IPv6 multicast background traffic (Part 1) – Box Chatter – IPv6 Multicast Backgrounder
If you would like read the next part in this article series please go to:
Introduction
IPv6 traffic, the next-generation Internet Protocol, is likely flowing across your enterprise LAN as you’ve been reading these words, especially if your organization is running Windows 7. Unless you’ve taken explicit steps to configure IPv6, however, what’s unusual about this traffic is that it’s almost all multicast. There is a continual low-level IPv6 multicast hum on most Windows seven LANs, most of which is related to zero-configuration networking: in plain English, box chatter. This article, the very first in our series, reviews key concepts in IPv6 and multicast, setting the stage for the rest of the series.
This series of posts covers this IPv6 multicast background traffic from various perspectives: where it’s coming from, the battle inbetween industry titans who are putting it there, a bunch of low-level packet traces, and why you should care. The series presupposes at least a passing familiarity with IPv6 but we’ll review key concepts across.
Here’s what we’ll be covering:
IPv6 Multicast Backgrounder: Key Things to Know
Multicast
IT professionals are most familiar with unicast IP addresses where, to simplify, network traffic passes one-to-one inbetween two unique endpoints. Multicast is similar to broadcast, with one-to-many or many-to-many transmission on the same IP address, but differs from broadcast in one key way: multicast is based on a subscription model. Multimedia streaming is the classic multicast use case but on modern networks it is finding an entirely fresh use: dynamic auto-configuration of devices and services. At the time IPv4 was defined, multicast was still considered experimental and didn’t make it into the official protocol (it was added afterward). In IPv6, on the other arm, multicast is a mandatory part of the core protocol and tends to be much more widely used than in IPv4.
IPv6 addressing
A quick recap of IPv6 addressing. IPv6 addresses are one hundred twenty eight bits long, compared to IPv4’s thirty two bits, and are scoped. Scoping means that an address is unique and only valid within a certain domain, such as the local LAN vs. the entire IPv6 global internet. Scoping is effected through the use of IPv6 prefixes. An IPv6 prefix is usually the very first sixty four bits of the address and essentially corresponds to an organizational boundary, with the final sixty four bits of the address, which are usually derived from a device’s MAC address, designating a unique host. Here is a typical IPv6 address, with the prefix portion highlighted: 2001:db8:Two:0:1477:3e9a:966c:b3ca
IPv6 unicast addresses are almost always self-assigned, with neither static addressing nor even DHCP being necessary. For globally-unique IPv6 addresses, the very first portion of the IPv6 address, the prefix, is usually obtained dynamically from the local router (we’ll discuss this later). If the local router hasn’t been configured to provide a prefix and the host has no other way of learning it, then it will use the so-called link-local prefix fe80, which is similar to the IPv4 link-local scope 169.254.0.0/16. This ensures address uniqueness within the scope of a local LAN.
IPv4 multicast addresses are in the so-called Class D range 224.0.0.0 through 239.255.255.255. In IPv6, the prefix ff00::/8, i.e. the eight bytes at the beginning of the address, designates a multicast address. The multicast addresses we’ll be covering here are all in the ff02 range, where ‘2’ indicates that they are link-local in scope, i.e. that IPv6 won’t route these packets beyond the local LAN.
Table of Link-Local Multicast addresses we’ll talk about: