Multicast Address Puns

So I have a issue where my wireless controller is not responding properly. I have an 8.0 subnet on a /23. When I try to ping 9.36 from anything on the 8 it does not respond. If I try to ping 9.36 from anything on the 9 then it responds fine. Here is where it gets odd. Arp is showing a multicast address on 9.36. 00:00:5E:00:01:01. Computers with a 9 address show the same arp entry. What is this multicast address?

I am writing a program for a new system using NVX endpoints and I am a bit confused about the multicast address. If I have multiple encoders does each encoder use its own multicast address or do they all share the same multicast address?

i keep reading the official cert guild but dame that book is dry and trying to wrap my head around that

I am a little bit confused about the IPv6 multicast address - FF00::/8 - maybe someone can shine more light on it. If the first 8 bits form the prefix (FF) cant we write it as FF::/8? Thanks.

I got a security scan reporting TCP/IP Multicast Address Handling Remote DoS (spank.c) vulnerability on our Cisco ASA 5512-x.

I just use this device solely as VPN (anyconnect) appliance. (running 9.12(3))

so I disabled multicast with "no multicast routing" but it still shows up in the scan report. How do i fixed this please?

thanks

Hi. I usually post these kind of "newbie" question to /r/networking but I have had them removed a couple of times because they are too newbie and not about enterprise networking :(. The last time his happened a moderator there suggested this sub-reddit. Hence why I am here. If this is not the appropriate place to ask these kind of question, apologies. Pointers to where will also be appreciated.

So I am having a hard time finding materials online that explains how multicast address are set.

I understand what unicast is: Basically one to one communication. In this scenario, an address identifies one unique host. So setting the address for this, is simple. You assign that unique address.

I understand what the broadcast: basically one to many/all. In this scenario, the broadcast address is basically an address you send to, that ensures that your message is sent to all hosts on the link. So setting or using this address is simple, in layer 2, you just send to FF:FF:FF:FF:FF:FF or the last IP address of a subnet.

I understand what multicast communication is: Basically instead of flooding all the host, you send message to a selected host. So, a one to selected model, where only hosts that have "subscribed" to the message. I also understand that there are addresses designated for this kind of communication. For example with IPv4, multicast address has most-significant bit pattern of 1110 (i understand similar categorization exist in IPv6). For Ethernet, Ethernet frames with a value of 1 in the least-significant bit of the first octet of the destination MAC address are treated as multicast frames.

My question is, how does a host subscribe to be part of a multicast? Most of the material I see explaining this concept leaves this part out!
Also is it possible to have multiple multicast on a single switch/link. If so how are these different multicast groups managed and kept isolated etc.

Is there a command to set or change the multicast address of a DM-NVX-350 and set it in Transmitter mode using Script Manager of Toolbox?

In this course, David says the least significant bit in the first octet of the OUI is 0 for unicast or 1 for multicast.

I don't understand this. How can this be burned into a NIC? A host is free to send any type of frame it wants within the constraints of it's protocol stack.

If you have his course, this comes up in vid 97

Once upon a time I got a very simple question on Boson for ICND1.

The question was along the lines of What Multicast IP Addresses share MAC Addresses.

For those that don't want a long winded explanation the answer is 224.1.1.2 Will share the same Mac Address with 224-239 and 224.129.1.2

So 239.129.1.2 can actually share the same MAC Address with 224.1.1.2. Very cool quirky stuff.

Here is my dilemma.

I am struggling to create the MAC Address for the 239.255.255.255 and 239.255.255.254

Even if I had this MAC Address I would struggle figuring out what IP Addresses would share it's MAC Address.

Unlike with 224.1.1.1 which is really easy.

The MAC Address 01:00:5e:01:01:01 is shared by

224.1.1.1 225.1.1.1 226.1.1.1 .... (Insert 227-237) 238.1.1.1 239.1.1.1

AND

224.129.1.1 225.129.1.1 226.129.1.1 .... (Insert 227-237) 238.129.1.1 239.129.1.1 01:00:5e:01:01:01

My brain however melts down when trying to imagine what this looks like for 239.255.255.255

On a BIT level it simply doesn't make sense to me. From the way I calculate this breaking down on a binary level the MAC Address for 239.255.255.255 would have to be 01:00:5E:7F:FF:FF and 239.255.255.254 = 01:00:5E:7F:FF:FE

Is this correct? And if correct would that mean 239.255.255.255 shares 01:00:5E:7F:FF:FE with 239.127.255.255 ?

and 239.254.255.255 shares 01:00:5E:7E:FF:FE with 239.126.255.255

It would have to be 7E:FF because 1 more bit on a Hex level would be 8 turning 7 into F which would be 255. 7 means that the 4th bit is still 0 and on a binary to decimal level that bit is worth 128. and from what I understand 225-239 and 128 are never represented in the MAC Address (Hence why they share)

..... ...

