mDNS flooding from different ip

I have noticed this mDNS query comming from different ip on my local network that goes to my arp cache224.0.0.251

image description

image description

is this supposed to be normal?

ropenrom24's avatar
1
ropenrom24
asked 2020-04-15 03:47:34 +0000
edit flag offensive 0 remove flag close merge delete

Comments

multicast address 224.0.0.251 is used by mDNS

https://developers.google.com/cast/do...
What type of device is 192.168.1.6?
How was the packet capture done?
Weird that you seem to be getting eight (8) copies of the discovery messages.
Chromecast MDNS

Chuckc's avatar Chuckc (2020-04-15 05:28:42 +0000) edit
more
  • delete

Its an android device and its slowing my router latency I am getting 3ms to 400ms+ spike.





does my device causing this or the chromecast? it seems that its a request from the android device though

ropenrom24's avatar ropenrom24 (2020-04-15 07:47:22 +0000) edit
more
  • delete

Can you provide a pcap with one of the packets?
Or update with info from the IP and UDP layers?

Chuckc's avatar Chuckc (2020-04-15 13:55:13 +0000) edit
more
  • delete

I did not really understand what you meant but here is the wireshark capture file. https://ufile.io/kbqp7mvz Im sorry not really sure what im doing

ropenrom24's avatar ropenrom24 (2020-04-15 14:17:03 +0000) edit
more
  • delete

btw my IP is 192.168.1.200 and the rest are just android devices

ropenrom24's avatar ropenrom24 (2020-04-15 14:18:45 +0000) edit
more
  • delete
add a comment see more comments