IGMP/239.255.2.3

[Bruce Summers]

hey folks,

using wireshark to capture some data for my cisco works server...I've noted that there is a huge amount of multicast traffic to 239.255.2.3....

has anybody else seen this? is it normal...seems to be almost every other packet.

[Jon Marshall]

Bruce

This address 239.255.x.x is used by Microsoft Windows 2003 Network Load Balancing. See attached link for more details -

http://support.microsoft.com/kb/283028

Jon

[leekleybm]

Bruce,

I'm not sure if you have this figured out yet, but per RFC 2365 the 239.X.X.X range is the Administratively Scope Multicast range. The group address 239.255.2.3 falls under a further subset called the Local Scope. Read through the RFC to see how the addresses are used in Best Practices, then find the group source in the multicast routing table to begin to determine what the purpose of the group is.