASSEMBLE!

 

[ockerb]

Thanks colem, I understand what you are telling me, i suppose my main question is why do they want to connect to 224.0.0.22. what/where is that if i'm not connected to the internet?
Thanks for your time mate
Ockerb

 

[edfair]

You have something running that can detect your networking and it is trying to phone home to report in. Possibly to register or update. Or possibly to do something worse.
Have you been connected via dialup? Then possibly adware, spyware, or malware.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[bcastner]

IP 224.0.0.22 is a "multicast address" for routers reserved for local purpose, it is part of ICMP v3 (Internet Control Message Protocol version 3). You can Google this if you would like to read a lot more.

It is OK.
If you go to the trouble of analysing the TTL (Time To Live) of the responses you would likely find they would "die" after 1 hop anyway. If I use my firewall to block this, I cannot get email.

ALG is the Application Layer Gateway service, a component service of Windows XP. It is required if you use a 3rd party firewall or Internet Connection Sharing (ICS) to connect to the internet. Do not end this program in task manager - you will lose all internet connectivity until your next restart or login.

 

[edfair]

Thank you for increasing my knowledge bcastner. Hadn't ever run across it.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[bcastner]

Probably because most firewalls allow the traffic without comment. At one time I was using a "rules-based" firewall and blocked the traffic.

It took me several days to figure out the problem with my email. (My ISP is Verizon, and it makes a router discovery/ registration call).

 

[edfair]

Since the OP has no internet connectivity, and therefore no need for multicast capability, can this be shut down?

And I'm assuming that the error message was generated within XP's firewall. Which seems to be overkill in a 2 machine peer to peer network and probably best to be shut down also.


Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[bcastner]

Right click on the network connection icon in the notification tray (two little computers), View Network Connections.

Click on Advanced at the top menu, Optional Networking Components. Double click Networking Services. Uncheck #1, #3, and #5 (Internet Gateway Discovery, RIP listener, and UPnP client).

 

[bcastner]

I should note that if ICS is being used in this small LAN, and/or you intent to use an IM client with file transfer, voice and/or video, I would leave selections #1 and #5 enabled.

A simpler solution would be to allow the traffic through the firewall (this must be a third-party firewall, as XP will allow the traffic with an exception entry for ICMP in the Firewalls advanced tab, ICMP, allow incoming router requests.

 

[ockerb]

Thanks all I feel much better about this ip now and yes it is a 3rd party firewall. Thanks again

Ockerb

 

[bcastner]

I should note that I Googled this, and as a convenience quoted in part a response to the identical question by "godfather" in this web forum:

http://forums.pcworld.co.nz/archive/index.php/t-44408.html

It was a convenience for me, but I would feel badly doing so without attribution.

Again, a Google on this will provide a great deal of light about ICMP and router discovery.

And, I think I addressed Forum member Ed Fair's original query: (I will paraphrase): "If it is a LAN without Internet, why are they being bothered with this nonsense?"

What I failed to do was explain why explorer.exe asks for access to the internet. You can tell the firewall to block this without penalty. (I do not, personally). It asks for the access in anticipation of a possible Help request. It is benign, and not "spying" on you.

 

[bcastner]

What I really am waiting for is the question: "Why is my XP computer trying to create a listening port for a Federal prison in the state of Alabama, USA?"

It is related to the original poster's question, sort of.

 

[ockerb]

hmmm...lost me on the last one bill, it must be way past my bedtime. Answer for you edfair as well, it was only a lan without internet because I was trying to get the lan working before i worried about internet access and ICS. Also for you bill, it's not always easy to get the answers from google, or should I say the answers can be searched and obtained but the searcer doesn,t always understand the return. Alas, back to the drawing board OR ask in Tek Tips

 

[bcastner]

ockerb,

You have described exactly the point of sites such as Tek-Tips, and the newsgroups. Hopefully the Forum members can answer in plain English a question such as yours. I learn more from answering questions than I ever in fact contribute as a body of work to this Forum.

My last question is just a folly -- an entertaining question for the Forum. I apologize, as it does not have anything to do with your original question, albeit it is related.

Ignore it.

Best wishes,
Bill Castner

 

[edfair]

I was making the comment based more on the user being pushed into more of an OS than he needs. I work on several small networks used for data sharing where XP is definite overkill when you consider the internet protection built in by default.

My response to the google answer problem would be to "ask the right question" but that has to be trimmed to "use the garbage to form the next search". Funny how refining the search terms can drill down to the one answer you need.

Although you have raised a hypothetical question Bill, it is a serious concern. But then, if you never pay attention to what your machine is doing in the background anyway, how would you know it has been hijacked to who knows what.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[bcastner]

Ed,

I did have the advantage in my Google that I knew the basis of the question, but was checking to see if my recollection was correct. I used the search term: "xp connect 224.0.0.22 icmp", but only because I knew it was a router discovery issue.

We may disagree on the issue if XP is overkill for a small LAN. That is too lengthy a debate to begin here. I understand your concerns/issues, but for small LANs XP (my opinion) is a better choice than Win9x.

I used for years rules-based firewalls, for exactly the issue you raise -- I want to know what is happening in the background. But for many users this is a case of "too much information." The XP Service Pack 2 firewall is a reasonable compromise. As are the essentially plug-and-play third party firewalls from Zone Alarm, Symantec, Sygate, and others.

The resolution of my hypothetical question above is quite interesting. I do not want to spoil a good puzzle, but I apologize again as it was a related issue but off-topic.

As we brace where I live for either rain, an ice storm, a blizzard or a modest snow fall, I offer the following for the amusement of all. (It does contain some cuss words, but nothing overtly offensive.)

How to ask a good question in a Forum:

http://www.trials-shack.co.uk/posting.html