Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Understanding IPv6: A Sniffer Full Of 3s: Page 2 of 2

Off to the RFCs!

Let's go look at what some of the RFCs have to say about all this.

RFC 7042 section 2.3.1 states the following:

All MAC-48 multicast identifiers prefixed "33-33" (that is, the 2**32 multicast MAC identifiers in the range from 33-33-00-00-00-00 to 33-33-FF-FF-FF-FF) are used as specified in [RFC2464] for IPv6 multicast. In all of these identifiers, the Group bit (the bottom bit of the first octet) is on, as is required to work properly with existing hardware as a multicast identifier. They also have the Local bit on and are used for this purpose in IPv6 networks.

OK, so 33-33-00-00-00-00 to 33-33-FF-FF-FF-FF are reserved as the destination MAC address for IPv6 multicast. But how did FF02::5 become IPv6mcast_00:00:00:00:05?

RFC 2464 section 7 covers multicast address mapping:

An IPv6 packet with a multicast destination address DST, consisting of the sixteen octets DST[1] through DST[16], is transmitted to the Ethernet multicast address whose first two octets are the value 3333 hexadecimal and whose last four octets are the last four octets of DST.

                      

Huge departure from IPv4?

Does all of this reveal something hugely new and different about IPv6 that IPv4 did not do? Nope. IPv4 just used MAC address numbers I was more familiar with. Admittedly, the IPv4 addresses seemed to "blend in" more with other MAC addresses (01:00:5e for IPv4 versus 33:33 for IPv6).

Let's look at the unresolved view first:

 

It's similar to the pattern we saw with IPv6. Again, the destination MAC addresses that start with "01:00:5e" seem to only appear as destination MAC addresses, and only when the destination IPv4 address is a multicast address 224/8.

Now let's look at the resolved view:

I've gotten used to the FE80. My mind translates those well now. The FF02:: also. The 33:33 in the destination MAC address? That might still take awhile. But you know… two out of three ain't bad.