IPv6 multicasting is a core mechanism that delivers traffic to specific groups of devices rather than broadcasting to all nodes on a network. This coverage includes multicast scoping, well-known multicast addresses, and the solicited node multicast address.
IPv6 Multicasting
Multicasting is a very important part of how IPv6 operates and works. We went over the different types of addresses there are, and one of those was the multicast address. Here's the range right here, and we're going to take a further in-depth look into this. The range that we have is anywhere from FS.
Let's say we wanted to send messages out to just desktops on our network. I'm going to circle just the desktops we want to send information out to. We're going to send information from the server out to those desktops, so that server is going to send it to the switch, and the switch is going to forward it to all devices that are subscribed to that multicast group.
But the question is, how does the switch know which ports to send them on? There are a couple of different ways to do that. Number one, we can actually get onto the switch and assign specific multicast groups onto the switch, so that way it will send out whatever frames are destined towards that multicast group, and then it will send out to those devices that are out on the network. That is how to manually set it up.
But there is also a dynamic way. When a machine checks in to the switch, it will actually tell the switch which groups it wants to be a part of, so there is a dynamic way for these machines to subscribe to that group. Then when that server sends out that data, that switch knows where to send that data to. If it doesn't know, if it doesn't understand what ports are assigned to that specific multicast group, then it will just broadcast it out to all devices.
What this represents right here is a multicasting address. Multicasting addresses all start out, just by definition, with eight bits all being one, and so that is the equivalent to FF. It's the same thing that we saw on that table a slide or two ago. So it starts out with FF, and then the next set of bits, the next four bits, are flags. There are specific flags for things that we want to flag, but we're not too concerned about this at this point.
Then we get into the scope. The next four bits measure, or signify, the scope. And then the last 112 bits just represents the group ID, so these last 112 bits are assigned to some sort of group. That is the address.
The scope is four bits, so we have 16 possibilities, zero through F. Not all of them are defined; some of them are reserved, and some of them we need to be concerned with now. I've written down the ones that we need to be concerned with right now.
The global multicast address means that it will go out onto the internet. There are globally routable multicast addresses, and they would all start with this E within the scope.
Here's another way of stating the same thing. I have this table right here, and if an address starts with FF01, then that is an interface local and it doesn't leave the local device; it's local to the interface. If it starts with FF02, that is a link local and it doesn't leave the subnet. If it starts with FF05, it is a site local and it doesn't leave the local site. The difference between that and a subnet is that a subnet is directly in its same subnet there and doesn't leave the layer 3 device, versus a site local would be like a headquarters office. Then you have FF08, which is an organizational local, which doesn't leave the organization, so it could actually go across WAN lines but it's still going to stay within the organization. And then you have FF0E, which is a global multicast address, and there are no boundaries to it, so it can traverse the internet.
Let's take this one step further. Interface local means this machine right here: if it is a multicast address that's interface local, it only is on that machine, on that direct interface. If it's a link local, it is local to the subnet, so it's a multicast that only is sent to this local network right here. If it is a site local, perhaps this is the same building right here, so everything on this side would be the site local. Multicast addresses could then go beyond this router and perhaps get sent into this area as well, but it maintains on the site. Then you have an organizational local, which would be everything that, even if it traverses the WAN, is still all company resources, all organization resources. And then finally the global will be able to go outside of the organization. So we've got interface local, link local, site local, organizational local, and global.
Here's a list of different addresses that you will probably see as you advance through this curriculum. One thing we see here is that they all start with FF, so immediately we should flag that this is a multicast address. Then all of these start with 02. That 02 identifies the scope: this is not going to go beyond a layer 3 device, it's going to stay within the subnet, within the LAN, it's going to stay locally.
So then we say, what are the groups that are assigned to this? Group one is all nodes and hosts, group two is all routers. All nodes and hosts is everything on the network; all routers is just the routers that are on the network. And then if the router is running OSPF, then these might apply to it; if the router is running RIP, then this would apply to it; if the router is running errp, that would apply to it. These are different groups that devices will subscribe to so they can get information that's being sent out to the group.
