I have an isolated Class C network -- that is 192.168.x.x -- that has no access to the Internet.

How would I determine the origin of IP addresses, like 224.0.0.251, or 192.168.122.1? These are addresses that should not be used on my private network. Yet they were blocked by the firewall on my Fedora boxes.

How can I find the source of these addresses so I can remove them or shut down the server?

Or is that a process of elimination I should use? If using that, what services must I leave up so the OS and Gnome doesn't die?

Thank you!

Tom D.

224, if I remember correctly, is a multicast address. IGMP, to be precise.

http://www.networksorcery.com/enp/protocol/igmp.htm

.251, if I remember correctly, is an mDNS query; multicast DNS.

http://files.multicastdns.org/draft-...lticastdns.txt

You're going to get that pretty much whatever you do, so no big deal really.

As for 192.168.122.1? .1's are usually (in an unspoken rule) for gateways. The only way to find the origin of that would be to try an arp on the address and see what the mac address is, and possibly track it down that way. That's my suggestion.

Thanks for the references. That's something I will want to look at.

I've been watching for 192.168.122.1 to appear again and haven't seen it. Thanks for the advice.

Tom D.