How do I chase down who is doing a multicast?

ToddAndMargo <[email protected]> Fri, 6 Apr 2018 16:23:05 -0700

Newsgroups	gmane.comp.security.nmap.devel
Message-ID	<[email protected]>

Hi All,

How do I use namp to chase down who is doing a multicast
(224.0.0.252) on my local network.

My Windows Security log is gobsmacked with the following:

Network Information:
	Direction:		Inbound
	Source Address:		224.0.0.252
	Source Port:		5355
	Destination Address:	192.168.202.215
	Destination Port:		52860
	Protocol:		17

This gets me no where:

# nmap -A -T4 -Pn 224.0.0.252

Starting Nmap 7.60 ( https://nmap.org ) at 2018-04-06 16:22 PDT
Nmap done: 1 IP address (0 hosts up) scanned in 0.85 seconds


Many thanks,
-T

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/