Did I seriously just figure this out while asking for help. Can someone confirm if that is right? It has been bothering me for days.

This is a very odd topic that I just can't ignore for some reason.

Background: I'm playing around a bit with link local host discovery without using neighbor discovery.

If I send an ICMPv6 echo request to the multicast address ff02::1, some hosts respond with echo replies with the multicast address as the IPv6 source address. What is the expected behavior here?

wireshark capture: https://imgur.com/a/O3VUT

Initially posted in /r/sysadmin

I've done a search on here as well as Google, but none of the answers seem to explain it in a way that I can understand.

For example:

Your IPv6 address is FE80::201:C9FF:FEBE:8701 and you need to find the MAC address of FE80::260:5CFF:FE3C:E601.

The NDP frame you send:

> Source IP: FE80::201:C9FF:FEBE:8701

> Destination IP: FF02::1:FF3C:E601 (solicited-node multicast address)

> Source MAC: 0001.C9BE.8701

> Destination MAC: 3333.FF3C:E601

Why can't you substitute the destination IP with the unicast address of the destination host and leave that destination MAC address like it is?

Wouldn't that achieve the same outcome?

Or does a multicast MAC address HAVE to correspond to a multicast IP address in the same frame?

Very frustrated and hope for some help. Doing my final review for the CCENT and came across a question and explanation in the Bososn practice test. "Which of the following addresses are equivalent to multicast MAC address 0100.5E27.0C01?"

Answer is addresses ending in 39.12.1 and 167.12.1

They explain how to solve this but I get lost at how they explain the 167.12.1? First convert last 6 hex to decimal. Got it. 39.12.1 now here is where I get lost. This is not the only address equivalent to the MAC. When multicast MAC is created only 23 bits of address used. Last 3 octets of IP are 24 bits. Setting of first 24 bits equal to 1 reveals other multicast addresses. Same as adding 128 to first decimal Add 128 to 39 for 167. Totally lost...

The other day I ran across a piece of software configured to "multicast" using the address 255.5.6.7.

While I've seen local broadcast (255.255.255.255) and "true" multicast (as defined in RFC5771), this address seems to reside outside either of those recommendations. The address did seem to work, however, as a corresponding client was receiving the messages (it was on the same subnet).

I was wondering if this address worked merely since the first octet identified as broadcast, and network devices are coded to shortcut the logic. Does anyone know if this is the case or whether this address falls within another commonly recommended block?

For reference, I already checked RFC919 and RFC5771 and neither seemed to include this address.

Hi There,

I'm reading the Oficial Cert Guide by W. Odom for ICND1 and have a question regarding the solicited-node multicast address and Neighbor Discovery Protocol.

According to the book (page 733) the NS messages are sent to the solicited-node multicast address of the target address. But figure 31-4 shows the NS being send to the global unicast address of the target host. I'm assuming this is a mistake, am I correct?

Thanks!!

We have two hosts that are acting as load balancers for a bunch of other servers behind them.

They're in an Active/Backup configuration and only one system has the active 'floating' IP address at any time.

Because of this, the one with the active IP address gets flooded with requests, so much so that we're starting to see issues with hitting TIME_WAIT bucket limits. This is even with tuning of time_wait timeouts and reuse flags etc..

Because the backup host is sat there practically idling, what would be the best way of using it's resources? I've heard rumours of using multicasting with a unicast IP address is one way to go, but that sounds like a huge trap.

Unless it's not?

Has anyone else had a similar set up in the past? Any input you have would be greatly appreciated.

I am working on IPv6 for some time now and anycast addressing has always been a debatable topic. I understand that whenever you enable IPv6 on an interface corresponding Link local address and subnet router anycast addresses gets installed. To make the routing easier Solicited Node multicast for every unicast address is also installed(which involves the global unicast, link local, etc,). But do we install the Solicited Node Multicast address for the subnet router anycast address as well? Why or why not?

I am trying to get a network of computers to all send me a tiny file or possibly a string (whichever is easier) if I request it over a common multicast address. How do I achieve this? I thought i could use netcat, but netcat does not seem to respond to multicast addresses.

So i would like to send a request and recieve one file or string from every node in the network. Simpler (lighter) is preferred.

