mDNS flooding from different ip

asked 2020-04-15 03:47:34 +0000

ropenrom24 gravatar image

I have noticed this mDNS query comming from different ip on my local network that goes to my arp cache224.0.0.251

image description

image description

is this supposed to be normal?

edit retag flag offensive close merge delete

Comments

multicast address 224.0.0.251 is used by mDNS

https://developers.google.com/cast/do...
What type of device is 192.168.1.6?
How was the packet capture done?
Weird that you seem to be getting eight (8) copies of the discovery messages.
Chromecast MDNS

Chuckc gravatar imageChuckc ( 2020-04-15 05:28:42 +0000 )edit

Its an android device and its slowing my router latency I am getting 3ms to 400ms+ spike.





does my device causing this or the chromecast? it seems that its a request from the android device though

ropenrom24 gravatar imageropenrom24 ( 2020-04-15 07:47:22 +0000 )edit

Can you provide a pcap with one of the packets?
Or update with info from the IP and UDP layers?

Chuckc gravatar imageChuckc ( 2020-04-15 13:55:13 +0000 )edit

I did not really understand what you meant but here is the wireshark capture file. https://ufile.io/kbqp7mvz Im sorry not really sure what im doing

ropenrom24 gravatar imageropenrom24 ( 2020-04-15 14:17:03 +0000 )edit

btw my IP is 192.168.1.200 and the rest are just android devices

ropenrom24 gravatar imageropenrom24 ( 2020-04-15 14:18:45 +0000 )edit
see more comments