0

I want to find the IP of the Multicast Groups I have joined. But, all the IP's obtained from netstat -ng are these:

root@me:~# netstat -ng
IPv6/IPv4 Group Memberships
Interface       RefCnt Group
--------------- ------ ---------------------
lo              1      224.0.0.1
enp2s0          1      224.0.0.1
wlp1s0          1      224.0.0.251
wlp1s0          1      224.0.0.1
lo              1      ff02::1
lo              1      ff01::1
enp2s0          1      ff02::1
enp2s0          1      ff01::1
wlp1s0          1      ff02::1:ff00:1002
wlp1s0          1      ff02::1:ffec:fbef
wlp1s0          1      ff02::1:ff46:409f
wlp1s0          1      ff02::1:ff2f:ca73
wlp1s0          1      ff02::1

all these IPs are generic (all nodes and similars) and I want to know in which network exactly i'm in. I found something with nmap tho:

root@me:~# nmap --script broadcast-igmp-discovery lo

Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-25 22:12 -03
Pre-scan script results:
| broadcast-igmp-discovery: 
|   192.168.0.80
|     Interface: wlp1s0
|     Version: 2
|     Group: 224.0.0.251
|     Description: mDNS (rfc6762)
|   192.168.0.80
|     Interface: wlp1s0
|     Version: 2
|     Group: 224.0.0.252
|     Description: Link-local Multicast Name Resolution (rfc4795)
|   192.168.0.80
|     Interface: wlp1s0
|     Version: 2
|     Group: 239.255.255.250
|     Description: Organization-Local Scope (rfc2365)
|_  Use the newtargets script-arg to add the results as targets
Failed to resolve "lo".
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 8.13 seconds

what do you guys think?

1 Answer 1

0

I think you may be confused about what "multicast IP" and "join" means.

Your netstat -ng (BTW, netstat, route, ifconfig, bridge etc. have been superseeded by ip, try ip maddress, which will give you the same output...) shows all the multicast IP groups you have joined. That these are just local multicast ranges is because so far, you've only joined local multicast groups by default. If you'd run mDNS (e.g. avahi), you'd also see 224.0.0.251. If you'd explicitely have joined other multicast groups e.g. by streaming video content, you'd also see those.

But you haven't, so you don't see them.

For multicast groups, there is no "network which I am in". If you want to play around with multicast groups, have e.g. a look at ssmping, asmping, and smcroute. Or any of the other many multicast tools.

If you want to know the "network you are in", you must look for the subnet ranges (which correspond to the broadcast range, not a multicast group) you get e.g. with ip addr.

(And generic Kali rant: Kali is not "what all the hackers use", nor "what all the experts use". No matter what you read in some forums. Kali is used for penetration testing: You install it on an USB stick, walk into a company, and hack their computers. It's not meant to learn hacking. It's not meant to be run on a VM (though many people do for some reason). It's not meant for daily work.

You are much better off getting an ordinary Linux distribution (e.g. Ubuntu, if you like Kali, because Kali is also Debian-based) to learn networking. You'll have all the hacking tools Kali has (though you have to install them), and none of the trouble Kali usually causes.

Also, please read this).

2
  • i'm not using kali I just thought the pentesters would be able to tell me what was going on. Still, thanks for taking your time this answer cleared a lot for me.
    – mranon
    Jul 28, 2019 at 8:31
  • Kali tag removed from question.
    – dirkt
    Jul 28, 2019 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.