Why does 224.0.0.1 appear constantly in my packet capture?

Routers send IGMP membership queries to it to learn which multicast groups hosts still want. The interval is typically once every 60 to 125 seconds per link.

Can I ping 224.0.0.1?

On Linux and macOS the ping goes out and hosts on the link may reply, which is a quick way to enumerate neighbours. Windows does not reply to it, and many devices ignore it.

What is the difference between 224.0.0.1 and 224.0.0.2?

224.0.0.1 is all hosts. 224.0.0.2 is all routers. Both are in the local network control block and neither is forwarded.

Is multicast the same as broadcast?

No. A broadcast interrupts every host. A multicast only reaches hosts that joined the group, except for the well-known groups such as 224.0.0.1 that everyone joins by definition.

224.0.0.1: all hosts multicast

224.0.0.1 is the all-hosts multicast group. Every host that speaks IPv4 multicast on a link is a member, and packets sent to it reach all of them. It sits in the local network control block, so routers never forward it beyond the link it was sent on.

multicast224.0.0.1

Operated by Reserved by IANA, registry defined in RFC 5771.

Live data

Fetched now, cached at the edge

Classification: multicast (RFC 5771)

Multicast. One sender reaching a group of subscribers. There is no registry entry, no reverse DNS and no reputation to look up for a reserved address, so this page shows the classification only.

Registry data from RDAP. Reverse DNS and blocklist checks over DNS-over-HTTPS. Run a full lookup on 224.0.0.1.

Where it sits in the multicast map

RFC 5771 sets out how IANA assigns IPv4 multicast addresses. The whole of 224.0.0.0/4, from 224.0.0.0 to 239.255.255.255, is multicast space, and it is divided into blocks with different rules.

Block	Name	Behaviour
`224.0.0.0/24`	Local Network Control	Never forwarded by routers, TTL is set to 1
`224.0.1.0/24`	Internetwork Control	Forwardable, used by NTP and similar
`232.0.0.0/8`	Source-Specific Multicast	Receiver names the source it wants
`239.0.0.0/8`	Administratively Scoped	Private multicast, the multicast equivalent of RFC 1918

224.0.0.1 is the first address in the first block. Its neighbours are worth recognising too: 224.0.0.2 is all routers, 224.0.0.5 and 224.0.0.6 are OSPF, 224.0.0.9 is RIPv2, 224.0.0.251 is mDNS, and 224.0.0.252 is LLMNR.

When you see it

In any packet capture on a network with a router, carrying IGMP membership queries.
In netstat -gn on Linux or netstat -g on macOS, in the list of groups an interface has joined.
In switch configuration, where IGMP snooping decides which ports need which multicast streams.
In firewall logs, as a destination that fills the counter with harmless local control traffic.
In IPTV and campus networks, where multicast carries video and the control groups keep the trees pruned.

How IGMP uses it

A router on the link periodically sends an IGMP membership query to 224.0.0.1. Every host receives it, and hosts that still want a particular group answer with a membership report. Hosts that no longer care stay silent, and the router eventually stops forwarding that group onto the link. IGMPv3 moved the reports to 224.0.0.22, but the queries still go to the all-hosts group.

The TTL on these packets is 1, which is the mechanism that keeps them local. A router decrements TTL before forwarding, gets zero, and drops the packet. There is no filtering rule to configure; the scoping is arithmetic.

The IPv6 equivalent

IPv6 has no broadcast at all. Where IPv4 uses 255.255.255.255 and 224.0.0.1 for different flavours of “everyone”, IPv6 uses ff02::1 for all nodes on the link and ff02::2 for all routers, defined in RFC 4291. Neighbour Discovery, the replacement for ARP, runs over solicited-node multicast groups so that only the host whose address matches is interrupted. Pinging ff02::1%eth0 on Linux is the closest IPv6 comes to a link-wide roll call.

What it is not

224.0.0.1 is not an address a host is assigned; it is a group a host joins. It is not reachable from the internet, so nothing outside your network can send to it. It is not a broadcast either, though it behaves like one for the specific groups everyone joins. And multicast traffic in a capture is not evidence of a problem: a quiet network still carries IGMP queries, ARP, and neighbour discovery all day.

Work out which multicast block an address falls into with /subnet-calculator.

Questions people ask

Why does 224.0.0.1 appear constantly in my packet capture?: Routers send IGMP membership queries to it to learn which multicast groups hosts still want. The interval is typically once every 60 to 125 seconds per link.
Can I ping 224.0.0.1?: On Linux and macOS the ping goes out and hosts on the link may reply, which is a quick way to enumerate neighbours. Windows does not reply to it, and many devices ignore it.
What is the difference between 224.0.0.1 and 224.0.0.2?: 224.0.0.1 is all hosts. 224.0.0.2 is all routers. Both are in the local network control block and neither is forwarded.
Is multicast the same as broadcast?: No. A broadcast interrupts every host. A multicast only reaches hosts that joined the group, except for the well-known groups such as 224.0.0.1 that everyone joins by definition.

Last reviewed 2026-09-04. editorial