FIREWALL.

CX

MULTICAST - UNDERSTAND HOW IP MULTICAST WORKS

WRITTEN BY ADMINISTRATOR. POSTED IN NETWORK FUNDAMENTALS (/NETWORKING-TOPICS/GENERAL-NETWORKING.HTML)

Rating 4.49 (65 Votes)

Share Tweet

(//pinterest.com/pin/create/button/?url=http%3A%2F%2Fwww.firewall.cx%2Fnetworking-topics%2Fgeneral-networking%
multicast.html&media=http%3A%2F%2Fwww.firewall.cx%2Fimages%2Fstories%2Fnetworking%2Fmulticast-intro-
1.gif&description=To%20understand%20what%20we%20are%20going%20to%20talk%20about%2C%20you%20must%20be%20fa

To understand what we are going to talk about, you must be familiar with how MAC addresses are structured and
how they work. The MAC Addresses (/networking-topics/general-networking/105-mac-addresses.html) page is
available to help you learn more about them.

A multicast is similar to a broadcast in the sense that its target is a number of machines on a network, but not all.
Where a broadcast is directed to all hosts on the network, a multicast is directed to a group of hosts. The hosts can
choose whether they wish to participate in the multicast group (often done with the Internet Group Management
Protocol), whereas in a broadcast, all hosts are part of the broadcast group whether they like it or not!

As you are aware, each host on an Ethernet network has a unique MAC address, so here's the million dollar question:
How do you talk to a group of hosts (our multicast group), where each host has a different MAC address, and at the
same time ensure that the other hosts, which are not part of the multicast group, don't process the information ? You
will soon know exactly how all this works.

To keep things in perspective and make it easy to understand, we are going to concentrate only on an Ethernet
network using the IP protocol, which is what 80-90 % of home networks and offices use.

BREAKING THINGS DOWN...

In order to explain Multicasting the best I can and to make it easier for you understand, I decided to break it down into
3 sections:

1) Hardware/Ethernet Multicasting
2) IP Multicasting

3) Mapping IP Multicast to Ethernet Multicast

A typical multicast on an Ethernet network, using the TCP/IP protocol, consists of two parts: Hardware/Ethernet
multicast and IP Multicast. Later on I will talk about Mapping IP Multicast to Ethernet Multicast which is really what
happens with multicasting on our Ethernet network using the TCP/IP protocol.

The brief diagram below shows you the relationship between the 3 and how they complete the multicasting model:

HARDWARE/ETHERNET MULTICASTING

When a computer joins a multicast group, it needs to be able to distinguish between normal unicasts (which are
packets directed to one computer or one MAC address) and multicasts. With hardware multicasting, the network card
is configured, via its drivers, to watch out for particular MAC addresses (in this case, multicast MAC addresses) apart
from its own. When the network card picks up a packet which has a destination MAC that matches any of the
multicast MAC addresses, it will pass it to the upper layers for further processing.

And this is how they do it:

Ethernet uses the low-order bit of the high-order octet to distinguish conventional unicast addresses from
multicast addresses. A unicast would have this bit set to ZERO (0), whereas a multicast would be set to ONE
(1)

To understand this, we need to analyse the destination MAC address of a unicast and multicast packet, so you can
see what we are talking about:

When a normal (unicast) packet is put on the network by a computer, it contains the Source and Destination MAC
address, found in the 2nd Layer of the OSI model. The following picture is an example of my workstation
(192.168.0.6) sending a packet to my network's gateway (192.168.0.5):

Now let's analyse the destination MAC address:

When my gateway receives the packet, it knows it's a unicast packet as explained in the above picture.

Let's now have a look at the MAC address of a multicast packet. Keep in mind, a multicast packet is not directed to
one host but a number of hosts, so the destination MAC address will not match the unique MAC address of any
computer, but the computers which are part of the multicast group will recognise the destination MAC address and
accept it for processing.

The following multicast packet was sent from my NetWare server. Notice the destination MAC address (it's a
multicast):

Analysis of a multicast destination MAC address:

So now you should be able to understand how computers can differentiate between a normal or unicast packet and a
multicast packet. Again, the destination MAC address 01-00-5E-00-00-05 is not the MAC address of a particular host-
computer but the MAC address that can be recognised by computers that are part of the multicast group. I should
also note that you will never find a source address that is a multicast MAC address, the source address will always be
a real one, to identify which computer the packet came from.

