I am reading the book practical packet analysis and I have just learned the fundamentals of the ARP protocol. They also added something about the arp -a cmd command. I'm curious about some of the extra addresses, and I can't find much information about them on the web. I understand that FF:FF:FF:FF:FF:FF means broadcast to all. I'm also aware of the network address and host address combination of the IP address in dottedquad notation and understand the subnet mask.

Although I am still furiously curious about this ARP table. When I enter the commands arp -a This is the output of my CMD:

C:>arp -a

Interface: --- 0xd

Internet Address Physical Address Type a0-21-b7-b0-da-2f dynamic ff-ff-ff-ff-ff-ff static 01-00-5e-00-00-16 static 01-00-5e-00-00-fb static 01-00-5e-00-00-fc static ff-ff-ff-ff-ff-ff static

I am just curious about the last four connections of class D networks. Should these be here normally? Is my computer connecting to something other than the router with the ARP normally? I understand that ARP broadcasts itself to every computer on a network. I'm just curious about this ARP table because the book is lacking an explanation on this. I would love to understand the purpose behind the standard listing of these addresses in my ARP table.

As always please and thank you.

1 Answer 1


Yes, that's normal. Those addresses are in a reserved IP range for multicasting. Multicast can be used by a lot of different things, but in general it's used for streaming data from a broadcast source to multiple clients. Applications can include video streaming, VOIP, and a score of different network discovery protocols.

You can see more information on the addresses you noted here:


The ones you saw specifically:

  • - IGMP
  • - mDNS
  • - Link-local Multicast Name Resolution

.22 is used for managing multicast memberships - multicast broadcasts are often in a "tree" structure, where members can be added/removed depending on if they need/want to be part of the multicast broadcast.

.251 and .252 are for helping your computer resolve names of other computers on your network. You can read more details on implementation here:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .