Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have read this article but still has some doubts may be after that...

The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from any source address. This response is not subject to any filtering. This response must be received on the same port that Windows XP SP2 used to broadcast the original multicast or broadcast message.

This feature enables programs and services that use multicast and broadcast messages to work correctly.

Note This change does not apply to the IPv6 firewall.

I work with firewalls for many years but so far I have not read this concept. and can't describe it for studenst in my class in details.

Is this normal behaviour for firewalls, and what is the reasoning behind it?

share|improve this question
    
Hi Saber - let me know if my edits broke your question. –  Rory Alsop Dec 7 '12 at 9:08
    
Hi @RoryAlsop . thank you so much. Why we haven't any answer? no good result in Google searches that i have !! –  saber tabatabaee yazdi Dec 9 '12 at 7:37
add comment

1 Answer

up vote 1 down vote accepted

This is not normal for firewalls, although it is almost like a stateful firewall policy, at least in spirit.

Multicast applications in 2004 (the time when SP2 was released) had many latency issues and various networking 'helps' were put in place to make the experience smoother. I suspect that MS added this 'feature' to assist online multimedia.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.