Yep its pretty normal for multicast setups. 224.0.0.2 is an address range set aside for mulitcast traffic (multicast: think one sender, one message, multiple recipents like a radio). It's a way to distribute traffic to the people that want it without establishing so many redundant connections. What you are seeing is an message from you to discover any nearby multicast enabled routers.
This will explain the ICMP message itself: http://www.networksorcery.com/enp/protocol/icmp/msg10.htm This is a brief but wide overview of mulitcast: http://www.ipmulticast.com/community/whitepapers/howipmcworks.html Dan M. > This is from the Sybase firewall log, (thanks to whomever > recomended trying it , sorry I am a newbie this is proably normal > but i am curious why this is being done by Windows. > Thanks in advance, > Dan > > > > File Version : 4.10.2222 > File Description : Win32 Kernel core component > File Path : C:\WINDOWS\SYSTEM\KERNEL32.DLL > Process ID : FFEF0107 (Heximal) 4293853447 (Decimal) > > Connection origin : local initiated > Protocol : ICMP > Local Address : 65.164.119.86 > ICMP Type : 10 (Router Solicitation) > ICMP Code : 0 > Remote Name : > Remote Address : 224.0.0.2 ----From WHOIS-->(=Internet Assigned Numbers > Authority) > >
