I´m trying to analyze my networktraffic and I´m not a networking pro, so I got some questions regarding the traffic. If there are stupid I apologize in front.
The first thing I see are three IGMP Messages. 192.168.2.1 220.127.116.11 IGMP 62 V3 Membership Report /Join group 18.104.22.168 for any sources / Join group 22.214.171.124 for any sources
10.0.0.0 126.96.36.199 IGMP 60 v3 Membership Query, general
192.168.2.1 188.8.131.52 IGMP 62 port /Join group 184.108.40.206 for any sources / Join group 220.127.116.11 for any sources
the first and third one are marked black, so there is an error, despite I don´t really know why.
So, I figured out IGMP has something to do with broadcasting and I figured out the IGMP messages are send at the start of the capture no matter when I start them. So I assume the have something to do with Wireshark.
The next thin I assume is, that every time I start wireshark it is looking for some broadcast groups. Since it´s marked false, I assume that nobody is answering. So wireshark tries but with no success.
So, could you please let me know what this have to do with wireshark, I know I don´t have a clue about the stuff, but I couldn´t find anythin on the internet.
asked 25 Nov '11, 04:30
Google is your friend here. These are multicast addresses.
So, if you look them up they say:
So these all have to do with name resolving. And indeed that's something Wireshark does use, so that makes sense.
answered 25 Nov '11, 11:34
When resolving names, what Wireshark is doing is attempting to translate IP addresses to names; it does so either by calling the host operating system's routines or by using the ADNS or C-ARES name resolution packages. Perhaps whichever one of those is being used sends out LLMNR packets.
Wireshark itself does not explicitly try to join any multicast groups; it puts the network adapter into promiscuous mode so that it can see all traffic sent on the network port into which the network adapter is plugged. Perhaps, in some OSes, the networking stack will attempt to join multicast groups if the adapter is put into promiscuous mode, in the hopes of convincing a switch to send multicast traffic for those groups to the port in question.
18.104.22.168 is an IP address for IGMP v3.
answered 26 Nov '11, 12:08
Guy Harris ♦♦