Simple, Safe, Secure Ransomware Protection

Why is Retrospect communicating with address 224.1.0.38?

Resources

Address 224.1.0.38 does not refer to any node on your network. It is our Class D multicast address, assigned to Retrospect by the Internet Assigned Numbers Authority and listed in their registration database at:

http://www.isi.edu/in-notes/iana/assignments/multicast-addresses

Sending a packet to a multicast address is how Retrospect locates its clients using our Piton Name Service.

IANA’s assignment of port 497 to "Dantz" (Retrospect) is listed on their site at:

http://www.isi.edu/in-notes/iana/assignments/port-numbers

There should be no traffic on the Internet using port 497 that’s not using Retrospect.

Why does this appear to be an IP address off site?

Multicast makes for a very simple and clean way to easily determine a group of available clients in a single operation. Multicast is setup using the multicast IP address 224.0.0.1 (which corresponds to the all hosts group on the subnet) and the router effectively handles getting the information out to the hosts on the subnet. This is the most effective way to find clients.

See more information on IGMP multicast model.

How to ensure your device is reachable via multicast

You can test what devices are reachable via multicast using the ping tool on Mac or Windows.

  • Windows — Open Command Prompt and run: ping 224.0.0.1

  • Mac — Open Terminal and run: ping 224.0.0.1

For both, you should see an output similar to the one below. Each IP address corresponds to a device that is multicast-enabled and accessible.

[~]$ ping 224.0.0.1
PING 224.0.0.1 (224.0.0.1): 56 data bytes
64 bytes from 192.168.0.103: icmp_seq=0 ttl=64 time=62.978 ms
64 bytes from 192.168.0.108: icmp_seq=0 ttl=64 time=0.077 ms

Last Update: 10 November, 2015