Published: 2021-12-21
Multicast traffic flow from a single source to a group of receivers. This is different from IP Unicast that only has a single receiver. Multicast is also different from IP Broadcast which targets all devices in the subnet. Where broadcasts cannot leave its own subnet, multicast routing enables multicast packets to travel between subnets.
A popular multicast use case is IPTV that broadcast live TV coverage to thousands or millions of households. If the source had to replicate the same packet to each receiver then its compute and network capacity would have to be enormous. Instead multicast allows the source to send the packet once and instead rely on the network to replicate them.
A multicast path is often described as a tree where the source is the root and every receiver is a leaf. Every branching point in the tree represents a switch or router in that replicate the multicast packet out on each branch.
S
|
/ \
R--/ \
/\--R
R--/ \
\--R
One source, several multicast group receivers. Each branching point is a router or a switch in the network.
A special IP-range 224/4 (224.0.0.0 -> 239.255.255.255) is reserved for Multicast use. You cannot configure your PC with an IP-address in this range, any properly coded operating system will throw an error. Within this IP range exist smaller IP-ranges with different purposes:
Link local multicast cannot leave the subnet. The TTL is set to 1 when sent, so if even you tried to forward the packet the router would drop it. We will use the SSM multicast range in the PIM Sparse Mode blog post. All other labs will use the 239/8 range.
Multicast does not use ARP, instead a multicast IPv4 address always uses the 01:00:5e MAC prefix and then appends the last 23 bits of the IP address to the destination MAC-address. For example, traffic to multicast address 239.2.3.4 has the destination MAC address 01:00:5e:02:03:04.
IPv6 multicast uses the 33:33 MAC prefix, allowing the last 32 bits of the IPv6 Multicast IP address to be appended to the destination MAC-address.
For both the 01:00:5e and 33:33 prefix, the last bit of the first octet has the value 1. This allows switches to quickly identify the incoming frame as a multicast frame and take appropriate action. Similarly, a broadcast frame is identified because all bits in the first octet has the value 1. Finally, the last bit of the first octet for a unicast frames is always 0.
A Multicast flow is often described in the (S,G) format. An example is (*, 239.1.1.1) describing any source IP sending multicast packets to IP address 239.1.1.1. This is called Any Source Multicast, or ASM for short.
Another example of a multicast flow is (10.1.2.3, 232.0.1.2) called Source Specific Multicast, or SSM for short. This flow is limited to only 10.1.2.3 as the source IP, any other source IP sending sending traffic 232.0.1.2 will be considered a different flow.
With no multicast configuration in the subnet, multicast acts just like broadcast. If a switch receives a multicast frame, the frame is flooded out on all other interfaces. A router will ignore the multicast packet.
With the use of IGMP and IGMP snooping the router and switch, respectively, will learn which receivers are interested in a particular multicast flow and only forward the packets on those specific ports, reducing unnecessary bandwidth utilization in the network. IGMP and IGMP snooping are covered in other blog posts.
A popular multicast routing protocol is PIM, allowing multicast traffic to pass through multiple subnets. But before we discuss PIM, we briefly touch on the uRPF feature, a necessity for a working routed multicast topology.
Unicast Reverse Path Forwarding. This is a loop prevention and anti-spoofing feature where the router verifies the source IP of incoming packets, dropping them if the uRPF check fails. The check will fail if the source IP in the received packet does not have a matching route in the routing table.
Looking at the example below, if R1 receives a packet from R3 with source IP 10.0.1.10 then uRPF check will fail because the routing table say R1 should only expect traffic from 10.0.1.0/24 on the interface towards PC10. R1 then assumes the source IP in the packet from R3 was spoofed or a routing loop has occured and so silently drops the packet.
PC10 --- 10.0.1.0/24 --- R1 --- 10.1.3.0/24 --- R3
\ / \ /
.10 .1 .1 .3
uRPF check pass! uRPF check fail!
---------------------> <---------------------
+------------------+ +------------------+
| Src IP 10.0.1.10 | | Src IP 10.0.1.10 |
| Dst IP 1.1.1.1 | | Dst IP 1.1.1.1 |
+------------------+ +------------------+
PIM relies on uRPF and the unicast routing table to find the shortest path to the multicast source.
A Multicast Routing Protocol. It's primary function is to exchange multicast group join or leave messages with other multicast routers. PIM is activated on an interface basis and once activated the router will start sending out PIM Hello messages. Any other PIM router on that interface will respond with its PIM hello packet and an adjacency will form. Once the adjacency is formed the two routers will send PIM Join/Prune messages to each other, signaling which multicast flows they are interested in receiving. These messages are exchanged by PIM neighbors:
This message is sent to a neighboring router, asking the neighbor to forward a specific (S,G) multicast flow to the sending router.
A message telling the neighboring router to stop forwarding a specific (S,G) flow to the sending router.
PIM has two main operating modes, each discussed below: