printable format  e-mail to a friend comment on article More Q & A Video Killed the Data Stream Distance Training with IS-IS Theory, Reality and Total T-1 Bandwidth 'Area 257' De-Classified Follow That Packet! Back-to-Back Connections and ADSL Split-Scope DHCP Servers VRRP Implementation Q & A Archive

I'm hoping you can help me out. I’ve been involved in a "heated discussion" with a female co-worker. She insists that broadcasts are a subset of multicasts. I keep telling her how different they are and not really related other than they are both sent to multiple destinations.

I refer her to Web site after Web site and ask everyone I know about the topic, but there's no getting through to her! What can I say to her?

Help!

-- Adam

Answer:

Adam,

Well, I’m not entirely sure this is a safe “discussion” for me to get involved in. But, sorry dude, I have to agree with her.

-- advertisement (story continued below) --

In a nutshell, the answer will certainly have something to do with whether we’re talking about Layer 2 or Layer 3 configurations. So, let’s go through a few things:

Layer 3 broadcasts are one of two things:

• All hosts’ broadcasts which go to 255.255.255.255. These go to all devices within a particular network/VLAN without direct knowledge of the IP range
• Subnet broadcasts go to the highest IP number of any given subnet (for example 200.200.200.255 is the broadcast IP of the /24 subnet); specific IPs will vary based on actual subnet mask

From a binary perspective, the host portion of the IP address is set to all ones value.

Layer 3 multicasts are a very specific range, known as Class D addresses. They all begin with binary value of 1110 in the first octet. This yields a first octet having values from 224 to 239. (11100000 to 11101111, in case you really wanted to know!)

The Class D range doesn’t have any concept of subnetting or of broadcast reachability. So at Layer 3, you are correct that the two have nothing to do with each other besides being a way to reach multiple hosts.

At Layer 2, however it’s a completely different story. We are still involved with ones, just not in the same fashion!

A Layer 2 broadcast is known as the “All-Fs” MAC address: FF-FF-FF-FF-FF-FF that we will see in our Ethereal, or other sniffer program. So, that gives us a very specific address that represents all devices within a Layer 2 network.

Layer 2 multicasts give us a little more of a headache. Many people have read different documents and have the idea that Layer 2 multicasts all begin with 01-00-5E-xx-xx-xx. This is sort of true. The Layer 2 representation of IP multicasts all begin with 01-00-5E. But that isn’t really the whole story.

It goes back even further to defining something we call an I/G bit. There is one specific bit in the entire MAC address that defines whether or not it’s a multicast. This keeps life a little interesting. For a more complex definition, it’s specifically the least significant bit (right side) of the most significant byte (left side) of the MAC address.

So, looking at our MAC address again, we see that the “01” is the most significant byte, and in binary that gives us 0000 0001 so the “1” is the least significant bit. This one little bit denotes an individual (0 value) or group (1 value) address.

In case you want to enhance your miscellaneous knowledge here, the next bit in (“2” position) represents the U/L bit. This is also called a locally assigned address (LAA). This represents a universally assigned address (0 value) or a locally assigned address (1 value).

With all that said, let’s go back and look at the Layer 2 broadcast address. With a value of FF-FF-FF-FF-FF-FF, the first byte (like the rest of them) is all ones: 1111 1111 for the bits. That means the I/G big is set to a 1.

Recalling my advanced geometry mathematics knowledge, with all of those exercises about sets and subsets, intersections and other little tidbits that bring back bad dreams of math class, it’s good to look at the criteria a router would use.

A Layer 2 multicast is any MAC address where the least-significant bit of the most-significant byte is set to “1.” A Layer 2 broadcast is a specific MAC address where all bits (including the I/G bit) are set to “1.” Therefore, Layer 2 broadcasts are part of the Layer 2 multicast set.

Or, more importantly for your co-worker, all Layer 2 broadcasts are multicasts. All layer 2 multicasts are not broadcasts.

Sorry I couldn’t help you out much here, but I’m sure this will teach you a valuable lesson in life: Don’t argue with women. Whether you understand it or not, there is some method or rule set that will make them right and you wrong! (Fortunately there isn’t anyone around to smack me at the moment, though I’m sure it will catch up with me!)

For some further information about the I/G bit:

http://www.synapse.de/ban/HTML/P_LAYER2/Eng/P_lay207.html
http://www.microsoft.com/technet/community/columns/cableguy/cg0202.mspx
http://www.faqs.org/rfcs/rfc1469.html

-- Scott

Send your toughest CCIE-level technical questions to editor@tcpmag.com.

back to question

Scott Morris, quadruple CCIE, JNCIE and all-around uber-geek, can often be seen traveling around the world consulting and delivering CCIE training. He recently accepted a new Senior CCIE Instructor position with Internetwork Expert! For more information on him check out http://www.uber-geek.net or for CCIE training check out http://www.internetworkexpert.com. You can contact Scott via editor@tcpmag.com. You can contact Scott about "Broadcasts Are from Mars, Multicasts Are from Venus" at editor@tcpmag.com.