Screensaver needs to broadcast packets?

[lespea]

I came back to my computer after the avast screen saver had been running for a while and I was quite surprised to see that that sygate (firewall) had caught some packets that avastss.scr (avast screensaver) was trying to send to 224.0.0.22 and I am quite curious as to why it would need to send anything.  The only meaningful thing pulled out of the hex was SUBSCRIBE /Lay so I don't know if it is an anti-crack thing or something checking to verify it's register or something.  Anyways I'm going to block it until I know more information, if any of you know anything about this, as I couldn't google any good info.  Thanks in advanced to anybody who knows what this's for.

Adam

[lespea]

So none of the devs know why it needs to broadcast?

[igor]

I don't think the screensaver needs, or even should, send anything out.
Are you sure it's really the screensaver process? (could it be e.g. some hook loaded into the process?)

[lespea]

Hmm not sure, in retrospect I probably should have saved my firewall log for future reference :/.  I've only seen it once and when it did come up I just looked at the IP and process broadcasting.  Next time it comes up I'll post an update, I just initially thought it was some sort of update thing or something maybe, or like I said before checking to make sure it was registered or something.

[Lisandro]

I just initially thought it was some sort of update thing or something maybe, or like I said before checking to make sure it was registered or something.

While updating yes, avast! will connect (even to check against piracy)
But the screensaver module? In fact, I have never seen this in my firewall.

Some packets that avastss.scr (avast screensaver) was trying to send to 224.0.0.22 and I am quite curious as to why it would need to send anything.

Which is your screensaver (set into avast screensaver module)?
Some screensavers send packets...

[neiby]

224.0.0.22 is not a broadcast address, it is a multicast address. It is an address used by IGMP, or Internet Group Management Protocol. Some process on your machine is trying to join a multicast group and is sending an IGMP report to the address to which all IGMP-capable routers must listen.

I have no idea why Avast screensaver would be participating in IGMP. It's most likely something else.

John

[lespea]

I have just the defualt xp pic slideshow as my screensaver combined with the avast screensaver.  Yeah I guess I should have realized that it was a multicast address, perhaps I should pay more attention in my networking class :/ lol.  Still kinda wondering why it was sending it though, but like I said it only happened once and I was just kinda taken back by it and posted here... without saving the log ... so maybe I mis-read it or something.