4

(Similar to my previous question, but addressing a separate aspect which has gone unanswered.)

I've seen this on my Windows 7 computer, and searches have turned up others in Vista/7 who have seen the same. However, I've not yet found (or perhaps have just missed) a good explanation for this.

These two addresses are static in my ARP table, but I don't know what put them there:

224.0.0.22            01-00-5e-00-00-16     static
224.0.0.252           01-00-5e-00-00-fc     static

I know the ARP table gets updated whenever my computer talks to another system on the subnet, but those entries get added as "dynamic". "Static" entries only get added either by direct user intervention, or by software acting on behalf of the user.

Is there any software known to add these particular addresses, or similar ones, to the table? Is this a normal part of the Windows 7/Vista installation, or would the entries have been added by other software along the way?

Improve this question
2
  • I'm not sure about the specifics, but Link Layer Topology Discovery in Win7/Vista works by generating random MACs to "map" the network. I don't know if they appear as static or dynamic.
    – Greg
    Commented Dec 9, 2010 at 16:02
  • Aaand I was wrong, the range of MAC addresses for LLTD is completely different.
    – Greg
    Commented Dec 9, 2010 at 16:08

3 Answers 3

Reset to default
6
+50

224.0.0.22 is a Multicast ip address for Internet Group Management Protocol (IGMP). Most likely this is resulting from either TeamSpeak or Google Talk.

224.0.0.252 is another Multicast address belonging to Link-local Multicast Name Resolution, built-in to Windows:

The Link Local Multicast Name Resolution (or LLMNR) is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. It is included in Windows Vista, Windows Server 2008 and Windows 7.

These are not Internet addresses, just used in the local network.

Improve this answer
4
  • Thanks! Finally someone answers this! I don't have Google Talk installed, but I do have Trillian with the Google Talk plugin.
    – Iszi
    Commented Dec 16, 2010 at 16:21
  • @Iszi: If this answers your question, you should accept it. Just a reminder that assigning the bounty is a separate action.
    – harrymc
    Commented Dec 19, 2010 at 17:14
  • Thanks. I prefer to give these a little time to simmer, but it seems you're the only one covering it. I thought bounties had an auto-award policy on expiration, anyway? EDIT: They do. Highest-voted answer created after the bounty was posted, with at least 2 up-votes.
    – Iszi
    Commented Dec 20, 2010 at 6:28
  • @Iszi: Auto-award only awards half of the bounty. The other half is simply lost.
    – harrymc
    Commented Dec 20, 2010 at 7:22
1

Did you install GoogleTalk or TeamSpeak recently? They add those entries...

Improve this answer
0

My company's VPN (SonicWALL SSL-VPN NetExtender) creates these entries when I connect. It does not remove them when I disconnect from the VPN.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .