Modules

Home
Alternative Menu
Cisco CCME VoIP
Articles
Cisco Decrypter
Cisco Lab Partners
Feedback
Forums
Max Arcade
Private Messages
Recommend Us
Statistics
Stories Archive
Submit News
Surveys
Topics
Web Links
Your Account

Cisco Knowledgebase
Articles
- Configuring DHCP
- Configuring DNAT
- Password Recovery
- Configuring Dynamic
DNS
- Configuring NTP
- More Cisco articles

Site Info
Your IP: 122.169.32.104
Welcome, Anonymous
Nickname
Password
Login
Register
Lost Password
Server Date/Time
17 March 2011 07:23:13
EET (GMT +2)

Top Downloads
- Web Security
- Server AntiSpam

Gold Lab Partners


Introduction To Multicast
Introduction
To understand what we are going to talk about, you must be familiar with how MAC addresses
are structured and how they work. The MAC Addresses page is available to help you learn
more about them..
A multicast is similar to a broadcast in the sense that its target is a number of machines on a
network, but not all. Where a broadcast is directed to all hosts on the network, a multicast is
directed to a group of hosts. The hosts can choose whether they wish to participate in the
multicast group (often done with the Internet Group Management Protocol), whereas in a
broadcast, all hosts are part of the broadcast group whether they like it or not :).
As you are aware, each host on an Ethernet network has a unique MAC address, so here's the
million dollar question: How do you talk to a group of hosts (our multicast group), where each
host has a different MAC address, and at the same time ensure that the other hosts, which
are not part of the multicast group, don't process the information ? You will soon know
exactly how all this works.
To keep things in perspective and make it easy to understand, we are going to concentrate
only on an Ethernet network using the IP protocol, which is what 80-90 % of home networks
and offices use.
Breaking things down...
In order to explain Multicasting the best I can and to make it easier for you understand, I
decided to break it down into 3 sections:
1) Hardware/Ethernet Multicasting
2) IP Multicasting
3) Mapping IP Multicast to Ethernet Multicast
A typical multicast on an Ethernet network, using the TCP/IP protocol, consists of two parts:
Hardware/Ethernet multicast and IP Multicast. Later on I will talk about Mapping IP Multicast
to Ethernet Multicast which is really what happens with multicasting on our Ethernet network
using the TCP/IP protocol.
The brief diagram below shows you the relationship between the 3 and how they complete the
multicasting model:
Hardware/Ethernet Multicasting
When a computer joins a multicast group, it needs to be able to distinguish between normal
unicasts (which are packets directed to one computer or one MAC address) and multicasts.
With hardware multicasting, the network card is configured, via its drivers, to watch out for
particular MAC addresses (in this case, multicast MAC addresses) apart from its own. When
the network card picks up a packet which has a destination MAC that matches any of the
multicast MAC addresses, it will pass it to the upper layers for further processing.
And this is how they do it :
Ethernet uses the low-order bit of the high-order octet to distinguish conventional unicast
addresses from multicast addresses. A unicast would have this bit set to ZERO (0), whereas
a multicast would be set to ONE (1)
To understand this, we need to analyse the destination MAC address of a unicast and
multicast packet, so you can see what we are talking about:
Networking Technical KnowledgeBase Articles Downloads More Stuff
17-03-2011 - The World's First Free Cisco Lab - Fire
www.firewall.cx/multicast-intro.php 1/4
multicast packet, so you can see what we are talking about:
When a normal (unicast) packet is put on the network by a computer, it contains the Source
and Destination MAC address, found in the 2nd Layer of the OSI model. The following picture
is an example of my workstation (192.168.0.6) sending a packet to my network's gateway
(192.168.0.5):
Now let's analyse the destination MAC address:
When my gateway receives the packet, it knows it's a unicast packet as explained in the
above picture.
Let's now have a look at the MAC address of a multicast packet. Keep in mind, a multicast
packet is not directed to one host but a number of hosts, so the destination MAC address will
not match the unique MAC address of any computer, but the computers which are part of the
multicast group will recognise the destination MAC address and accept it for processing.
The following multicast packet was sent from my NetWare server. Notice the destination MAC
address (it's a multicast):
Analysis of a multicast destination MAC address:
So now you should be able to understand how computers can differentiate between a normal
or unicast packet and a multicast packet. Again, the destination MAC address 01-00-5E-00-
00-05 is not the MAC address of a particular host-computer but the MAC address that can be
recognised by computers that are part of the multicast group. I should also note that you will
never find a source address that is a multicast MAC address, the source address will always
be a real one, to identify which computer the packet came from.
The IEEE group used a special Rule to determine the various MAC addresses that will be
considered for multicasting. This Rule is covered in the last section of this page, but you don't
need to know it now in order to understand Hardware multicasting. Using this special rule it
was determined that MAC address 01:00:5E:00:00:05 will be used for the OSPF protocol,
which happens to be a routing protocol, and then this MAC address also maps to an IP
address which is analysed in IP Multicast.

