TechKnowSurge
Cisco CCNA 1.9 Cisco CCST Networking 2.3 CompTIA Network+ 3.4 Cisco CCNA 1.8
VideoNetworkFree

IPv6 Multicasting

IPv6 multicasting is a core mechanism that delivers traffic to specific groups of devices rather than broadcasting to all nodes on a network. This coverage includes multicast scoping, well-known multicast addresses, and the solicited node multicast address.

Complete this video to capture a CTF flag worth 1 point.

About this video

IPv6 multicasting is a traffic delivery method that sends packets only to devices that have subscribed to a particular multicast group, avoiding the inefficiency of broadcasting to every node on a network. When a source transmits to a multicast group address, the switch forwards the traffic only to ports associated with subscribed devices. Switches can be configured with static multicast group assignments, or devices can dynamically register themselves with a group when they join the network. If a switch has no record of which ports belong to a given group, it falls back to flooding the traffic to all ports. All IPv6 multicast addresses begin with FF, followed by a flags field and a four-bit scope field that defines the boundary of the traffic. A scope value of 1 confines the multicast to a single interface, 2 limits it to the local subnet, 5 restricts it to a single site, 8 keeps it within an organization even across WAN links, and E allows global routing across the internet. Well-known link-local multicast groups — including all-nodes at FF02::1, all-routers at FF02::2, and protocol-specific groups for OSPF, RIP, and EIGRP — allow devices and routing protocols to communicate efficiently without relying on broadcasts. Each multicast IP address also maps to a corresponding multicast MAC address, which is how layer 2 switches determine the correct ports for frame forwarding. The solicited node multicast address is a specialized and automatically assigned multicast address with the prefix FF02::1:FF, followed by the last 24 bits of a device's link-local address. Because it is derived directly from the host's link-local address, it is effectively unique to that device, making the group a multicast group of one. This address is a foundational element of the IPv6 Neighbor Discovery Protocol, which uses it to perform functions equivalent to ARP in IPv4, and it will be examined in greater depth in the context of neighbor discovery.

What you'll learn

What's covered

IPv6 Multicasting

Aligned to

Cisco CCNA
1.9 Describe IPv6 address types
1.8 Configure and verify IPv6 addressing and prefix
Cisco CCST Networking
2.3 Identify IPv6 addresses and prefix formats
CompTIA Network+
3.4 Given a scenario, implement IPv4 and IPv6 network services

Key terms

Multicast
A transmission type in which data is sent from one source to a specific group of devices that have subscribed to a multicast group address, rather than to all devices or just one. This differs from broadcast (all devices) and unicast (one device).
IPv6 Multicast Address
An IPv6 address in the FF00::/8 range used to deliver packets to multiple subscribed interfaces simultaneously.
Multicast Scope
A 4-bit field in an IPv6 multicast address that defines the boundary within which the multicast traffic is confined, such as interface-local, link-local, site-local, or global.
Link-Local Address
An IPv6 address in the FE80::/10 range that is automatically assigned to every IPv6-enabled interface and used only for communication within a single network link. It cannot be routed beyond the local Layer 2 segment and is required for Neighbor Discovery and router communication.
Solicited-Node Multicast Address
A special IPv6 multicast address in the FF02::1:FF00:0/104 range that is derived from the last 24 bits of a device's IPv6 address, used by Neighbor Discovery to efficiently perform address resolution without broadcasting to all hosts. Instead of flooding all devices the way ARP does in IPv4, NDP sends solicitations only to the small group of devices sharing those same 24 bits.
Multicast Group
A set of devices that have subscribed to receive traffic sent to a specific multicast address.

Topics

Ipv6 Multicast Addressing Solicited Node Multicast Ipv6 Address Types Network Protocols Networking

Transcript

Multicasting is a very important part of how IPv6 operates and works. We went over the different types of addresses there are, and one of those was the multicast address. Here's the range right here, and we're going to take a further in-depth look into this. The range that we have is anywhere from FS.

