Unanswered Question
May 22nd, 2009
User Badges:

hey folks,

using wireshark to capture some data for my cisco works server...I've noted that there is a huge amount of multicast traffic to

has anybody else seen this? is it normal...seems to be almost every other packet.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Fri, 05/22/2009 - 13:55
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


This address 239.255.x.x is used by Microsoft Windows 2003 Network Load Balancing. See attached link for more details -



leekleybm Sun, 06/14/2009 - 06:05
User Badges:


I'm not sure if you have this figured out yet, but per RFC 2365 the 239.X.X.X range is the Administratively Scope Multicast range. The group address falls under a further subset called the Local Scope. Read through the RFC to see how the addresses are used in Best Practices, then find the group source in the multicast routing table to begin to determine what the purpose of the group is.


This Discussion