6

I'd like to disable the TCP/IP stack's support for multicast completely on Windows for diagnostic purposes. How do I do this?

I'm looking to do this on Windows XP, but if none can be provided, instructions for other versions are acceptable, too (Server and Client SKUs, all variations, across versions as well).

4
  • What if you load a linux virtual machine and it becomes a question of how to do it in linux. There is a program called netsed which can change packets, do a find and replace on packets.. so you could stop it that way but would be messy. Or a firewall that lets you specify things within a packet. Linux should have something – barlop Jul 26 '14 at 10:12
  • Perhaps you can include a quick way to test whether it is so. e.g. to quickly generate an IGMP packet. or to test receipt of one. – barlop Jul 26 '14 at 10:44
  • i'm still interested if you mention what diagnostic test you used to test if IGMP was enabled or disabled – barlop May 3 '15 at 11:06
  • 1
    I used Wireshark to confirm it ("test receipt"). Windows XP generated multicast group messages periodically when the functionality was enabled. – user314104 May 8 '15 at 18:10
4

The Win7 firewall has an option about blocking IGMP

inbound rules, new rule, Custom, choose Protocol, then choose IGMP. outbound rules, new rule, ditto

I see no such option in the XP firewall. It knows of ICMP but not IGMP.

The following is kind of in Morbid's answer

win7

http://technet.microsoft.com/en-us/library/cc957547.aspx HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IGMPLevel <-- set to 0 that is kind of within morbid's "answer".

Set IGMPLevel to 0

WinXP

http://support.microsoft.com/kb/314053/en-gb

all the TCP/IP parameters are registry values that are located under one of two different subkeys of

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ID for Adapter

At those keys, set IGMPLevel to 0


I haven't tested it though, and on my systems, On my Win7 system or my XP system.. While the keys are there, the name (IGMPLevel) isn't in my registry at those keys. So in my case i'd have to create it.

1
  • 1
    I tested setting IGMPLevel to 0. This seemed to have worked for what I wanted. Thank you. – user314104 Jul 27 '14 at 2:43
0

*Updated to reflect answer as to correct my mistake reading question properly. ;) 2014.07.25

How do I disable multicast on the TCP/IP stack for Windows?

I'd like to disable the TCP/IP stack's support for multicast completely on Windows for diagnostic purposes. How do I do this?

I'm looking to do this on Windows XP, but if none can be provided, instructions for other versions are acceptable, too (Server and Client SKUs, all variations, across versions as well).

seems i disregarded the multicast part my bad been up for awhile.. as far as multicast goes seems you have some options:

as to here refer: Force Windows 7 SP1 to disable Multicast on the NICs

and here: TCP/IP and NBT Configuration Parameters for Windows XP (Q314053)

SUMMARY

This article defines all of the registry parameters that are used to configure the protocol driver, Tcpip.sys, that implements the standard TCP/IP network protocols.

The TCP/IP protocol suite implementation for Windows XP reads all of its configuration data from the registry. This information is written to the registry by the Network tool in Control Panel as part of the Setup process. Some of this information is also supplied by the Dynamic Host Configuration Protocol (DHCP) Client service if the DHCP Client service is enable... Read More.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT or Windows 2000, you should also update your Emergency Repair Disk (ERD).

To change these parameters, use the following procedure:

Start Registry Editor (Regedit.exe).

From the HKEY_LOCAL_MACHINE subtree, go to the following key:

    >\SYSTEM\CurrentControlSet\Services 

Add a value to the key as described in the appropriate 
entry below by clicking Add Value on the Edit menu, typing 
the value, and then setting the value type under Data Type .

Click OK .

Quit Registry Editor.

Restart the computer to make the change take effect.

All of the TCP/IP parameters are registry values that are located under one of two different subkeys of

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Tcpip\Parameters
Tcpip\Parameters\Interfaces\ ID for Adapter 

where ID for Adapter represents the network adapter that TCP/IP is bound to. The relationship between an Adapter ID and Network Connection can be determined by examining HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network{4D36E972-E325-11CE-BFC1-08002BE10318}\ ID for Adapter \Connection. The Name value in these keys provides the friendly name for a network connection used in the Network Connections folder. Values under the latter keys are specific to each adapter. Parameters for which there may be both a DHCP and statically configured value may or may not exist, depending on whether the system/adapter is DHCP configured and whether static override values have been specified. A restart of the system is required for a change in any of these parameters to take effect...