How multicasting works

Let's say we wanted to send messages out to just desktops on our network. I'm going to circle just the desktops we want to send information out to. We're going to send information from the server out to those desktops, so that server is going to send it to the switch, and the switch is going to forward it to all devices that are subscribed to that multicast group.

But the question is, how does the switch know which ports to send them on? There are a couple of different ways to do that. Number one, we can actually get onto the switch and assign specific multicast groups onto the switch, so that way it will send out whatever frames are destined towards that multicast group, and then it will send out to those devices that are out on the network. That is how to manually set it up.

But there is also a dynamic way. When a machine checks in to the switch, it will actually tell the switch which groups it wants to be a part of, so there is a dynamic way for these machines to subscribe to that group. Then when that server sends out that data, that switch knows where to send that data to. If it doesn't know, if it doesn't understand what ports are assigned to that specific multicast group, then it will just broadcast it out to all devices.

Multicasting scopes

What this represents right here is a multicasting address. Multicasting addresses all start out, just by definition, with eight bits all being one, and so that is the equivalent to FF. It's the same thing that we saw on that table a slide or two ago. So it starts out with FF, and then the next set of bits, the next four bits, are flags. There are specific flags for things that we want to flag, but we're not too concerned about this at this point.

Then we get into the scope. The next four bits measure, or signify, the scope. And then the last 112 bits just represents the group ID, so these last 112 bits are assigned to some sort of group. That is the address.

The scope is four bits, so we have 16 possibilities, zero through F. Not all of them are defined; some of them are reserved, and some of them we need to be concerned with now. I've written down the ones that we need to be concerned with right now.

  • If there is a one, that means there's a 0001 in this scope field right here, then it is what's called an interface local. It is only local to the machine.
  • If it is a two, that is being a 0010 in these four bits on the scope, then that is a link local, and we know that link local is the local subnet.
  • If there is a four in this scope, then that means it is an admin local.
  • If there is a five in the scope, that means it's a site local.
  • If there's an 8, it means it's an organizational local.
  • And then if it's an E, that means it's a global multicast address.

The global multicast address means that it will go out onto the internet. There are globally routable multicast addresses, and they would all start with this E within the scope.

Here's another way of stating the same thing. I have this table right here, and if an address starts with FF01, then that is an interface local and it doesn't leave the local device; it's local to the interface. If it starts with FF02, that is a link local and it doesn't leave the subnet. If it starts with FF05, it is a site local and it doesn't leave the local site. The difference between that and a subnet is that a subnet is directly in its same subnet there and doesn't leave the layer 3 device, versus a site local would be like a headquarters office. Then you have FF08, which is an organizational local, which doesn't leave the organization, so it could actually go across WAN lines but it's still going to stay within the organization. And then you have FF0E, which is a global multicast address, and there are no boundaries to it, so it can traverse the internet.

Let's take this one step further. Interface local means this machine right here: if it is a multicast address that's interface local, it only is on that machine, on that direct interface. If it's a link local, it is local to the subnet, so it's a multicast that only is sent to this local network right here. If it is a site local, perhaps this is the same building right here, so everything on this side would be the site local. Multicast addresses could then go beyond this router and perhaps get sent into this area as well, but it maintains on the site. Then you have an organizational local, which would be everything that, even if it traverses the WAN, is still all company resources, all organization resources. And then finally the global will be able to go outside of the organization. So we've got interface local, link local, site local, organizational local, and global.

Specific multicast addresses

Here's a list of different addresses that you will probably see as you advance through this curriculum. One thing we see here is that they all start with FF, so immediately we should flag that this is a multicast address. Then all of these start with 02. That 02 identifies the scope: this is not going to go beyond a layer 3 device, it's going to stay within the subnet, within the LAN, it's going to stay locally.

So then we say, what are the groups that are assigned to this? Group one is all nodes and hosts, group two is all routers. All nodes and hosts is everything on the network; all routers is just the routers that are on the network. And then if the router is running OSPF, then these might apply to it; if the router is running RIP, then this would apply to it; if the router is running errp, that would apply to it. These are different groups that devices will subscribe to so they can get information that's being sent out to the group.

