1 00:00:08,460 --> 00:00:14,560 Okay, so I've mentioned that a multicast is recognizable from a unicast 2 00:00:14,560 --> 00:00:16,080 and from a broadcast. 3 00:00:16,080 --> 00:00:20,540 It's unique that you can look at a sniffer trace and hopefully once we're 4 00:00:20,540 --> 00:00:24,360 done with this class instantly be able to recognize ah, this packet is 5 00:00:24,360 --> 00:00:25,600 a multicast packet. 6 00:00:25,600 --> 00:00:26,760 So how do we know that? 7 00:00:26,760 --> 00:00:29,820 Well, let's start out at layer three, right? 8 00:00:29,820 --> 00:00:31,360 A twilight model. 9 00:00:31,360 --> 00:00:37,200 So in the world of IP version four, they reserve the Class D address range 10 00:00:37,200 --> 00:00:42,040 from multicast. So just as a quick refresher here, Class D addresses in 11 00:00:42,040 --> 00:00:48,600 binary are any addresses the start out with one one one zero in the very 12 00:00:48,600 --> 00:00:53,880 first octet. And then we don't care what the remaining bits are. 13 00:00:53,880 --> 00:01:00,140 So ?1 1.1 0 class four is a Class D address. 14 00:01:00,140 --> 00:01:04,600 And so when we're looking at that, if I zeroed out all the other bits, 15 00:01:04,600 --> 00:01:11,500 we know that the very first available multicast address would be 224000. 16 00:01:11,500 --> 00:01:17,260 And if I take all those x's to the right and set them to one's, the highest 17 00:01:17,260 --> 00:01:23,360 multicast address would be 239.255.255. 18 00:01:23,360 --> 00:01:29,720 255. So definitely, if you're ever taking any Cisco certification exam 19 00:01:29,720 --> 00:01:33,900 that's going to test you on multicast, I can almost promise you they're 20 00:01:33,900 --> 00:01:37,700 going to give you a question in the written section, testing your knowledge 21 00:01:37,700 --> 00:01:41,460 of what the range is of multicast IP addresses. 22 00:01:41,460 --> 00:01:45,240 So this is IP version four multicast range. 23 00:01:45,240 --> 00:01:49,180 Now just like in the world of unicast, how in the world of unicast, there's 24 00:01:49,180 --> 00:01:52,080 some addresses that are reserved for special purposes, right? 25 00:01:52,080 --> 00:01:58,640 Like the 127 network reserved for loopback, the 169 network, which is 26 00:01:58,640 --> 00:02:03,240 basically when DHCP fails. 27 00:02:03,240 --> 00:02:05,340 I forget I'll top my head what's that's called. 28 00:02:05,340 --> 00:02:09,480 So in the world of Class D multicast addresses, there are also a variety 29 00:02:09,480 --> 00:02:14,640 of addresses in this range that are reserved for special purposes. 30 00:02:14,640 --> 00:02:18,680 And you may be tested on that in some sort of a certification exam. 31 00:02:18,680 --> 00:02:21,740 So let's just talk a little bit about what those ones are real quickly. 32 00:02:21,740 --> 00:02:25,060 I'm not going to go into any detail about what they do, but I'm just going 33 00:02:25,060 --> 00:02:26,680 to give them to you. 34 00:02:26,680 --> 00:02:35,500 Okay, so first of all, 224.000 slash 24. 35 00:02:35,500 --> 00:02:42,660 This is called the reserved link local address. 36 00:02:42,660 --> 00:02:43,420 What do I mean by that? 37 00:02:43,420 --> 00:02:50,360 It basically means that any multicast that starts out with 224.000, that's 38 00:02:50,360 --> 00:02:52,540 only meant to go one hop. 39 00:02:52,540 --> 00:02:55,580 In other words, when a router gets that, he can't forward it. 40 00:02:55,580 --> 00:02:57,900 He can't route it out another interface. 41 00:02:57,900 --> 00:02:59,880 It's a link local multicast. 42 00:02:59,880 --> 00:03:03,340 So for example, think about EIGRP, right? 