Okay, so I've mentioned that a multicast is recognizable from a unicast
and from a broadcast.
It's unique that you can look at a sniffer trace and hopefully once we're
done with this class instantly be able to recognize ah, this packet is
a multicast packet.
So how do we know that?
Well, let's start out at layer three, right?
A twilight model.
So in the world of IP version four, they reserve the Class D address range
from multicast. So just as a quick refresher here, Class D addresses in
binary are any addresses the start out with one one one zero in the very
first octet. And then we don't care what the remaining bits are.
So ?1 1.1 0 class four is a Class D address.
And so when we're looking at that, if I zeroed out all the other bits,
we know that the very first available multicast address would be 224000.
And if I take all those x's to the right and set them to one's, the highest
multicast address would be 239.255.255.
255. So definitely, if you're ever taking any Cisco certification exam
that's going to test you on multicast, I can almost promise you they're
going to give you a question in the written section, testing your knowledge
of what the range is of multicast IP addresses.
So this is IP version four multicast range.
Now just like in the world of unicast, how in the world of unicast, there's
some addresses that are reserved for special purposes, right?
Like the 127 network reserved for loopback, the 169 network, which is
basically when DHCP fails.
I forget I'll top my head what's that's called.
So in the world of Class D multicast addresses, there are also a variety
of addresses in this range that are reserved for special purposes.
And you may be tested on that in some sort of a certification exam.
So let's just talk a little bit about what those ones are real quickly.
I'm not going to go into any detail about what they do, but I'm just going
to give them to you.
Okay, so first of all, 224.000 slash 24.
This is called the reserved link local address.
What do I mean by that?
It basically means that any multicast that starts out with 224.000, that's
only meant to go one hop.
In other words, when a router gets that, he can't forward it.
He can't route it out another interface.
It's a link local multicast.
So for example, think about EIGRP, right?
EIGRP, hello is an update.
Go to 224.0010, right?
That's only between two EIGRP routers.
A router can't route that to another router.
OSPF, 224.005 and six, once again, only meant to go to the next hop and
so on and so forth.
So those are called reserved link local addresses.
Another one. So everything else from 224 .0.1.0 through to, well not everything
else, but 238. .anything 255, 255, 255.
This range is called the globally scoped address, the globally scoped
address, which means basically you can use this for your multicast data,
right? Your multicast audio, your multicast video stream, you can pick
an address in this range, which is a pretty wide range and use that to
send out your multicast.
Now there are still some addresses within this range that have been reserved
for stuff that you probably don't want to use.
For example, 224.0.1.1.
You might read that that is reserved for the network time protocol, NTP.
There's another one called 232.anything.
.232.anything is called source specific multicast.
And like the name sounds, I'll just say SSM.
That's used when, let's say your laptop not only discovers what the multicast
destination is, 232.666 as an example, but also learns that the unicast
host of the server that's going to be sending that is 9.10.11.12.
So when your laptop sends out its IGMP message, it actually says, hey,
I want to receive the multicast only from the source of 9.10.11.12 going
to this destination.
That's what we would call source specific multicast.
You actually know the source, you are specifying the source that you want
to receive it from.
Just a few others as well.
I'm going to put on here.
Another reserved address that you should probably be familiar with.
And all these, by the way, come from the IANA website, the Internet Assigned
Numbers Authority.
You can just go to IANA.org and you can get all this information here.
You've also got the 233 .anything address.
That's reserved for something called glop.
Don't ask me what that is.
I have no idea what glop is.
All I know is it's a reserved address.
And then you've got, lastly, 239.anything.
That's what's called the limited scope address.
In other words, if you only want to run multicast within your organization,
within your company, you should, nothing's forcing you to do this, but
you should pick an address from the 239 range because it's limited scope
within my company only.
It's not meant to go to the outside world.
As a matter of fact, if you try to send a multicast out your interface
connected to your ISP, if the destination of that multicast is 239.something,
they most likely have some kind of a filter which is going to deny it,
which is going to drop it.
So you might say, okay, 239.777, that's going to be my CEO's video.
239.180.2.5, that's going to be my background music that's going all the
time. So like I said, nothing forcing you to do this, but that's what
the reserved ranges are.
So that is for IP version 4, from 224 to 239.
So hopefully you'll recognize that at this point.
Now let's move on into the world of IP version 6.
In IP version 6, if you see in binary, any address that begins with this
pattern, which basically means any address that begins with FF, that is
an IPv6 multicast address.
So it's actually, I think, a lot easier to remember than this range of
addresses in IPv4, IPv6, real simple, FF.
Now we know that in IPv6 addresses, you've got four hexadecimal characters
followed by a colon, right, or I guess if you're watching four characters
followed by a colon.
So this is only time out the first two characters.
What about the other two characters after that?
Well, the next four bits in binary, which are in blue here, which will
translate to one character, is what's called the flags.
And not really going to go into that.
It's not really used.
It's typically zeroed out.
And then the last four bits in red are what we call the scope, which indicates
once this multicast pack is generated, how far can it go from the actual
source that generated it?
So let me give you some common scope values, because once again, you might
need to know this for an exam at some point.
So first of all, FF01, that's called the interface local scope.
That's sort of like in the world of IPv4, that's sort of like when you
ping something beginning with 127, the loopback address, right, when you,
on your laptop, when you ping 127.anything, does that actual ping ever
actually leave your laptop?
Does it go on the cable or go on the Wi-Fi?
No, it doesn't. It stays within your own TCP IP stack within your CPU.
That's sort of like what this is as well.
FF01 means it never actually goes on the wire, it never goes anywhere.
So you're not actually ever going to see that in a sniffer trace.
And then you've got the next one, which is FF02.
So this is called link local.
So as an example, look at the ones down here.
Rip next generation, FF02, OSPF v3, FF02, it's all link local multicast.
And then we've got some other ones which are sort of ambiguously defined.
Nobody's really got a good definition for what this means.
You've got the next three are FF04, that's called admin local.
Your guess is good as mine as far as how far that's supposed to go.
And then you've got FF05, which is called site local.
FF05 is site local.
And then you've got FF08, which is organization local.
So in theory, any multicast going to any one of these three destinations
should stay within your company.
It should not go out to the ISP.
But you know, how far within your company was the difference in distance
via a four, five or an eight, that's really up to you.
And actually routers don't enforce this.
Now they do enforce FF02, right?
If a router receives an IPV6 packet inbound on an interface going to FF02,
first thing is he'll do is he'll process it and he'll say, is this for
me? Is this something I need to look at like an OSPF hello or an EIGRP
hello? And after that, he'll process it or he'll drop it, but he will
never route out another interface, something going FF02.
Now, if a router gets something coming into FF04, 05 or 08, he could potentially
route that. If he's got an IPV6 multicast routing protocol going on that
tells him where to forward it, he will.
The router really has no boundaries for these.
He's not going to say, oh, it's already gone through two routers or four
routers or eight routers, I should drop it.
He doesn't do that.
He'll treat all these exactly the same as long as he has some sort of
multicast route in his M router table.
And then the last one is FF0E.
And this is called global scope.
So if you're actually receiving a multicast from your service provider
is going across the internet, this is what the first 16 bits should look
like, FF0E. So that is how you would recognize an IPV6 as well as an IPV4
multicast address.
That's how it would look like.