Eu vejo entradas ARP para os endereços IP 224.0.0.22 , 224.0.0.251 e 224.0.0.252
Eles são Endereços multicast :
A multicast address is a logical identifier for a group of hosts in a computer network, that are available to process datagrams or frames intended to be multicast for a designated network service.
Multicast addressing can be used in the Link Layer (Layer 2 in the OSI model), such as Ethernet multicast, and at the Internet Layer (Layer 3 for OSI) for Internet Protocol Version 4 (IPv4) or Version 6 (IPv6) multicast.
Mais informações são fornecidas abaixo, mas esse tipo de atividade é normal.
O que é 224.0.0.22 ?
224.0.0.22 é um endereço do Protocolo de Gerenciamento de Grupo da Internet (IGMP) versão 3 .
Este é o tráfego normal e permanece na sua rede local.
The Internet Group Management Protocol (IGMP) is a communications protocol used by hosts and adjacent routers on IPv4 networks to establish multicast group memberships. IGMP is an integral part of IP multicast.
IGMP can be used for one-to-many networking applications such as online streaming video and gaming, and allows more efficient use of resources when supporting these types of applications.
IGMP is used on IPv4 networks.
Fonte Protocolo de Gerenciamento de Grupo da Internet (IGMP) versão 3
O que é 224.0.0.251 ?
224.0.0.251 é um endereço DNS multicast (mDNS) .
the multicast Domain Name System (mDNS) resolves host names to IP addresses within small networks that do not include a local name server.
It is a zero-configuration service, using essentially the same programming interfaces, packet formats and operating semantics as the unicast Domain Name System (DNS).
Fonte DNS multicast (mDNS)
I've seen those types of requests before - those certainly look much like Bonjour / mDNS requests to me. They use multicast IP address 224.0.0.251 and port 5353.
The most likely source for this is Apple iTunes, which as you know comes pre-installed on Mac computers and is a popular install on Windows machines.
UPDATE: if this is a Linux box (not a Mac or Windows box), that's probably the Avahi daemon then. Its ZeroConf/Bonjour compatible. Its installed by default, but if you don't use DNS-SD or mDNS, it can be disabled.
Fonte o que faz o multicast no 224.0. 0.251? responda por suman
O que é 224.0.0.252 ?
224.0.0.252 é um endereço de resolução de nomes de multidifusão local (LLMNR) .
The Link-Local Multicast Name Resolution (LLMNR) is a protocol based on the Domain Name System (DNS) packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link.
It is included in Windows Vista, Windows Server 2008, Windows 7, Windows 8 and Windows 10. It is also implemented by systemd-resolved on Linux.
LLMNR is defined in RFC 4795.
Fonte Resolução de nomes de multidifusão link local (LLMNR)