43 00:03:03,340 --> 00:03:05,040 EIGRP, hello is an update. 44 00:03:05,040 --> 00:03:08,540 Go to 224.0010, right? 45 00:03:08,540 --> 00:03:10,460 That's only between two EIGRP routers. 46 00:03:10,460 --> 00:03:13,300 A router can't route that to another router. 47 00:03:13,300 --> 00:03:19,180 OSPF, 224.005 and six, once again, only meant to go to the next hop and 48 00:03:19,180 --> 00:03:20,260 so on and so forth. 49 00:03:20,260 --> 00:03:25,260 So those are called reserved link local addresses. 50 00:03:25,260 --> 00:03:38,020 Another one. So everything else from 224 .0.1.0 through to, well not everything 51 00:03:38,020 --> 00:03:43,820 else, but 238. .anything 255, 255, 255. 52 00:03:43,820 --> 00:03:52,420 This range is called the globally scoped address, the globally scoped 53 00:03:52,420 --> 00:03:57,320 address, which means basically you can use this for your multicast data, 54 00:03:57,320 --> 00:04:00,400 right? Your multicast audio, your multicast video stream, you can pick 55 00:04:00,400 --> 00:04:05,520 an address in this range, which is a pretty wide range and use that to 56 00:04:05,520 --> 00:04:07,460 send out your multicast. 57 00:04:07,460 --> 00:04:13,340 Now there are still some addresses within this range that have been reserved 58 00:04:13,340 --> 00:04:15,220 for stuff that you probably don't want to use. 59 00:04:15,220 --> 00:04:20,820 For example, 224.0.1.1. 60 00:04:20,820 --> 00:04:25,340 You might read that that is reserved for the network time protocol, NTP. 61 00:04:25,340 --> 00:04:34,180 There's another one called 232.anything. 62 00:04:34,180 --> 00:04:38,300 .232.anything is called source specific multicast. 63 00:04:38,300 --> 00:04:42,360 And like the name sounds, I'll just say SSM. 64 00:04:42,360 --> 00:04:48,320 That's used when, let's say your laptop not only discovers what the multicast 65 00:04:48,320 --> 00:04:56,240 destination is, 232.666 as an example, but also learns that the unicast 66 00:04:56,240 --> 00:05:01,560 host of the server that's going to be sending that is 9.10.11.12. 67 00:05:01,560 --> 00:05:05,180 So when your laptop sends out its IGMP message, it actually says, hey, 68 00:05:05,180 --> 00:05:10,320 I want to receive the multicast only from the source of 9.10.11.12 going 69 00:05:10,320 --> 00:05:12,220 to this destination. 70 00:05:12,220 --> 00:05:15,220 That's what we would call source specific multicast. 71 00:05:15,220 --> 00:05:19,400 You actually know the source, you are specifying the source that you want 72 00:05:19,400 --> 00:05:21,200 to receive it from. 73 00:05:21,200 --> 00:05:23,360 Just a few others as well. 74 00:05:23,360 --> 00:05:28,500 I'm going to put on here. 75 00:05:28,500 --> 00:05:32,640 Another reserved address that you should probably be familiar with. 76 00:05:32,640 --> 00:05:36,840 And all these, by the way, come from the IANA website, the Internet Assigned 77 00:05:36,840 --> 00:05:37,720 Numbers Authority. 78 00:05:37,720 --> 00:05:42,280 You can just go to IANA.org and you can get all this information here. 79 00:05:42,280 --> 00:05:55,120 You've also got the 233 .anything address. 80 00:05:55,120 --> 00:05:58,240 That's reserved for something called glop. 81 00:05:58,240 --> 00:05:59,680 Don't ask me what that is. 82 00:05:59,680 --> 00:06:01,160 I have no idea what glop is. 83 00:06:01,160 --> 00:06:03,000 All I know is it's a reserved address. 84 00:06:03,000 --> 00:06:09,460 And then you've got, lastly, 239.anything. 85 00:06:09,460 --> 00:06:18,460 That's what's called the limited scope address. 