mDNS flooding from different ip

asked 2020-04-15 03:47:34 +0000

ropenrom24 gravatar image

I have noticed this mDNS query comming from different ip on my local network that goes to my arp cache224.0.0.251

image description

image description

is this supposed to be normal?

edit retag flag offensive close merge delete


multicast address is used by mDNS
What type of device is
How was the packet capture done?
Weird that you seem to be getting eight (8) copies of the discovery messages.
Chromecast MDNS

Chuckc gravatar imageChuckc ( 2020-04-15 05:28:42 +0000 )edit

Its an android device and its slowing my router latency I am getting 3ms to 400ms+ spike.

does my device causing this or the chromecast? it seems that its a request from the android device though

ropenrom24 gravatar imageropenrom24 ( 2020-04-15 07:47:22 +0000 )edit

Can you provide a pcap with one of the packets?
Or update with info from the IP and UDP layers?

Chuckc gravatar imageChuckc ( 2020-04-15 13:55:13 +0000 )edit

I did not really understand what you meant but here is the wireshark capture file. Im sorry not really sure what im doing

ropenrom24 gravatar imageropenrom24 ( 2020-04-15 14:17:03 +0000 )edit

btw my IP is and the rest are just android devices

ropenrom24 gravatar imageropenrom24 ( 2020-04-15 14:18:45 +0000 )edit