The IEEE group used a special Rule to determine the various MAC addresses that will be considered for multicasting.
This Rule is covered in the last section of this page, but you don't need to know it now in order to understand
Hardware multicasting. Using this special rule it was determined that MAC address 01:00:5E:00:00:05 will be used for
the OSPF protocol, which happens to be a routing protocol, and then this MAC address also maps to an IP address
which is analysed in IP Multicast.
 

IP MULTICAST

The IP Multicast is the second part of multicasting which, combined with the hardware multicasting, gives us a
multicasting model that works for our Ethernet network. If hardware multicasting fails to work, then the packet will
never arrive at the network layer upon which IP multicasting is based, so the whole model fails.

With IP multicasting the hardware multicasting MAC address is mapped to an IP Address. Once Layer 2 (Datalink)
picks the multicast packet from the network (because it recognises it, as the destination MAC address is a multicast)
it will strip the MAC addresses off and send the rest to the above layer, which is the Network Layer. At that point, the
Network Layer needs to be able to understand it's dealing with a multicast, so the IP address is set in a way that
allows the computer to see it as a multicast datagram. A host may send multicast datagrams to a multicast group
without being a member.

Multicasts are used a lot between routers so they can discover each other on an IP network. For example, an Open
Shortest Path First (OSPF) router sends a "hello" packet to other OSPF routers on the network. The OSPF router must
send this "hello" packet to an assigned multicast address, which is 224.0.0.5, and the other routers will respond.

IP Multicast uses Class D IP Adresses:

Let's have a look at an example so we can understand that a bit better:

The picture below is a screenshot from my packet sniffer, it shows a multicast packet which was sent from my
NetWare server, notice the destination IP address:

The screenshot above shows the packet which was captured, it's simply displaying a quick summary of what was
caught. But, when we look on the left, we see the above packet in much more detail.

You can clearly see the markings I have put at the bottom which show you that the destination IP for this packet is IP
Address 224.0.0.5. This corresponds to a multicast IP and therefore is a multicast packet.

The MAC header also shows a destination MAC address of 01-00-5E-00-00-05 which we analysed in the previous
section to show you how this is identified as a multicast packet at Layer 2 (Datalink Layer).

Some examples of IP multicast addresses:

224.0.0.0 Base Address (Reserved) [RFC1112,JBP]

224.0.0.1 All Systems on this Subnet [RFC1112,JBP]
224.0.0.2 All Routers on this Subnet [JBP]
224.0.0.3 Unassigned [JBP]
224.0.0.4 DVMRP Routers [RFC1075,JBP]
224.0.0.5 OSPFIGP OSPFIGP All Routers [RFC2328,JXM1]
Remember that these IP Addresses have been assigned by the IEEE
!

Now all that's left is to explain how the IP multicast and MAC
multicast map between each other...

MAPPING IP MULTICAST TO ETHERNET MULTICAST

The last part of multicast which combines the Hardware

Multicasting and IP Multicasting is the Mapping between them.
There is a rule for the mapping, and this is it:

To map an IP Multicast address to the corresponding

Hardward/Ethernet multicast address, place the low-order 23
bits of the IP multicast address into the low-order 23 bits of
the special Ethernet multicast address. The rest of the high-
order bits are defined by the IEEE (yellow colour in the example)

The above rule basically determines the Hardware MAC address. Let's have a look at a real example to understand
this.

We are going to use Multicast IP Address 224.0.0.5 - a multicast for the OSPF routing protocol. The picture below
shows us the analysis of the IP address in binary so we can clearly see all the bits:

It might seem a bit confusing at first, but let's break it down:

We have an IP Address of 224.0.0.5, this is then converted into binary so we can clearly see the mapping of the 23
bits to the MAC address of the computer. The MAC Address part which is in yellow has been defined by the IEEE
group. So the yellow and pink line make the one MAC Address as shown in binary mode, then we convert it from
binary to hex and that's about it !
 You should keep in mind that multicast routers should not forward any multicast datagram with destination
addresses in the following 224.0.0.0 and 224.0.0.255. The next page (multicasting list) gives a bit more
information on this.

This concludes our discussion on how Multicast works. For more information on network protocols, analysis and
functionality, please visit our Network Protocols (/networking-topics/protocols.html) or Network Fundamentals
(/networking-topics/general-networking.html) section.

Back to Network Fundamentals Section (/networking-topics/general-networking.html)

Switch to Desktop Version (http://www.firewall.cx/?mobile=0)