86 00:06:18,460 --> 00:06:24,280 In other words, if you only want to run multicast within your organization, 87 00:06:24,280 --> 00:06:28,620 within your company, you should, nothing's forcing you to do this, but 88 00:06:28,620 --> 00:06:33,740 you should pick an address from the 239 range because it's limited scope 89 00:06:33,740 --> 00:06:35,240 within my company only. 90 00:06:35,240 --> 00:06:37,200 It's not meant to go to the outside world. 91 00:06:37,200 --> 00:06:40,940 As a matter of fact, if you try to send a multicast out your interface 92 00:06:40,940 --> 00:06:45,940 connected to your ISP, if the destination of that multicast is 239.something, 93 00:06:45,940 --> 00:06:49,500 they most likely have some kind of a filter which is going to deny it, 94 00:06:49,500 --> 00:06:51,500 which is going to drop it. 95 00:06:51,500 --> 00:06:56,560 So you might say, okay, 239.777, that's going to be my CEO's video. 96 00:06:56,560 --> 00:07:01,360 239.180.2.5, that's going to be my background music that's going all the 97 00:07:01,360 --> 00:07:06,060 time. So like I said, nothing forcing you to do this, but that's what 98 00:07:06,060 --> 00:07:08,360 the reserved ranges are. 99 00:07:08,360 --> 00:07:13,480 So that is for IP version 4, from 224 to 239. 100 00:07:13,480 --> 00:07:16,940 So hopefully you'll recognize that at this point. 101 00:07:16,940 --> 00:07:20,520 Now let's move on into the world of IP version 6. 102 00:07:20,520 --> 00:07:28,660 In IP version 6, if you see in binary, any address that begins with this 103 00:07:28,660 --> 00:07:33,520 pattern, which basically means any address that begins with FF, that is 104 00:07:33,520 --> 00:07:36,220 an IPv6 multicast address. 105 00:07:36,220 --> 00:07:39,380 So it's actually, I think, a lot easier to remember than this range of 106 00:07:39,380 --> 00:07:43,700 addresses in IPv4, IPv6, real simple, FF. 107 00:07:43,700 --> 00:07:47,520 Now we know that in IPv6 addresses, you've got four hexadecimal characters 108 00:07:47,520 --> 00:07:51,060 followed by a colon, right, or I guess if you're watching four characters 109 00:07:51,060 --> 00:07:52,460 followed by a colon. 110 00:07:52,460 --> 00:07:55,260 So this is only time out the first two characters. 111 00:07:55,260 --> 00:07:58,040 What about the other two characters after that? 112 00:07:58,040 --> 00:08:02,920 Well, the next four bits in binary, which are in blue here, which will 113 00:08:02,920 --> 00:08:07,080 translate to one character, is what's called the flags. 114 00:08:07,080 --> 00:08:08,460 And not really going to go into that. 115 00:08:08,460 --> 00:08:09,360 It's not really used. 116 00:08:09,360 --> 00:08:11,340 It's typically zeroed out. 117 00:08:11,340 --> 00:08:17,980 And then the last four bits in red are what we call the scope, which indicates 118 00:08:17,980 --> 00:08:24,400 once this multicast pack is generated, how far can it go from the actual 119 00:08:24,400 --> 00:08:27,360 source that generated it? 120 00:08:27,360 --> 00:08:32,200 So let me give you some common scope values, because once again, you might 121 00:08:32,200 --> 00:08:36,480 need to know this for an exam at some point. 122 00:08:36,480 --> 00:08:49,160 So first of all, FF01, that's called the interface local scope. 123 00:08:49,160 --> 00:08:52,860 That's sort of like in the world of IPv4, that's sort of like when you 124 00:08:52,860 --> 00:08:58,240 ping something beginning with 127, the loopback address, right, when you, 125 00:08:58,240 --> 00:09:02,780 on your laptop, when you ping 127.anything, does that actual ping ever 126 00:09:02,780 --> 00:09:04,060 actually leave your laptop? 127 00:09:04,060 --> 00:09:06,720 Does it go on the cable or go on the Wi-Fi? 128 00:09:06,720 --> 00:09:12,100 No, it doesn't. It stays within your own TCP IP stack within your CPU. 129 00:09:12,100 --> 00:09:13,560 That's sort of like what this is as well. 130 00:09:13,560 --> 00:09:17,540 FF01 means it never actually goes on the wire, it never goes anywhere. 