One thing I want to point out is this first one, all nodes and hosts. It's interesting: all nodes and hosts, well, that sure sounds like a broadcast, and it essentially is a type of broadcast if all nodes and hosts are subscribed to this group specifically. Most to all of your devices should be subscribed to this group, so when you send something to this group it's actually going to reach all of the nodes. And then we see that all routers there is going to be all the routers that are going to subscribe to that. These are the two that we really are going to hit on hard.

We're going to be talking a lot about things that are broadcasted — or I shouldn't use the term broadcast, it is a multicast. You still have to subscribe to that group in order to get those advertisements, in order to get those messages that are being sent to the group. But we are going to be dealing with the all nodes and hosts, and we'll be dealing with all the devices that the routers are going to subscribe to.

The other thing that I want to point out is that I also added the MAC addresses. I added the MAC addresses here because there's always an association between the IP address and the MAC address, and the reason why that has to be is because that is what the switch is making a determination on: which device is going to get this information, which device is going to get the packet and the frames that are being sent to this group. Because the switch is a layer 2 device and it's making these decisions, it makes the decision at the frame level, and so it needs to be able to see the MAC address reflect whatever multicast group it's a part of. You can see that these multicast groups start with 33 and then they end with the group number on here, and so that is the multicast group there. Just know that that's how the switch determines what ports it's going to forward the frame off to, so that it can get it to these different devices.

Let's look at a specific example. This is an FF02, so we know that it's multicast because it begins with FF, and we know the scope is going to stay within the subnet. Let's say we have this range right here. It's got two routers that are servicing it, it's got a couple of switches, and it's got a lot of devices that are hanging off of it. This computer right here wants to ask a question of the routers, so what would it be? It'd be sending a message to ff2::2. That switch gets it and realizes that it has a device, this router right here, that subscribed to that group on a port, and will forward it out there. Then this switch also knows that there is a device that's associated with that group on it, and lets this switch know, so this switch knows it needs to forward it out that port and this switch knows it needs to forward out that port. So now both of these routers will get the advertisement to ff2::2. We'll actually see how this works with Neighbor Discovery Protocol, for these routers to actually reply and say, yeah, I am a way out, you can use me as a default gateway.

That's one example. Another example is we've got these routers that are communicating with each other, and maybe they need to pass off certain information with each other. This router right here and this router right here can send out advertisements and messages to each other so that they can start that communication and get that communication flowing. But remember, whatever is sent out this link right here is going to stay on that link right there; it's not going to go beyond those routers. Whatever is sent out this link is going to stay on this link right here; it's not going to go beyond those routers. Same thing with this link right here. So this particular one, FF02::2, will be used to go from your machines to your routers, and will be used between routers and routers.

The solicited-node multicast address

There is one very unique multicast group, and that is called the solicited-node multicast group. The address for this solicited-node multicast group is FF02::1:FF and then a series of bits, and these series of bits are going to represent the host. It's going to be unique to the host, so the group that's going to be involved in this multicast group is going to be a multicast group of one. It's going to be just a single device.

What your device does is it takes the link local address, and then it uses the last part of the link local address to populate the rest of the solicited-node multicast group. Then it can use this to send multicast messages out, and that's part of the neighbor discovery process. We'll talk about Neighbor Discovery Protocol in a second, but at this point just know that solicited-node multicast is one of the multicast addresses that are going to be assigned on your machine, and there's going to be a correlation between that and your link local address, and Neighbor Discovery Protocol uses that.

Multicasting is pretty cool stuff, and it's really necessary for IP version 6. We went over a lot of the concepts, starting from what multicasting is and how it works. We got into the scopes and what the scopes are, how far those multicasts will be sent within your networks. Then we talked about multicast addresses and what those multicast addresses look like. And we finished it up with talking about the solicited-node multicast address, which we'll be talking about later when we get into Neighbor Discovery Protocol.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →