TechKnowSurge
Cisco CCNA 1.9 Cisco CCST Networking 2.3 CompTIA Network+ 3.4 Cisco CCST Networking 5.2 CompTIA Network+ 5.5
TechKnowSurge Catalog Videos DEMO: Wireshark, Multicast Membership
VideoNetworkFree

DEMO: Wireshark, Multicast Membership

A Windows machine running IPv6 automatically joins several multicast groups when connected to a network. This demonstration uses Wireshark and the netsh command to capture and examine those multicast memberships in real time.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

When an IPv6-enabled Windows machine connects to a network, it immediately begins the process of joining multicast groups, a behavior that can be observed directly by capturing traffic on the Ethernet interface with Wireshark. The captured frames include ICMPv6 Multicast Listener Report messages that signal the device's intent to join specific multicast addresses, and sorting the capture by protocol makes those packets easy to identify and inspect. Each report corresponds to a multicast address the device is registering with the local network segment. Two key multicast addresses visible in the capture are solicited-node multicast addresses, which IPv6 derives automatically from a device's unicast addresses. One is tied to the statically assigned IPv6 address and ends in the last 24 bits of that address, while the other corresponds to the interface's link-local address. This relationship can be confirmed using ipconfig to view the link-local address and cross-referencing its last four hex characters against the solicited-node multicast address shown in the Wireshark capture and the netsh interface ipv6 show joins output. The full list of multicast memberships returned by that command also includes well-known addresses such as ff02::fb and ff02::c, which support standard IPv6 network services. Together, these tools provide a clear, verifiable picture of how an IPv6 host establishes its multicast presence on a network at the moment it comes online.

What you'll learn

What's covered

IPv6 Multicast on Windows

Aligned to

Cisco CCNA
1.9 Describe IPv6 address types
Cisco CCST Networking
2.3 Identify IPv6 addresses and prefix formats
5.2 Perform a packet capture with Wireshark and save it to a file
CompTIA Network+
3.4 Given a scenario, implement IPv4 and IPv6 network services
5.5 Given a scenario, use the appropriate tool or protocol to solve networking issues

Key terms

Internet Control Message Protocol
ICMP
A network layer protocol used to send error messages and operational information about network conditions.
Multicast
A transmission type in which data is sent from one source to a specific group of devices that have subscribed to a multicast group address, rather than to all devices or just one. This differs from broadcast (all devices) and unicast (one device).
Solicited-Node Multicast Address
A special IPv6 multicast address in the FF02::1:FF00:0/104 range that is derived from the last 24 bits of a device's IPv6 address, used by Neighbor Discovery to efficiently perform address resolution without broadcasting to all hosts. Instead of flooding all devices the way ARP does in IPv4, NDP sends solicitations only to the small group of devices sharing those same 24 bits.
Link-Local Address
An IPv6 address in the FE80::/10 range that is automatically assigned to every IPv6-enabled interface and used only for communication within a single network link. It cannot be routed beyond the local Layer 2 segment and is required for Neighbor Discovery and router communication.
ICMPv6 Multicast Listener Report
An ICMPv6 message a host sends to notify local routers and neighbors of its IPv6 multicast group memberships.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.

Topics

Wireshark Ipv6 Icmpv6 Multicast Packet Analysis Networking Windows Administration

Transcript

We're going to take a look at a Windows machine and see what multicast memberships it subscribes to, because it has IP version 6 running on its interface.

Capturing the Interface as It Comes Up

I'm on my demo laptop right here, and what I'm going to do is turn on Wireshark to monitor the ethernet interface, and then I'm going to plug it into the switch, and we are going to see what memberships it becomes a part of, and what information is in those packets that are sent out, the frames that are sent out to become part of that membership.

Here I have Wireshark up. I'm going to double click my ethernet connection. Notice there's nothing coming across it right now, because it's not plugged in. So I'm going to plug this in and then we'll see what traffic comes across it.

The Multicast Listener Reports

Now that we've plugged in this device, I've stopped the capture. We've got a lot of data now of what traffic goes across this interface when you plug it in. What I'm going to do is sort by protocol, and what I'm looking for are the ICMP version 6 packets that are in here.

I look at these and I see some multicast listener report messages. So I look in here and we see something specific: this is a colon 14. So this is the multicast address associated with the IP address that we assigned to this device, the static IP address. I click on this one — same thing we've got there. So we can see that it subscribes to some of these multicast addresses in here.

Checking the Joins from the Command Prompt

What I can do is pull up a command prompt and type in netsh interface ipv6 show joins. This is a command that we've used before to take a look at what multicast addresses it's joined to.

I can see here is the ethernet interface. I'll move this down here towards the bottom so we can see some of the list, and as I scroll through these we can see that ff02::fb is on that list down there, and same thing with ff02::c. So it's subscribing to these different lists out there, these different memberships, multicast memberships.

Some of the ones that it subscribes to: we've got this ff02::1:ff00:14. That's the solicited node multicast group that's associated with the static IP address that we assigned to it. And then we also see this ff02::1:ffd7:34fa. That's associated with the link local address that we had on this, so that's the solicited node multicast address associated with the link local.

Verifying the Link Local Address

Just to verify that — it ends in 34fa — I can type in here ipconfig and scroll to our ethernet, and here's the link local, and it ends in 34fa. So yes, we see that this is the link local address. It's created a solicited node multicast address, and then it's registered that solicited node multicast address so that it can receive messages that are destined for that multicast address.

So there you have it. That's part of the process of this: it creates that solicited node multicast address, and then it registers that to be part of that multicast membership.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →