We installed some workstation packet filtering firewall software and found a large number of Internet Protocol 2 packets on the network. What are they used for, and is this a threat?

The Internet Protocol 2 packets you see at the workstations are Internet Group Management Protocol (IGMP) packets coming from routers that keep track of memberships in multicast network groups.

Multicast routers use IGMP to discover what groups have members on their networks. The routers send regular queries to the "all-systems" multi-cast address (224.0.0.1). Hosts that receive the queries reply with one "host membership report" response message for each group the host belongs to, unless they hear another host reply for that same group first.

Multicast routers do not need to keep track of every host in every group, they only need to keep an accurate list of the active groups. If the router does not hear any member reports for a particular group within a pre-set timeout period, the router assumes there are no active group members and will not forward multi-cast group packets from remote domains for that group onto the local network.

IGMP primarily is used on point-to-point connections between routers and hosts, and most likely does not represent a security threat to your workstations by itself.