0

I ran arp -a in cmd in my home network and it got normal output, but then some multicast addresses have shown up:

  192.168.3.255         ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.251           01-00-5e-00-00-fX     static
  224.0.0.252           01-00-5e-00-00-fX     static
  239.255.255.250       01-00-5e-7f-ff-fX     static
  255.255.255.255       ff-ff-ff-ff-ff-ff     static

So in short terms they are just used for broadcasting messages on the 2nd OSI layer to some groups of devices in my network? I am still learning networking, so any help is appreciated. I cannot ping the first IP, the MAC addresses look weird. I censored some of the MACs for safety reasons with Xs. My subnet mask is 255.255.252.0

P.S What do these MAC addresses mean? Are they virtual? Or are they like a sum of multiple device MACs?

1 Answer 1

3

At the ethernet layer, hosts generally listen for packets destined for specific MAC addresses. This includes unicast, broadcast, and multicast addresses. Broadcast & Multicast addresses have special handling in network switches. Cheap switches will just broadcast packets with a destination MAC that is a multicast or broadcast address.

  • ff:ff:ff:ff:ff:ff is the broadcast MAC address
  • 01:00:5e:XX:XX:XX is the multicast MAC address range. There is a trivial mapping from multicast IPs in the 224.0.0.0/4 range (224.0.0.0-239.255.255.255): just take the lower 23 bits of the IP, and prepend with the OUI 01:00:5e: (the collisions in the top 5 bits of the IP and the missing bit have historical reasons).

Sending an ICMP PING out for an IP associated with a broadcast or multicast MAC address will generally cause all hosts listening for that MAC to respond. Depending on the client you are using, you may have to pass a specific broadcast flag or have admin privileges.

You can lookup registered multicast addresses here: https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml#multicast-addresses-12 However, there are services that pick random multicast addresses, or aren't registered.

In your output:

  • 224.0.0.22 - IGMP
  • 224.0.0.251 - mDNS
  • 224.0.0.252 - Link-local Multicast Name Resolution
  • 239.255.255.250 - Simple Service Discovery Protocol (SSDP)

Python transformation for Multicast IPv4 address to Multicast MAC:

def multicast_ipv4_to_mac(ipaddr_as_u32, multicast_oui='01005e'):
   return "%s%06x" % (multicast_oui, ipaddr_as_u32 & 0x7FFFFF)

# Example, using ip2int from https://stackoverflow.com/questions/5619685/conversion-from-ip-string-to-integer-and-backward-in-python
> multicast_ipv4_to_mac(ip2int('224.0.0.22'))
'01005e000016'
2
  • How do I prepend? Using an AND bitmask? Apr 18, 2019 at 9:10
  • Note that it's the multicast MAC address range specifically for IPv4. There can be other prefixes (e.g. IPv6 uses its own); only a single bit distinguishes unicast vs group MAC addresses.
    – user1686
    Apr 18, 2019 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.