Hello Sathish
I see where your confusion comes from. What you’re seeing in the wireshark captures are the two subtypes of membership queries. They’re both membership queries, but one is a general query, while the other is a group specific query. Both have the Type: Membership Query (0x11) in the wireshark capture.
Essentially, the Type field (0x11) is the same for both messages, but their context (general vs specific) is clarified by the “Multicast Address” field in the IGMP message.
Note that for the general query, the Multicast Address field is set to 0.0.0.0 0.0.0.0, and thus the destination of the IP packet is the general all multicast hosts 224.0.0.1. Conversely, for a group specific query, the Multicast Address field is set to the group to which the host wants to become a member, specifically, the 239.1.1.1 group. This is also why the destination of that IP packet is set to 239.1.1.1.
This behavior is further described in RFC2236 that defines IGMPv2:
0x11 = Membership Query There are two sub-types of Membership Query messages: - General Query, used to learn which groups have members on an attached network. - Group-Specific Query, used to learn if a particular group has any members on an attached network. These two messages are differentiated by the Group Address, as described in section 1.4 . Membership Query messages are referred to simply as "Query" messages.
Note that “these two messages are differentiated by the Group Address” in the RFC.
I hope this has been helpful!
Laz