TechKnowSurge
CompTIA A+ Core 2 1.2 CompTIA Network+ 5.5 Cisco CCST Networking 5.3 Cisco CCNA 1.9 CompTIA Network+ 3.4 Cisco CCST Networking 2.3 Cisco CCNA 1.8
TechKnowSurge Catalog Videos DEMO: IPv6 Multicast Addresses on Windows
VideoNetworkFree

DEMO: IPv6 Multicast Addresses on Windows

A Windows machine is queried using the netsh command to display its active IPv6 multicast group memberships, revealing interface-local, link-local, and solicited-node multicast addresses. The demonstration also shows how to research unfamiliar multicast group designations using publicly available IANA reference resources.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The netsh interface IPv6 show joins command provides a direct way to inspect every IPv6 multicast group a Windows host has joined, and this demonstration walks through that output on a live machine with multiple network interfaces. The results are filtered to focus on the Ethernet adapter, where all listed addresses begin with ff, the standard prefix for IPv6 multicast. The first segment of each address after ff indicates scope: ff01 addresses are interface-local and never leave the host, while ff02 addresses are link-local and are confined to the local subnet, never crossing a Layer 3 boundary. Within the ff02 scope, the all-hosts address ff02::1 appears as expected, since every IPv6-capable host automatically joins this group to receive subnet-wide multicast traffic. Two solicited-node multicast addresses in the ff02::1:ff prefix range are also present, one corresponding to the interface's link-local address and one to a manually configured static IPv6 address. The connection between these multicast groups and their associated unicast addresses is confirmed by running ipconfig and matching the final octets of each unicast address to the final octets of its solicited-node multicast group. Several additional ff02 addresses appear in the output that fall outside standard coursework coverage. These are researched by querying the IANA IPv6 multicast address registry, which maps ff02::c to SSDP and ff02::fb to mDNSv6, among others. The registry also links each designation to its defining RFC, providing a practical method for identifying and further investigating any unfamiliar multicast group address encountered during network analysis or troubleshooting.

What you'll learn

What's covered

IPv6 Multicast Groups Demo

Aligned to

CompTIA A+ Core 2
1.2 Given a scenario, use the appropriate Microsoft command-line tool.
CompTIA Network+
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues.
3.4 Given a scenario, implement IPv4 and IPv6 network services.
Cisco CCST Networking
5.3 Run basic diagnostic commands and interpret the results.
2.3 Identify IPv6 addresses and prefix formats
Cisco CCNA
1.9 Describe IPv6 address types
1.8 Configure and verify IPv6 addressing and prefix

Key terms

Internet Protocol
IP
The principal communications protocol for routing packets across network boundaries.
Multicast
A transmission type in which data is sent from one source to a specific group of devices that have subscribed to a multicast group address, rather than to all devices or just one. This differs from broadcast (all devices) and unicast (one device).
IPv6
The sixth version of the Internet Protocol, using 128-bit addresses written in hexadecimal and separated by colons to provide a vastly larger address space than IPv4's 32-bit addresses. IPv6 also introduces built-in features like SLAAC, NDP, and mandatory support for IPsec.
Solicited-Node Multicast Address
A special IPv6 multicast address in the FF02::1:FF00:0/104 range that is derived from the last 24 bits of a device's IPv6 address, used by Neighbor Discovery to efficiently perform address resolution without broadcasting to all hosts. Instead of flooding all devices the way ARP does in IPv4, NDP sends solicitations only to the small group of devices sharing those same 24 bits.
Link-Local Address
An IPv6 address in the FE80::/10 range that is automatically assigned to every IPv6-enabled interface and used only for communication within a single network link. It cannot be routed beyond the local Layer 2 segment and is required for Neighbor Discovery and router communication.
netsh
A Windows command-line utility used to display and configure network settings, including viewing IPv6 multicast group memberships.

Topics

Ipv6 Multicast Windows Networking Netsh Iana Network Administration

Transcript

We're going to take a look at a Windows machine and see what multicast groups it subscribes to. To do that, I brought up a command prompt, and I'm going to type in this command: netsh int — for interface — ipv6, because we're looking at IP version 6, and we want to show the joins, show the multicast groups that this machine is joined to.

I'm going to hit enter on this, and it's going to pull up a lot of different interfaces. These machines have a lot of interfaces that are on them to do various things. What I'm specifically looking for is the ethernet interface, so I'm going to scroll up and find the ethernet interface. I also see the Wi-Fi is part of some similar groups with this.

Reading the Multicast Addresses

Now, as I'm taking a look at this, I see all of them start with ff. That's what the multicast groups start with. This is 01, so I know that this one is only on that interface — it's the interface-local group, so that's not going to go beyond the interface. Anything that's being sent to this multicast address won't go beyond the interface; it'll stay on the machine.

Then 02 is going to stay within the subnet, so it's not going to go beyond any layer 3 device. This is going to stay on my network. If you recall, ff02::1 is all hosts, so all hosts on the local network, all hosts on the subnet. Of course this machine would subscribe to that group, because it would be a part of all the hosts, and it would need to get any kind of multicast that is headed towards the whole group. So this is part of that group right there.

Then we see some others that we didn't actually talk about: ff02::c, ff02::fb, ff02::13. We didn't talk about those. We did talk about the ones that start with ff02::1:ff, so these two right here are the solicited-node multicast addresses. There are two of them, and one of these is for my link local address and one of them is for a statically assigned IPv6 address that I assigned to this machine. So these are the corresponding solicited-node multicast groups that it's a part of, because of that.

Looking Up What a Group Is For

Perhaps I want to dig a little further. What is this ff02::c? I could copy that — I just highlighted it, I right-clicked and it copied it. I can bring up a browser and paste it into here, and do a search for it.

This site right here I can pull up, and it will show you some of the designated ones, some of these that we see in here. So here is the ff01 group. I want to go down to the ff02 group, and I want to look at the c: c is designated for SSDP. Then I could go and look that up and find out more about that.

I also saw the fb is mDNS version 6, so I could then go look up mDNS version 6. It even has the RFC here that defines what this protocol looks like, so I could click on here and see more detail about how this is defined. I could see quite a bit of information through here.

Matching the Solicited-Node Groups to the Addresses

Now let's just take a look at those other solicited-node multicast groups. I'm going to minimize this and go back to where I see those solicited-node multicast groups, and I just want to show you what those are referencing. I'm going to move this off to the left-hand side, pull this up and do an ipconfig.

I'm going to take a look at my ethernet connection. I'm going to expand it, and we see that the link local address that's assigned here — this ethernet — ends in a34fa. Let's take a look at what that multicast group was. Aha, so this one right here ends in fa. If I were to take a look at that, then that's probably the one that is the solicited-node multicast group that's associated with that link local address.

Then I can also look at the other address I statically assigned on this, and it ends in 5678. Now I can take a look at this over here, and this one ends in 5678. So that solicited-node multicast group is associated with the IP address that is statically assigned to this machine.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →