Home / server / Questions / 569359
Accepted
AEGIS
Asked: 2014-01-24 06:22:35 +0800 CST

Networking ARP table in windows cmd

  • 772

I am reading the book practical packet analysis and I have just learned the fundamentals of the ARP protocol. They also added something about the arp -a cmd command. I'm curious about some of the extra addresses, and I can't find much information about them on the web. I understand that FF:FF:FF:FF:FF:FF means broadcast to all. I'm also aware of the network address and host address combination of the IP address in dottedquad notation and understand the subnet mask.

Although I am still furiously curious about this ARP table. When I enter the commands arp -a This is the output of my CMD:

C:>arp -a

Interface: 192.168.1.4 --- 0xd

Internet Address Physical Address Type

192.168.1.1 a0-21-b7-b0-da-2f dynamic

192.168.1.255 ff-ff-ff-ff-ff-ff static

224.0.0.22 01-00-5e-00-00-16 static

224.0.0.251 01-00-5e-00-00-fb static

224.0.0.252 01-00-5e-00-00-fc static

255.255.255.255 ff-ff-ff-ff-ff-ff static

I am just curious about the last four connections of class D networks. Should these be here normally? Is my computer connecting to something other than the router with the ARP normally? I understand that ARP broadcasts itself to every computer on a network. I'm just curious about this ARP table because the book is lacking an explanation on this. I would love to understand the purpose behind the standard listing of these addresses in my ARP table.

As always please and thank you.

windows

1 Answers

  1. Best Answer

    Yes, that's normal. Those addresses are in a reserved IP range for multicasting. Multicast can be used by a lot of different things, but in general it's used for streaming data from a broadcast source to multiple clients. Applications can include video streaming, VOIP, and a score of different network discovery protocols.

    You can see more information on the addresses you noted here:

    http://www.iana.org/assignments/multicast-addresses/multicast-addresses.xml#multicast-addresses-1

    The ones you saw specifically:

    • 224.0.0.22 - IGMP
    • 224.0.0.251 - mDNS
    • 224.0.0.252 - Link-local Multicast Name Resolution

    .22 is used for managing multicast memberships - multicast broadcasts are often in a "tree" structure, where members can be added/removed depending on if they need/want to be part of the multicast broadcast.

    .251 and .252 are for helping your computer resolve names of other computers on your network. You can read more details on implementation here:

    http://technet.microsoft.com/en-us/library/bb878128.aspx

    • 2