131 00:09:17,540 --> 00:09:21,420 So you're not actually ever going to see that in a sniffer trace. 132 00:09:21,420 --> 00:09:24,600 And then you've got the next one, which is FF02. 133 00:09:24,600 --> 00:09:27,720 So this is called link local. 134 00:09:27,720 --> 00:09:30,780 So as an example, look at the ones down here. 135 00:09:30,780 --> 00:09:40,880 Rip next generation, FF02, OSPF v3, FF02, it's all link local multicast. 136 00:09:40,880 --> 00:09:46,740 And then we've got some other ones which are sort of ambiguously defined. 137 00:09:46,740 --> 00:09:49,580 Nobody's really got a good definition for what this means. 138 00:09:49,580 --> 00:09:59,400 You've got the next three are FF04, that's called admin local. 139 00:09:59,400 --> 00:10:02,760 Your guess is good as mine as far as how far that's supposed to go. 140 00:10:02,760 --> 00:10:11,640 And then you've got FF05, which is called site local. 141 00:10:11,640 --> 00:10:13,860 FF05 is site local. 142 00:10:13,860 --> 00:10:22,120 And then you've got FF08, which is organization local. 143 00:10:22,120 --> 00:10:28,140 So in theory, any multicast going to any one of these three destinations 144 00:10:28,140 --> 00:10:30,700 should stay within your company. 145 00:10:30,700 --> 00:10:33,100 It should not go out to the ISP. 146 00:10:33,100 --> 00:10:36,380 But you know, how far within your company was the difference in distance 147 00:10:36,380 --> 00:10:40,080 via a four, five or an eight, that's really up to you. 148 00:10:40,080 --> 00:10:42,100 And actually routers don't enforce this. 149 00:10:42,100 --> 00:10:44,640 Now they do enforce FF02, right? 150 00:10:44,640 --> 00:10:49,800 If a router receives an IPV6 packet inbound on an interface going to FF02, 151 00:10:49,800 --> 00:10:53,040 first thing is he'll do is he'll process it and he'll say, is this for 152 00:10:53,040 --> 00:10:57,660 me? Is this something I need to look at like an OSPF hello or an EIGRP 153 00:10:57,660 --> 00:11:02,880 hello? And after that, he'll process it or he'll drop it, but he will 154 00:11:02,880 --> 00:11:07,480 never route out another interface, something going FF02. 155 00:11:07,480 --> 00:11:13,640 Now, if a router gets something coming into FF04, 05 or 08, he could potentially 156 00:11:13,640 --> 00:11:19,340 route that. If he's got an IPV6 multicast routing protocol going on that 157 00:11:19,340 --> 00:11:21,860 tells him where to forward it, he will. 158 00:11:21,860 --> 00:11:24,020 The router really has no boundaries for these. 159 00:11:24,020 --> 00:11:26,800 He's not going to say, oh, it's already gone through two routers or four 160 00:11:26,800 --> 00:11:28,720 routers or eight routers, I should drop it. 161 00:11:28,720 --> 00:11:29,660 He doesn't do that. 162 00:11:29,660 --> 00:11:33,700 He'll treat all these exactly the same as long as he has some sort of 163 00:11:33,700 --> 00:11:37,360 multicast route in his M router table. 164 00:11:37,360 --> 00:11:43,960 And then the last one is FF0E. 165 00:11:43,960 --> 00:11:46,680 And this is called global scope. 166 00:11:46,680 --> 00:11:50,240 So if you're actually receiving a multicast from your service provider 167 00:11:50,240 --> 00:11:54,800 is going across the internet, this is what the first 16 bits should look 168 00:11:54,800 --> 00:12:05,480 like, FF0E. So that is how you would recognize an IPV6 as well as an IPV4 169 00:12:05,480 --> 00:12:07,300 multicast address. 170 00:12:07,300 --> 00:12:08,060 That's how it would look like.