igmp v3

[bbzz]

I always have one terminal which monitors pflog0 filter realtime, which logs blocks on internet facing interface on one of my routers.

So I see this pops up:

rule 48..16777216/8(ip-option): pass out on vge1: X.X.X.X > 224.0.0.22: igmp v3 report, 1 group record(s)

The group that multicast report for is 239.255.255.250 (SSDP).

Since I never, ever saw this before (on this particular router that is), I quickly parsed a few old pflog logs, and non had this. Why would this be recorded? Why would it send igmp v3 report? Not only that but there's no rule that logs passing OUT on interface.

 

[kpa]

It's the ip options that makes pf(4) to log those packets. I have this for silencing those messages in my logs:

# Silence the log noise
pass quick on $LAN proto igmp all allow-opts

 

[bbzz]

Ok, but what makes it send it? No config has been changed for a long time, and the only time I've seen this logged was last night - 3 messages in 10 seconds.