IP Address Question

[Kevin Brown]

Dazed_75 wrote:
> I was working on a friend's systems today and saw something I did not
> understand.  Yes, they were windows boxes, but my question is purely a
> networking question.  Basically he has a desktop machine with a wired
> connection to a wireless AP/router (Airport brand I think) and a
> laptop using a wireless connection to that same router.  The router is
> providing DHCP Server functionality and serving addresses
> 192.168.0.100-xxx. All that seems to be working fine.
> 
> The ethernet adapter in the desktop showed it was operating as
> 192.168.0.101 with a subnet mask of 255.255.255.0 which I thought
> meant it would only accept packets addressed to 192.168.0.something
> and broadcast packets on that same net.  I had also believed that the
> 4 wired ports on the router were switched, not a hub.  Hence I was
> quite surprised that the firewall had seen and denied access to a
> request from the laptop 192.168.0.102 (UDP port 49xxx) to
> 239.255.255.250 port 3702.
> 
> Yes, the laptop is a Vista machine and therefore is using their new
> discovery protocol, but my question is why the desktop software ever
> even saw this message. I know I am missing something very basic
> because I would have thought the switch would not even have put the
> message on the desktop's wire and that even if it did, the ethernet
> port hardware or driver on the desktop would not have passed the
> message in to where the firewall would see it.  What am I missing?

What you are seeing is a multicast packet from the system announcing it 
is now on the network.  If you look at your route table you will see a 
default route for 224.0.0.0/240.0.0.0.