[kw71]

> Also, it may only play UDP packets coming from 234.0.0.2:2046, which would likely mean you would have to convince the DHCP server to assign you that address instead of its intended host.

This does not agree with my understanding.

234.0.0.2 is probably the destination address. I think if a DHCP server gave out an address in this range it would be misconfigured.

In 802.3 and 802.11 I think multicast packets are actually broadcast, so this is why you don't need to join the group.

[runjake]

This is not how multicast traffic works. Yes, 234.0.0.2:2046 is apparently the destination. The receivers probably just listen for this destination address and plays whatever it receives. DHCP server wouldn't matter here.

These multicast packets also aren't L2 broadcast addresses. For more info, see:

https://en.wikipedia.org/wiki/IP_multicast#Layer_2_delivery

[Godel_unicode]

Group membership matters in multicast, although I agree probably not in this case. If there's a hub-spoke topology and you a spoofing on a leaf switch which doesn't propagate this could be a fun problem for engineering (looking up and reading about IGMP is left as an exercise for the reader)

[chris_wot]

Well, it doesn't appear that IP spoofing has been setup too well on the switches, because the switch seems to be doing what either an el cheapo switch will do, or do what Cisco switches do which is take the multicast traffic and flood it out the vlan broadcast domain.

Hell, if that's UDP traffic it doesn't necessarily even look like it requires a response, so you could spoof the source IP address and the server might not even care...