This is the Key you are looking for I Believe:

>IGMPLevel

    Key: Tcpip\Parameters
    Value Type: REG_DWORD - Number
    Valid Range: 0,1,2
    Default: 2

This parameter determines to what extent the system supports IP multicasting and participates in the Internet Group Management Protocol. At level 0, the system provides no multicast support. At level 1, the system can only send IP multicast packets. At level 2, the system can send IP multicast packets and fully participate in IGMP to receive multicast packets.

You should set the registry key to 0 to have no multicast support.


hope that this helps a bit more than the previous answer. lol :)


Edited please disregard below:


Answer to question "How do I disable TCP/IP stack for Windows?":

You can't! You can re-install or reset.

"In Windows XP, the TCP/IP stack is considered a core component of the operating system, and you cannot remove TCP/IP."

"In extreme cases, the best solution for this issue may be to reinstall the IP stack. But with the NetShell utility, you can reset the TCP/IP stack to restore it to its state that existed when the operating system was installed"

http://support.microsoft.com/kb/299357

refer here: http://www.techrepublic.com/forums/questions/how-to-uninstall-tcp-ip-in-win-xp/post-6ca59f30-d1ff-11e2-bc00-02911874f8c8/

also refer here: "How to Disable Windows TCP/IP Stack in VC++ [Programmatically]" as quoted below...

How to Disable Windows TCP/IP Stack in VC++ [Programmatically]

wanted to know How to Disable Windows TCP/IP Stack in VC++ [ Programmatically ].

We are doing some raw socket programming using winpcap. So our application does not need Windows TCP/IP Stack and We Want to uninstall it the moment our application starts.

Please help.

Thanks in Advance.


The TCP/IP stack is an essential part of any modern OS, including recent versions of MS Windows. As explained on MS knowlegebase Q299357 (speaking about Win XP):

Because TCP/IP is a core component of Windows, you cannot remove it.

At any rate, even if it were possible, no program that uses TCP/IP (which is most modern softtware, since most contain some kind of net integration, auto update etc.) would work, and most would probably fail in mysterious ways, since no one tested that configuration.

So the short answer is: Don't do it.

Maybe you could explain why you feel it necessary to remove TCP/IP networking? Then we might be able to help you.

Edit:

Based on your comment below, if you want bypass/disable the ARP handling of the TCP/IP stack, then WinPcap should let you do that. If not, you probably need to write your own Windows network driver. Again, this seems extremely complicated and intrusive. Could you please describe what your application does and why you even need to mess around with low-level networking?

Seems futile my friend if their is an answer to your question it is no, you cant.

1
  • You might want to read the question again. I'm not asking to disable the TCP/IP stack; I'm just asking to disable the multicast portion of it. – user314104 Jul 26 '14 at 7:43
0

I was looking on the XP registry for those keys and I could not find them, so I found a better solution:

In an elevated Command Prompt:

C:\Windows\system32> netsh
netsh>firewall
netsh firewall>set multicastbroadcastresponse disable
netsh firewall>set multicastbroadcastresponse mode=disable profile=all

To check up if config is OK, write:

netsh firewall>show multicastbrodcastresponse

netsh windowsxp

Source: Microsoft Website – “Netsh Commands for Windows Firewall”

The IGMPLevel registry key , does not exist in XP , like the image shows above . However , this registry key must be created to exist .

No IGMPLevel Registry key - Windows XP

Unless , the registry key in XP is : "UseZeroBroadcast" . Anyway like told before it works in my XP , at least wireshark does not detect broadcast packets to 224.0.0.1 or to 239.255.255.255 .

IMPORTANT: netsh firewall is deprecated in more recent versions of Windows; use netsh advfirewall firewall instead.  For more information on using netsh advfirewall firewall commands instead of netsh firewall, see KB article 947709: “How to use the netsh advfirewall firewall context instead of the netsh firewall context to control Windows Firewall behavior in Windows Server 2008 and in Windows Vista”.

2
  • I've edited in the contents of your other answer but the image was much too small to see. Feel free to edit in that image. imgur is the preferred image host here. – Journeyman Geek Nov 19 '15 at 0:14
  • Doing this makes your connection useless. – Codebeat Jun 6 '16 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.