Windows – What adds these Multicast IPs to the ARP table, as static entries

arpnetworkingwindows 7windows-vista

(Similar to my previous question, but addressing a separate aspect which has gone unanswered.)

I've seen this on my Windows 7 computer, and searches have turned up others in Vista/7 who have seen the same. However, I've not yet found (or perhaps have just missed) a good explanation for this.

These two addresses are static in my ARP table, but I don't know what put them there:

224.0.0.22            01-00-5e-00-00-16     static
224.0.0.252           01-00-5e-00-00-fc     static

I know the ARP table gets updated whenever my computer talks to another system on the subnet, but those entries get added as "dynamic". "Static" entries only get added either by direct user intervention, or by software acting on behalf of the user.

Is there any software known to add these particular addresses, or similar ones, to the table? Is this a normal part of the Windows 7/Vista installation, or would the entries have been added by other software along the way?

Best Answer

224.0.0.22 is a Multicast ip address for Internet Group Management Protocol (IGMP). Most likely this is resulting from either TeamSpeak or Google Talk.

224.0.0.252 is another Multicast address belonging to Link-local Multicast Name Resolution, built-in to Windows:

The Link Local Multicast Name Resolution (or LLMNR) is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link. It is included in Windows Vista, Windows Server 2008 and Windows 7.

These are not Internet addresses, just used in the local network.

Related Question