Is this an ntl server that's sending me port 520 packets?

[Richstant]

Hi,

I've just moved house & set up with ntl broadband. The only issue is that I'm getting loads of packets to port 520 on ip 224.0.0.9 from an ntl ip. Apparently these are packets that routers use to determine traffic routing paths, but I never had them before & have no idea where they've suddenly come from. Does anyone know whether this is from an ntl server, or is it likely just a badly setup router in someones house. The ip resolves to xxx-xxxxx-6-gw.cdif.cable.ntl.com which I assume belongs to some individual?

[Richstant]

I should have mentioned that I'm also getting the same packets from another ip - 10.157.95.254 - which as far as I can work out is an ntl server that I'm directly connected to. I'm getting these packets every 5 seconds!!

[liresa]

Port 520 is for RIP, a protocol used to send routing information around a network. The 224.0.0.9 is the assigned multicast address for RIP-2 packets.
The others look like NTL router addresses - gw may mean gateway, 10.157.95.254 looks like the last address on your network block and so is probably also a router. You can test this by tracerouting to an internet server. e.g. in a Windows command window:

tracert www.ntl.com

The first or second hop, depending on your network setup, may well be the 10.157.95.254

It's nothing to worry about - because NTL's network is so big there are bound to be local differences, be that through slight misconfigurations or differences in network topology requiring different configurations.
The packets are only around 32 bytes long, so don't result in much extra traffic - far more is used by the ARP noise present on the network.

[BBKing]

It means that ntl networks have left RIP running on a cable interface, which is bad practice. They need to set the cable interface you're on to Passive in the RIP config.

However, they probably aren't reading this,