Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

(Similar to my previous question, but addressing a separate aspect which has gone unanswered.)

I've seen this on my Windows 7 computer, and searches have turned up others in Vista/7 who have seen the same. However, I've not yet found (or perhaps have just missed) a good explanation for this.

These two addresses are static in my ARP table, but I don't know what put them there:

224.0.0.22            01-00-5e-00-00-16     static
224.0.0.252           01-00-5e-00-00-fc     static

I know the ARP table gets updated whenever my computer talks to another system on the subnet, but those entries get added as "dynamic". "Static" entries only get added either by direct user intervention, or by software acting on behalf of the user.

Is there any software known to add these particular addresses, or similar ones, to the table? Is this a normal part of the Windows 7/Vista installation, or would the entries have been added by other software along the way?

share|improve this question
    
I'm not sure about the specifics, but Link Layer Topology Discovery in Win7/Vista works by generating random MACs to "map" the network. I don't know if they appear as static or dynamic. –  Greg Dec 9 '10 at 16:02
    
Aaand I was wrong, the range of MAC addresses for LLTD is completely different. –  Greg Dec 9 '10 at 16:08
add comment

3 Answers

up vote 5 down vote accepted
+50

224.0.0.22 is a Multicast ip address for Internet Group Management Protocol (IGMP). Most likely this is resulting from either TeamSpeak or Google Talk.

224.0.0.252 is another Multicast address belonging to Link-local Multicast Name Resolution, built-in to Windows:

The Link Local Multicast Name Resolution (or LLMNR) is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. It is included in Windows Vista, Windows Server 2008 and Windows 7.

These are not Internet addresses, just used in the local network.

share|improve this answer
    
Thanks! Finally someone answers this! I don't have Google Talk installed, but I do have Trillian with the Google Talk plugin. –  Iszi Dec 16 '10 at 16:21
    
@Iszi: If this answers your question, you should accept it. Just a reminder that assigning the bounty is a separate action. –  harrymc Dec 19 '10 at 17:14
    
Thanks. I prefer to give these a little time to simmer, but it seems you're the only one covering it. I thought bounties had an auto-award policy on expiration, anyway? EDIT: They do. Highest-voted answer created after the bounty was posted, with at least 2 up-votes. –  Iszi Dec 20 '10 at 6:28
    
@Iszi: Auto-award only awards half of the bounty. The other half is simply lost. –  harrymc Dec 20 '10 at 7:22
add comment

Did you install GoogleTalk or TeamSpeak recently? They add those entries...

share|improve this answer
add comment

My company's VPN (SonicWALL SSL-VPN NetExtender) creates these entries when I connect. It does not remove them when I disconnect from the VPN.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.