A lot of EGP protocol traffic

Hi,

we're now logging to an external syslog server.

When we analyze the received data, we get a lot of these:

Allowed "EGP" protocol traffic from ...

Now it seems that the default rule "Allow IGMP" triggers this, but if I check the traffic, it seems it's all multicast.

Is this default behaviour that it's marked as EGP? Where does it get its description? Is it adjustable?

Thanks for any info,

Peter