IP Multicast
The IP Multicast is the second part of multicasting which, combined with the hardware
multicasting, gives us a multicasting model that works for our Ethernet network. If hardware
multicasting fails to work, then the packet will never arrive at the network layer upon which IP
multicasting is based, so the whole model fails.
With IP multicasting the hardware multicasting MAC address is mapped to an IP Address. Once
Layer 2 (Datalink) picks the multicast packet from the network (because it recognises it, as
the destination MAC address is a multicast) it will strip the MAC addresses off and send the
17-03-2011 - The World's First Free Cisco Lab - Fire
www.firewall.cx/multicast-intro.php 2/4
the destination MAC address is a multicast) it will strip the MAC addresses off and send the
rest to the above layer, which is the Network Layer. At that point, the Network Layer needs
to be able to understand it's dealing with a multicast, so the IP address is set in a way that
allows the computer to see it as a multicast datagram. A host may send multicast datagrams
to a multicast group without being a member.
Multicasts are used a lot between routers so they can discover each other on an IP network.
For example, an Open Shortest Path First (OSPF) router sends a "hello" packet to other OSPF
routers on the network. The OSPF router must send this "hello" packet to an assigned
multicast address, which is 224.0.0.5, and the other routers will respond.
IP Multicast uses Class D IP Adresses:
Let's have a look at an example so we can understand that a bit better:
The picture below is a screenshot from my packet sniffer, it shows a multicast packet which
was sent from my NetWare server, notice the destination IP address:

The screenshot above shows the packet
which was captured, it's simply displaying a
quick summary of what was caught. But,
when we look on the left we see the above
packet in much more detail.
You can clearly see the markings I have put
at the bottom which show you that the
destination IP for this packet is IP Address
224.0.0.5. This corresponds to a multicast IP
and therefore is a multicast packet.
The MAC header also shows a destination
MAC address of 01-00-5E-00-00-05 which we
analysed in the previous section to show you
how this is identified as a multicast packet at
Layer 2 (Datalink Layer).
Some examples of IP multicast addresses:
224.0.0.0 Base Address (Reserved) [RFC1112,JBP]
224.0.0.1 All Systems on this Subnet [RFC1112,JBP]
224.0.0.2 All Routers on this Subnet [JBP]
224.0.0.3 Unassigned [JBP]
224.0.0.4 DVMRP Routers [RFC1075,JBP]
224.0.0.5 OSPFIGP OSPFIGP All Routers [RFC2328,JXM1]
Remember that these IP Addresses have been assigned by the IEEE !
Now all that's left is to explain how the IP multicast and MAC multicast map between each
other...
Mapping IP Multicast to Ethernet Multicast
The last part of multicast which combines the Hardware Multicasting and IP Multicasting is the
Mapping between them. There is a rule for the mapping, and this is it:
To map an IP Multicast address to the corresponding Hardward/Ethernet multicast address,
place the low-order 23 bits of the IP multicast address into the low-order 23 bits of the
special Ethernet multicast address. The rest of the high-order bits are defined by the IEEE
(yellow colour in the example)
The above rule basically determines the Hardware MAC address. Let's have a look at a real
example to understand this.
We are going to use Multicast IP Address 224.0.0.5 - a multicast for the OSPF routing
17-03-2011 - The World's First Free Cisco Lab - Fire
www.firewall.cx/multicast-intro.php 3/4
We are going to use Multicast IP Address 224.0.0.5 - a multicast for the OSPF routing
protocol. The picture below shows us the analysis of the IP address in binary so we can
clearly see all the bits:
It might seem a bit confusing at first, but let's break it down:
We have an IP Address of 224.0.0.5, this is then converted into binary so we can clearly see
the mapping of the 23 bits to the MAC address of the computer. The MAC Address part which
is in yellow has been defined by the IEEE group. So the yellow and pink line make the one MAC
Address as shown in binary mode, then we convert it from binary to hex and that's about it !
NOTE
You should keep in mind that multicast routers should not forward any multicast datagram
with destination addresses in the following 224.0.0.0 and 224.0.0.255. The next page
(multicasting list) gives a bit more information on this.
This just about does it for multicasting !

Next - Multicast IP List


17-03-2011 - The World's First Free Cisco Lab - Fire
www.firewall.cx/multicast-intro.php 4/4