One thing I want to point out is this first one, all nodes and hosts. It's interesting: all nodes and hosts, well, that sure sounds like a broadcast, and it essentially is a type of broadcast if all nodes and hosts are subscribed to this group specifically. Most to all of your devices should be subscribed to this group, so when you send something to this group it's actually going to reach all of the nodes. And then we see that all routers there is going to be all the routers that are going to subscribe to that. These are the two that we really are going to hit on hard.
We're going to be talking a lot about things that are broadcasted — or I shouldn't use the term broadcast, it is a multicast. You still have to subscribe to that group in order to get those advertisements, in order to get those messages that are being sent to the group. But we are going to be dealing with the all nodes and hosts, and we'll be dealing with all the devices that the routers are going to subscribe to.
The other thing that I want to point out is that I also added the MAC addresses. I added the MAC addresses here because there's always an association between the IP address and the MAC address, and the reason why that has to be is because that is what the switch is making a determination on: which device is going to get this information, which device is going to get the packet and the frames that are being sent to this group. Because the switch is a layer 2 device and it's making these decisions, it makes the decision at the frame level, and so it needs to be able to see the MAC address reflect whatever multicast group it's a part of. You can see that these multicast groups start with 33 and then they end with the group number on here, and so that is the multicast group there. Just know that that's how the switch determines what ports it's going to forward the frame off to, so that it can get it to these different devices.
Let's look at a specific example. This is an FF02, so we know that it's multicast because it begins with FF, and we know the scope is going to stay within the subnet. Let's say we have this range right here. It's got two routers that are servicing it, it's got a couple of switches, and it's got a lot of devices that are hanging off of it. This computer right here wants to ask a question of the routers, so what would it be? It'd be sending a message to ff2::2. That switch gets it and realizes that it has a device, this router right here, that subscribed to that group on a port, and will forward it out there. Then this switch also knows that there is a device that's associated with that group on it, and lets this switch know, so this switch knows it needs to forward it out that port and this switch knows it needs to forward out that port. So now both of these routers will get the advertisement to ff2::2. We'll actually see how this works with Neighbor Discovery Protocol, for these routers to actually reply and say, yeah, I am a way out, you can use me as a default gateway.
That's one example. Another example is we've got these routers that are communicating with each other, and maybe they need to pass off certain information with each other. This router right here and this router right here can send out advertisements and messages to each other so that they can start that communication and get that communication flowing. But remember, whatever is sent out this link right here is going to stay on that link right there; it's not going to go beyond those routers. Whatever is sent out this link is going to stay on this link right here; it's not going to go beyond those routers. Same thing with this link right here. So this particular one, FF02::2, will be used to go from your machines to your routers, and will be used between routers and routers.
There is one very unique multicast group, and that is called the solicited-node multicast group. The address for this solicited-node multicast group is FF02::1:FF and then a series of bits, and these series of bits are going to represent the host. It's going to be unique to the host, so the group that's going to be involved in this multicast group is going to be a multicast group of one. It's going to be just a single device.
What your device does is it takes the link local address, and then it uses the last part of the link local address to populate the rest of the solicited-node multicast group. Then it can use this to send multicast messages out, and that's part of the neighbor discovery process. We'll talk about Neighbor Discovery Protocol in a second, but at this point just know that solicited-node multicast is one of the multicast addresses that are going to be assigned on your machine, and there's going to be a correlation between that and your link local address, and Neighbor Discovery Protocol uses that.
Multicasting is pretty cool stuff, and it's really necessary for IP version 6. We went over a lot of the concepts, starting from what multicasting is and how it works. We got into the scopes and what the scopes are, how far those multicasts will be sent within your networks. Then we talked about multicast addresses and what those multicast addresses look like. And we finished it up with talking about the solicited-node multicast address, which we'll be talking about later when we get into Neighbor Discovery Protocol.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →