control multicast

You don't say what kind of equipment you have. If you have something like Cat 2950 switches then you might be able to block it, but anything lower level (e.g., 1900XL switches) probably not.

Looks like 224.0.0.251 is multicast DNS, such as is used by

arpwatch might perhaps help you chase down the system.

CatOS or IOS? And which version and which feature set? Which supervisor engine?

For example if it is IOS and SE2+, SE3 or SE4, you could follow the "Configuring and Monitoring Policing" example at

There might be other ways ;-)

I don't think that Walter's approach will work in a Layer 2 interface but I may be mistaken.

There are several possible approaches

You could block it or send it somewhere that it will do no harm or maybe turn off multicast forwarding altogether.

There is an algorithmic mapping between IP and MAC multicast addresses.

So you would have to block a range of 32 IP Addresses but that may not be an issue.

What happens if you turn off IGMP?

The documentation specifically indicates that the QoS policy may be applied to a port or to a VLAN. It also talks about per-interface policers.

There isn't anything -obvious- in the referenced documentation that would require a layer 3 interface.

Sorry, failed to read the post properly, just saw the ACL and assumed that that is all there was.