I came across some interesting broadcast traffic today on my network. I had one of my hosts listening on 6514/UDP and saw this come across the wire:
<rumor version="2.0" type="notification" topic="datHint" importance="normal" datVersion="5749" datCabVersion="20090922112722" updateCabVersion="20090413014657" baseURL="http://vs.mcafeeasap.com/MC/ENU/VS47"/>
The source port was 6515/UDP. According to the internets:
mcafee-asap – Used by McAfee antivirus. A broadcast on UDP/6514 is sent by a client without Internet access in order to find another computer, with Internet access to be used as a proxy for Internet antivirus updates.
I can only imagine the amount of fun that can be had with this type of proxy auto-discovery.
Advertisement
