Hi there! I’ve been using Comodo for about two years now, love it.
Now, I’m this kind of a person who regularly checks active connections so I notice when something is different. Typically, if I just close all applications, and just stay at desktop, I would have 0 connections. Since two days, there is one connection that always stays and that is 224.0.0.22 or 224.0.0.252 or 239 something(if I terminated one, another would appear). I have been doing quite a bit of research, and those addresses are so called multicasts. So apparently if I understood correctly, they are local and only stay on the local network. What they do is like they make announcements to certain applications or something? I have to say I don’t fully understand what they do or are used for.
I am on a home PC, it’s just my PC, no other device, no other pc, no printer, nothing more connects to my router besides my PC. Every time I turn off my router and back on, the 224.0.0x comes up. So I’ve managed to repeat it. But it was not like this before, in the past, I would have some addresses appear at first but after few minutes they would clear and there would be 0 connections, but not now.
Now my questions are, are those addresses completely harmless? Is there no exploit that can be used through it? I mean, why all of a sudden, I am getting this multicast address that just doesn’t go away? I did not install any new applications, only thing I was messing with a few days ago were android drivers for phone but I don’t think its that? I tried removing anything I could but that address is always there, what is causing it? Also I do have network discovery off, I do have multicast turned off in gpedit.msc (always had).
So for now, I created a firewall rule that blocks IGMP from 224.0.0.0 to 239.255.255.255 and those multicast IPs are now gone, they no longer appear. So is it safe to actually have such a firewall rule? Will it not cause any issues that I blocked it? Though rather than blocking it, I would prefer to know what exactly was causing those IPs to appear in the first place.
Thanks