Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently the whole network at work is being hit by multicast traffic originating on the LAN itself. I did some investigating and the service which seems to be responsible is ws-discovery.

I have attached a screenshot of wireshark capturing the traffic. I have tried shutting down the source machine from which it was originating, but the multicast traffic still seems to be present in the network.


My network topology

2 subnets - and Gateway is a debian system. We have 3 switches for 3 floors. They are all unmanaged Dlink 24-port switches.

Multicast blocking at switch level is out of the question. Any solutions? :(

share|improve this question
You don't happen to have any network loops (in topology), do you? That could easily explain ghost traffic. Also, there are quite a few services/programs that may rely on ws-discovery, so completely disabeling it may not be feasible. Limiting it to 'normal' levels may be more suitable. – Joris Feb 15 '11 at 6:07
What sort of loops should i be looking into? Sorry im still a newbie! Also svchost.exe is the one responding on all the machines. The multicast ip is The multicast was going on to ws-discovery whose port was 3702. Right now its completely stopped. – Nel Feb 15 '11 at 6:24
AHHHHH! You were right! It was a network loop. One person had connected back a freely hanging wire of the switch back into it!!! Jeebus! Thanks Joris – Nel Feb 15 '11 at 6:54
You're welcome :-) – Joris Feb 15 '11 at 15:54
@Joris out of curiosity, why did you make your loop suggestion as a comment, rather than an answer? I've seen lots of people doing the same recently on serverfault, but I'm not sure why. – Daniel Lawson Apr 8 '11 at 22:31

I've seen very similar traffic on my own network. It ended up being a misconfigured rendezvous point in the Cisco router configs. Multicast in Cisco-land requires a rendezvous point to prevent loops. I don't know if that's at all applicable in your setup, though.

share|improve this answer
We do have a cisco 1841, but thats facing outward from the gateway. I dont think that is the problem although i could have a look. The multicast traffic was at about 9-10 Mbits which brought the whole network to a crawl, but now its at 1-2Mbits, I have no clue how or why its reduced! – Nel Feb 15 '11 at 6:04
@nel It's worth a look. The event I'm thinking of had some of the cisco gear itself repeating mcast traffic it was seeing. – sysadmin1138 Feb 15 '11 at 6:05
Just checked in the configs, nothing related to multicast is setup in there. – Nel Feb 15 '11 at 6:23
@Nel You may need to set something. Unfortunately, I'm not fluent in Cisco so someone else will have to help you with that. – sysadmin1138 Feb 15 '11 at 6:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.