Hi there! I’ve been using Comodo for about two years now, love it.

Now, I’m this kind of a person who regularly checks active connections so I notice when something is different. Typically, if I just close all applications, and just stay at desktop, I would have 0 connections. Since two days, there is one connection that always stays and that is or or 239 something(if I terminated one, another would appear). I have been doing quite a bit of research, and those addresses are so called multicasts. So apparently if I understood correctly, they are local and only stay on the local network. What they do is like they make announcements to certain applications or something? I have to say I don’t fully understand what they do or are used for.

I am on a home PC, it’s just my PC, no other device, no other pc, no printer, nothing more connects to my router besides my PC. Every time I turn off my router and back on, the 224.0.0x comes up. So I’ve managed to repeat it. But it was not like this before, in the past, I would have some addresses appear at first but after few minutes they would clear and there would be 0 connections, but not now.

Now my questions are, are those addresses completely harmless? Is there no exploit that can be used through it? I mean, why all of a sudden, I am getting this multicast address that just doesn’t go away? I did not install any new applications, only thing I was messing with a few days ago were android drivers for phone but I don’t think its that? I tried removing anything I could but that address is always there, what is causing it? Also I do have network discovery off, I do have multicast turned off in gpedit.msc (always had).

So for now, I created a firewall rule that blocks IGMP from to and those multicast IPs are now gone, they no longer appear. So is it safe to actually have such a firewall rule? Will it not cause any issues that I blocked it? Though rather than blocking it, I would prefer to know what exactly was causing those IPs to appear in the first place.


As long as your behind a router they are safe to allow.

But why did they suddenly appear, and is it not safe to just block multicast?

There are several multicast addresses.
Depend on the needs of the software.