Recently I've been reading up on multicasting and examining it on our network to validate the stuff I'm reading/learning.

layer 3 transport is pretty easy stuff (at least PIM is anyway)

layer 2 stuff is getting a little more confusing. Namely verifying IGMP Snooping and the fact that multicast frame are only being sent to snooped hosts that sent the join message.

I can see the multicast mac address on our distribution switches, and confirm that it is the mac for the IGMP group based on RFC 1112. ie the low order 23 bits of the IGMP ipv4 address placed in the mac address after 01-00-5E.

But I can't see that mac address in the cam table of layer 2 access switch (3750's) at all.

Note: everything is currently working I'm only trying to verify stuff here w/ show commands to better understand the process.

How do I know the frame is being sent only to the host that sent a join. I was expecting to see that multicast mac address also present in the forwarding tables on the access switch, but I'm not seeing it at all.

Is this just having to do with the 3750?

I am trying to set up an Arista DCS-7048T to listen to two different sets of multicast groups that have different rendezvous point addresses, all over one physical link. These are the commands I have tried so far. Note the addresses have been anonymized.

ip access-list standard WAN_1
   10 permit 239.0.0.0/24
   20 permit 239.0.1.0/24
   30 deny any
ip access-list standard WAN_2
   10 permit 239.0.2.0/24
   20 permit 239.0.3.0/24
   30 deny any
ip pim rp-address 192.168.0.1 access-list WAN_1 override
ip pim rp-address 192.168.0.2 access-list WAN_2 override

This doesn't work, joining the groups on a machine connected to the switch causes no packets to be received.

Setting up one set of groups individually, with one RP, works.

Sorry if this question is vague or doesn't make sense.

Here is more info about the switch:

Arista DCS-7048T-A-R
Hardware version:    01.05
Deviations:
    Serial number:       xxxxx
    System MAC address:  yyyyy

Software image version: 4.9.7
    Architecture:           i386
    Internal build version: 4.9.7-1070657.EOS497
    Internal build ID:      7517c179-ca6d-4e31-b0b0-bb2edfa04c58

I'm working on upgrading some networking equipment and part of that is converting some internal network segmentation rules. I noticed that the old equipment had a rule on some subnets to block traffic to 224.0.0.0/4 which is the range for IPv4 multicasting. I believe the goal was to prevent any unwanted traffic between internal subnets, but does this actually help anything from a security point of view? Does this hurt anything from a performance point of view? I don't believe there is any internal multicasting that needs to happen between subnets, but I do see a lot of devices trying to talk to these addresses.

I am very familiarized with DHCP server role on Windows OS, but I have a doubt regarding multicast scope.

From what I understand, a multicast scope will assign MADCAP clients with a multicast address defined in the scope range. That way, applications that use multicast addresses will be able to communicate with several hosts at the same time with one address only.

My question is, why would I set up a multicast scope, if one address should be enough for several clients, let's say 10 computers. That way the app will use that same multicast address to communicate with all hosts.

How does MADCAP clients get the address? How do I setup the DHCP Server to provide ONE multicast address to clients in ONE scope? How can I check from the client side what multicast address they belong to?

Thanks in advance!

So Ipv6 multicast addresses are supposed to be starting from ff08::/16 right? Then why are ff02:: addresses defined as multicast addresses? HELP

In a few places in the CCNA ICND1 Official Cert guide book Wendell Odom mentions the benefits of multicast traffic. For example:

>[Multicast] has the same good effect as broadcast with IPv4, without the negatives of a broadcast. In this case, only IPv6 routers will spend any CPU cycles processing the RS message.
>
>-- Page 732, ICND1 100-105 Official Cert Guide

Is the NIC itself aware of its IPv6 address and thus able to discard packets before interrupting the CPU? Or is the book just expressing that the hosts on the network will spend fewer cycles because it can discard the packet early?

I have a fairly decent sized farm with multiple buildings that I sent internet to via ubiquity Antennas. Each building has a small 5 port switch and a Synology RT2600 in AP mode to distribute wifi in critical areas.

I want to know if it's possible to set up a few Voip phones like an intercom system. I don't want to make any calls outside of the network, I just want to be able to lift a receiver and dial 1 or something like that and the phone in the metal shop rings.

Cellphone and FM was tried but we are already in a really bad area and some of the buildings are like faraday cages.

I am not sure what I am doing wrong with my Google searches, but everything I've looked at is "magic jack" or some such service I'd have to pay for and that's not what I am aiming to do.

In my mind it would seem like it would be as simple as creating a DHCP reservation or static IP for each phone to be on the network, but after that I'm not sure what else to expect.

Any guidance or articles someone can point me to would be appreciated.

I just need some clarification about the multicast addresses used in broadcast networks. As far as I can tell, they are used according to this table:

Can anyone verify this?

Edit: BRD to BDR. Also, I'm aware that all routers send Hellos to 224.0.0.5, regardless of role.

I'm struggling to understand exactly what these mean and how they work. Could anyone explain like I'm five?

Thanks a ton in advance!

In an attempt to study for my 640-816 exam on Monday, I'm listing some pesky memorization details that will no doubt give me trouble. Please let me know if I've missed anything. This could be a good study guide for anyone else who has trouble with these things.

The first is timers:

STP: Hello = 2 seconds Max Age = 10 times Hello (20 by default) Forward Delay = 20 seconds

RSTP: Hello = 2 seconds Max Age = 3 times Hello (6 by default) Forward Delay = Eliminated in RSPT

RIPv2 Topology Update timer = 30 seconds Hold-down timer = 180 seconds

OSPF: LSA (after convergence) = 30 minutes Hello Interval = 10 seconds Dead Interval = 4 x Hello (40)

EIGRP:

Hello Interval: 5 seconds for links with high bandwidth, 60 sec for low bandwidth Hold-time timer: 3 times hello interval (15 and 180 seconds)

For those who also have trouble memorizing multicast addresses (both ipv4 and ipv6)

IPV4: 224.0.0.1 = All hosts 224.0.0.2 = All Routers 224.0.0.5 = All OSPF routers 224.0.0.6 = All OSPF DRs 224.0.0.9 = All RIPv2 routers 224.0.0.10 = All EIGRP routers

The same addresses apply for IPv6

FF02::1 = All IPv6 hosts FF02::2 = All Ipv6 routers FF02::5 = All OSPFv3 routers FF02::6 = All OSPFv3 DRs FF02::9 = All RipNG routers FF02::A = All EIGRP routers FF02::1:2 = All DHCP relay agents

Other pesky IPv6 addresses:

::1 loopback 2000::/3 Global unicast address FD00::/8 Unique Local FE80:://10 Link Local FF02:://16 Multicast

Hopefully this will provide an easy study reference for some of those difficult to remember numbers and addresses. Let me know if I missed anything or if there is anything you would like added!

I was poking through a customer's firewall and saw some strange multicast addresses (I'm accustomed to 224.0.0.9, .6. and .5). So I decided to find a comprehensive list - and figured I would share it for anyone interested.

https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml#multicast-addresses-1

It's a totally different range from the work network I'm on, they show up all over the office. What's their purpose? Why do I have five of them?

(I should mention that I have a virtual machine running Debian, seeing as it added a lot of network interfaces that confused me at first, though the VM station is only on occasionally)

Hello,

I have a quick question; I don't know much about IPV6 but I have a device that is constantly being blocked by default on my LAN and sending a pushover notification to me as well. I'm trying to identify where its coming from but I'm not sure how to track it down. I'm getting this in the firewall log. I think its related to Plex or Unifi Controller but im not for sure. Once I can identify it I can see why its constantly being blocked. I appreciate any help so I can figure out where this is originating from.

LAN		Jan 4 00:46:21	[fe80::9451:26da:2ca5:4277]:5353	[ff02::fb]:5353	udp	Default deny rule 

LAN		Jan 4 00:46:21	[fe80::9451:26da:2ca5:4277]:5353	[ff02::fb]:5353	udp	Default deny rule

Edit: So update

I did find that my plex docker is listed as 192.168.x.xxxx:5353/UDP192.168.x.xxxx:5353

I'm guessing thats where the port is coming from however I have ipv6 disabled.

I have a new application which requires multicast routing between a few subnets. This is my first time configuring Multicast routing in a production environment.

We have elected to use PIM Sparse Mode and a static RP configuration. The L3 VLAN Interfaces all live on a Cisco 4500X VSL Stack. These interfaces are already routing Unicast traffic.

I have configured IP multicast routing on the core switch using the ip multicast-routing command, and specified the static RP address using the ip pim rp-address x.x.x.x command. The RP address is a Loopback interface on the same core switch stack. I have configured PIM Sparse Mode using the ip pim sparse-mode command on each of the applicable VLAN interfaces and RP LO Interface.

After configuration, I attempted to test multicast using a pair of devices running a multicast testing tool (One Server and One Client). The client PC is not receiving any multicast traffic, except when on the same subnet as the server. The multicast group address (239.0.1.2) is also not appearing in the output of show ip igmp groups on the L3 core switch . IGMP V2 is enabled on all of the associated L3 interfaces. All of the enabled interfaces do appear in the output of the show ip pim interface command.

Did a bit of Wireshark inspection as well... I am seeing the IGMP group join messages coming from the client device, and the MC trafffic sourced from the server. It does not appear the MC stream is making it to the client subnet at all though.

I have a feeling there may be something else required to make multicast work, that I have missed. Any ideas or troubleshooting next-steps would be appreciated.

I got following Setup:

camera -> switch -> target

My camera streams udp with a strict destination to the target.
I'm interested in the intended behaviour when the target loses physical connection.

Expected behaviour:
camera is still streaming but switch doesnt forward any of it's data because the MAC-adress is not present anymore.

Actual behaviour:
camera is still streaming and the switch broadcasts the camera data to all ports, while the destination is still the same as before. (confirmed through wireshark)

Problems
Some devices on the network are not reachable anymore because they are overwhelmed with the broadcast traffic. (10Mbit device is barely reachable when the 15Mbit udp stream turns to broadcast)

My workaround:
I put the setup with camera and target on it's own vlan, so they dont disturb with the broadcast.

My questions:
Is the actual behaviour the intended behaviour of a switch?
If so, who's responsible to stop the camera stream so the network doesn't get flodded with data?

Summary
I got a problem where a udp stream turns to a broadcast when physical connection(unplugging network cable, turning device off) to the destination is lost. According to https://www.homenethowto.com/switching/switches/ the actual behaviour is the intended behaviour. How do i avoid my network getting flooded in this case or who is responsible to stop the udp stream?

Listen to the most recent Vicious Syndicate podcast here - https://www.vicioussyndicate.com/vs-data-reaper-podcast-episode-72/

As always, glad to do these summaries, but a summary won't be able to cover everything and can miss nuances, so I highly recommend listening to their podcast as well. Next VS Report should be out on Thursday, December 30th, with the next podcast being out sometime next weekend.

General - The balance changes look to have done their job for the most part, but of the "Solitaire 5" decks from the last patch, we're now down to a "Solitaire 2". Mozaki Mage was the lone deck not touched, and it's still a problem at high MMRs. Garrote Rogue's winrate took a hit after the Octobot nerf, but its matchup spread got significantly better with its two main counters in Lifesteal DH and Celestial Druid being gone from ladder. Octo to 3 looks similar to the first Mythril Rod nerf where the 1 mana adjustment may not be enough.

They think that with the recent patch, we were very close to a "perfect" meta with every class having a playable archetype. ZachO suggests if they moved Octo to 4 mana and Mozaki to 6 or Incanter's Flow to 4, it'd be even better by pushing later game win conditions into viability. The meta is more diverse than it seems, with multiple playable options and deck styles. Towards the end of the podcast they get into Kibler's comments about card draw in the game being an issue right now, with him specifically pointing to Multicaster being a problem. ZachO reiterates that as long as you're spending mana on card draw, it's not an issue, because no one is killing you by playing 3 mana Arcane Intellect on turn 7 and 8. Mass mana cheat making card draw cost next to nothing is the issue. ZachO strongly disagrees that card draw is as much of a problem as mana cheat or that they go hand in hand, and states the reason why the meta is currently diverse is due to the card draw options available for multiple classes. Shaman in the first half of Barrens was a dead class. Give them a Dungeoneer, they become viable. Give them a Multicaster, they suddenly have 5 separate viable archetypes with none of them being offensive. Multicaster is the reason why we finally have a Mage archetype that's viable without Incanter's Flow. Abundance of draw increases strategic diversity, and as long as these combo finishers come online around turn 10 or 11, there's not an issue since late game finishers should be viable. No one should be upse

Do i need to memorize Well Known Multicast Mac address for CCNA 200-125 exam ?

Background: I'm playing around a bit with link local host discovery without using neighbor discovery.

If I send an ICMPv6 echo request to the multicast address ff02::1, some hosts respond with echo replies with the multicast address as the IPv6 source address. What is the expected behavior here?

wireshark capture: https://imgur.com/a/O3VUT

I am very familiarized with DHCP server role on Windows OS, but I have a doubt regarding multicast scope.

From what I understand, a multicast scope will assign MADCAP clients with a multicast address defined in the scope range. That way, applications that use multicast addresses will be able to communicate with several hosts at the same time with one address only.

My question is, why would I set up a multicast scope, if one address should be enough for several clients, let's say 10 computers. That way the app will use that same multicast address to communicate with all hosts.

How does MADCAP clients get the address? How do I setup the DHCP Server to provide ONE multicast address to clients in ONE scope? How can I check from the client side what multicast address they belong to?

Thanks in advance!