4

I have these entries, starting with 224 on my computer and on the virtual machines, they cannot be deleted nor modified. Why is that happening. I am running Win 8.1

C:\WINDOWS\system32>arp -a

Interface: 192.168.1.78 --- 0x4
Internet Address      Physical Address      Type
192.168.1.1           9c-97-26-4e-58-a2     dynamic
192.168.1.255         ff-ff-ff-ff-ff-ff     static
224.0.0.22            01-00-5e-00-00-16     static
224.0.0.251           01-00-5e-00-00-fb     static
224.0.0.252           01-00-5e-00-00-fc     static
239.255.255.250       01-00-5e-7f-ff-fa     static
255.255.255.255       ff-ff-ff-ff-ff-ff     static

Interface: 169.254.133.85 --- 0xa
Internet Address      Physical Address      Type
169.254.255.255       ff-ff-ff-ff-ff-ff     static
224.0.0.22            01-00-5e-00-00-16     static
224.0.0.251           01-00-5e-00-00-fb     static
224.0.0.252           01-00-5e-00-00-fc     static
239.255.255.250       01-00-5e-7f-ff-fa     static
255.255.255.255       ff-ff-ff-ff-ff-ff     static

Interface: 169.254.56.140 --- 0xb
Internet Address      Physical Address      Type
169.254.255.255       ff-ff-ff-ff-ff-ff     static
224.0.0.22            01-00-5e-00-00-16     static
224.0.0.251           01-00-5e-00-00-fb     static
224.0.0.252           01-00-5e-00-00-fc     static
239.255.255.250       01-00-5e-7f-ff-fa     static

Interface: 169.254.193.129 --- 0xc
Internet Address      Physical Address      Type
169.254.255.255       ff-ff-ff-ff-ff-ff     static
224.0.0.22            01-00-5e-00-00-16     static
224.0.0.251           01-00-5e-00-00-fb     static
224.0.0.252           01-00-5e-00-00-fc     static
239.255.255.250       01-00-5e-7f-ff-fa     static
Improve this question
2
  • Physical (MAC) addresses starting with 01-00-5e are standard multicast addresses. Nothing to worry about here, me thinks.
    – Patrick Seymour
    Apr 10, 2016 at 12:45
  • If they were the result of ARP poisoning, the entry would be "dynamic".
    – Daniel B
    Apr 10, 2016 at 12:56

1 Answer 1

Reset to default
3

I see ARP entries for the IP addresses 224.0.0.22, 224.0.0.251 and 224.0.0.252

They are Multicast addresses:

A multicast address is a logical identifier for a group of hosts in a computer network, that are available to process datagrams or frames intended to be multicast for a designated network service.

Multicast addressing can be used in the Link Layer (Layer 2 in the OSI model), such as Ethernet multicast, and at the Internet Layer (Layer 3 for OSI) for Internet Protocol Version 4 (IPv4) or Version 6 (IPv6) multicast.

Further information is provided below, but this kind of activity is normal.

What is 224.0.0.22?

224.0.0.22 is a Internet Group Management Protocol (IGMP) version 3 address.

This is normal traffic, and it stays on your local network.

The Internet Group Management Protocol (IGMP) is a communications protocol used by hosts and adjacent routers on IPv4 networks to establish multicast group memberships. IGMP is an integral part of IP multicast.

IGMP can be used for one-to-many networking applications such as online streaming video and gaming, and allows more efficient use of resources when supporting these types of applications.

IGMP is used on IPv4 networks.

Source Internet Group Management Protocol (IGMP) version 3

What is 224.0.0.251?

224.0.0.251 is a Multicast DNS (mDNS) address.

the multicast Domain Name System (mDNS) resolves host names to IP addresses within small networks that do not include a local name server.

It is a zero-configuration service, using essentially the same programming interfaces, packet formats and operating semantics as the unicast Domain Name System (DNS).

Source Multicast DNS (mDNS)

I've seen those types of requests before - those certainly look much like Bonjour / mDNS requests to me. They use multicast IP address 224.0.0.251 and port 5353.

The most likely source for this is Apple iTunes, which as you know comes pre-installed on Mac computers and is a popular install on Windows machines.

UPDATE: if this is a Linux box (not a Mac or Windows box), that's probably the Avahi daemon then. Its ZeroConf/Bonjour compatible. Its installed by default, but if you don't use DNS-SD or mDNS, it can be disabled.

Source what is the multicast doing on 224.0.0.251? answer by suman

What is 224.0.0.252?

224.0.0.252 is a Link-local Multicast Name Resolution (LLMNR) address.

The Link-Local Multicast Name Resolution (LLMNR) is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link.

It is included in Windows Vista, Windows Server 2008, Windows 7, Windows 8 and Windows 10. It is also implemented by systemd-resolved on Linux.

LLMNR is defined in RFC 4795.

Source Link-local Multicast Name Resolution (LLMNR)

Further Reading

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .