Multicast IP Address to MAC address mapping

 Multicast IP address live in the 224.0.0.0 – 239.255.255.255 range but what about MAC addresses and Ethernet frames? What do we do on layer 2 to make multicast work? Let me show you an example of a MAC address:

Above you see an example of a MAC address. In the first octet, bit 0 has been reserved for broadcast or multicast traffic. When we have unicast traffic this bit will be set to 0. For broadcast or multicast traffic this bit will be set to 1.

On layer 3 IANA has reserved the class D range (224.0.0.0 – 239.255.255.255) for multicast IP addresses. What about layer 2? What MAC addresses do we use for multicast traffic?

For layer 2 we also have a reserved prefix to use for multicast traffic. The 24-bit MAC address prefix 01-00-5E is reserved for layer 2 multicast. Unfortunately only half of the MAC addresses in this 24-bit prefix can be used for multicast, this means we only have 23 bits of MAC address space to use for multicast. Here’s an illustration:

As you can see the first 3 octets are 01-00-5E. This is the reserved range. This means there are 8+8+8 = 24 bits left for us to use. I just told you that only half of this 24-bit space is available to us which means that only 23 bits can be used. Why can we only use 23 bits?

There’s a funny story why we only have 23 bits left…back in the days (1990 something) Steve Deering was working on his research on IP multicast and he wanted the IEEE to assign 16 OUIs (Organizational Unique Identifiers) to IP multicast MAC addresses. each OUI has 24 bits of address space, so 16 x 24 bits would supply enough MAC addresses to create a 1:1 relation between multicast IP address and multicast MAC address.

Each OUI costed $1000 and Steve’s manager didn’t want to pay 16 x $1000 = $16.000 just for MAC address space. As a result Steve’s manager bought a single OUI (24 bit) and gave half of the space (23 bit) to Steve to use for his multicast research. Why does this matter? Let me show you:

Above you see an IP address which has 32 bits. A multicast IP address also has 32 bits but the first 4 bits are always the same (1110) because we use the 224.0.0.0 – 239.255.255.255 range. This means that each multicast IP address has 28 unique bits.

Now if we want to map our 28 bit multicast IP address to our 23 bit MAC address we have a problem…we miss 5 bits of mapping information:

This means that we have to map multiple Multicast IP addresses to the same Multicast MAC address. We don’t have enough MAC addresses to give each multicast IP address its own MAC address.

We miss 5 bits of mapping information: 25 = 32. This means we will map 32 multicast IP addresses to 1 multicast MAC address. Here’s an example:

• 224.1.1.1
• 224.129.1.1
• 225.1.1.1
• …
• …
• …
• 238.1.1.1
• 238.129.1.1
• 239.1.1.1

The multicast IP addresses above all map to the same multicast MAC address (01-00-5E-01-01-01). This can cause some problems in our networks. For example, a host that listens to the 239.1.1.1 multicast IP address will configure its network card to listen to MAC address 01-00-5E-01-01-01. If someone else is streaming to the 224.1.1.1 multicast IP address it will also end up at our host because the MAC address is the same. The host will have to look at the IP address of the received frame to see if it’s for 239.1.1.1 and discard frames that are meant for 224.1.1.1.

Now the big question remains…what multicast IP addresses map to which multicast MAC address and how do we calculate this? You can use a calculator of course but if you are studying for a Cisco exam you don’t have this luxury. Let’s take a look at how to do this!

First we’ll figure out which multicast MAC address maps to which 32 multicast IP addresses. You can use the following table  to calculate between decimal, hexadecimal and binary:

Decimal	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15
Hexadecimal	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
Binary	0000	0001	0010	0011	0100	0101	0110	0111	1000	1001	1010	1011	1100	1101	1110	1111

We will take the following multicast MAC address and calculate what 32 multicast IP addresses map to it:

01:00:5e:0b:01:02

First we have to translate this MAC address from hexadecimal to binary:

0	1	0	0	5	e	0	b	0	1	0	2
0000	0001	0000	0000	0101	1110	0000	1011	0000	0001	0000	0010

Above you can see how I translated the hexadecimal address into binary, this is the full MAC address:

0000 0001

0000 0000

0101 1110

0000 1011

0000 0001

0000 0010

Now we will take the lowest 23 bits of this MAC address:

0000 0001

0000 0000

0101 1110

0000 1011

0000 0001

0000 0010

The bits that I highlighted in red are the lowest 23 bits of the MAC address.

Now we will take the class D multicast IP address range in binary:

1110 0000

0000 0000

0000 0000

0000 0000

The digits in blue (1110) are the class D IP address in binary (224 in decimal). The green digits are the 5 bits that we lose because we have to map a 28 bit unique multicast IP address to a 23 bit multicast MAC address. We will take the blue and green digits and put the red digits behind them:

1110 0000

0000 1011

0000 0001

0000 0010

Let’s convert this binary address into a decimal IP address:

224	11	1	2
1110 0000	0000 1011	0000 0001	0000 0010

So the complete multicast IP address is 224.11.1.2. Now we can play with the green digits to see what other multicast IP addresses map to the same MAC address:

Binary Multicast IP Address	Decimal Multicast IP Address
1110 0000 0000 1011 0000 0001 0000 0010	224.11.1.2
1110 0001 0000 1011 0000 0001 0000 0010	225.11.1.2
1110 0010 0000 1011 0000 0001 0000 0010	226.11.1.2
1110 0011 0000 1011 0000 0001 0000 0010	227.11.1.2
1110 0100 0000 1011 0000 0001 0000 0010	228.11.1.2
1110 0101 0000 1011 0000 0001 0000 0010	229.11.1.2
1110 0110 0000 1011 0000 0001 0000 0010	230.11.1.2
1110 0111 0000 1011 0000 0001 0000 0010	231.11.1.2
1110 1000 0000 1011 0000 0001 0000 0010	232.11.1.2
1110 1001 0000 1011 0000 0001 0000 0010	233.11.1.2
1110 1010 0000 1011 0000 0001 0000 0010	234.11.1.2
1110 1011 0000 1011 0000 0001 0000 0010	235.11.1.2
1110 1100 0000 1011 0000 0001 0000 0010	236.11.1.2
1110 1101 0000 1011 0000 0001 0000 0010	237.11.1.2
1110 1110 0000 1011 0000 0001 0000 0010	238.11.1.2
1110 1111 0000 1011 0000 0001 0000 0010	239.11.1.2
1110 0000 1000 1011 0000 0001 0000 0010	224.139.1.2
1110 0001 1000 1011 0000 0001 0000 0010	225.139.1.2
1110 0010 1000 1011 0000 0001 0000 0010	226.139.1.2
1110 0011 1000 1011 0000 0001 0000 0010	227.139.1.2
1110 0100 1000 1011 0000 0001 0000 0010	228.139.1.2
1110 0101 1000 1011 0000 0001 0000 0010	229.139.1.2
1110 0110 1000 1011 0000 0001 0000 0010	230.139.1.2
1110 0111 1000 1011 0000 0001 0000 0010	231.139.1.2
1110 1000 1000 1011 0000 0001 0000 0010	232.139.1.2
1110 1001 1000 1011 0000 0001 0000 0010	233.139.1.2
1110 1010 1000 1011 0000 0001 0000 0010	234.139.1.2
1110 1011 1000 1011 0000 0001 0000 0010	235.139.1.2
1110 1100 1000 1011 0000 0001 0000 0010	236.139.1.2
1110 1101 1000 1011 0000 0001 0000 0010	237.139.1.2
1110 1110 1000 1011 0000 0001 0000 0010	238.139.1.2
1110 1111 1000 1011 0000 0001 0000 0010	239.139.1.2

https://networklessons.com/multicast/multicast-ip-address-to-mac-address-mapping

Command to find users attacking a file in linux

 cat auth.log | grep "input_usr_auth_request" | awk '{print $9}' | sort -u > users.txt

Python

https://www.kaggle.com/abhat222/python-tutorial-part1#Dictionary

https://www.kaggle.com/abhat222/python-tutorial-part2#Container

https://www.kaggle.com/abhat222/numpy-tutorial

OSPF/BGP Fast Convergence

 For OSPF:

a) Failure Detection: BFD

b) Failure Propogation : OSPF Timers (Throttle timers)

• OSPF “timers throttle lsa all <lsa-start> <lsa-hold> <lsa-max>” command

sub-second lsa-hold timer requires “timers lsa arrival n” tuning on all nodes within the area to tune “MinLSArrival”

c) SPF Calculation:

incremental SPF (iSPF) only calculates part of the SPT which is affected

OSPF Example: timers throttle spf 50 100 2000

d) RIB and FIB update: depends on scale and the trigger

e) Platform/Infrastructure:

JUNOS YAML vs JSON

YAML is superset of JSON

JSON:

• Junos OS configuration
• Junos OS operational command outputs
• Junos REST API

YAML:

• Junos PyEZ tables
• Ansible Playbooks
• JSNAPy

List :

    JSON : Arrays

    YAML: Sequence

Dictionaries:

    JSON: Objects

    YAML: Mapping

Junos Automation Stack

 

• Processes required for automating junos devices are mgd(management process) and jsd(jet service processes)
• mgd handles automation requests invloving junox XML APi, Yang, Rest API
• jsd handles automation requuests involving Juniper Extension Toolkit(JET) API.

JUNOS Architecture

Transit Traffic:

Wont enter RE and directly processed in PFE and requires a forwarding table entry for destination.

If requires duplicates the packet on to multiple egress port.

Exception Traffic:

Traffic destined to local system(routing protocol updates, telnet, ping traceroute)

Ip packets with ip option field set

traffic that requires generation of icmp messages

forwarding plance <-> control plane internal link is rate limited to prevent DOS attacks

Control traffic is given preference