Send one packet to four kinds of destination

short · 30 min · Objective 1.4

Task

Generate unicast, broadcast, multicast and anycast traffic in turn and observe who receives each. The four traffic types are a definition question on the exam and a two-minute demonstration in a lab.

Steps

  1. Start sudo tcpdump -i eth0 -n -e on Host C and leave it running. You are going to judge each traffic type by whether it appears there.
  2. Unicast. From Host A: ping -c 2 192.168.10.1. Host C should see nothing, because a switch forwards a known unicast only out the port that owns the destination MAC.
  3. Broadcast. From Host A: ping -c 2 -b 192.168.10.255, where the -b flag is what permits a broadcast ping. Host C sees it, with destination MAC ff:ff:ff:ff:ff:ff.
  4. Multicast. From Host A: ping -c 3 224.0.0.1, the all-hosts multicast group. Host C sees it, and note the destination MAC begins 01:00:5e, which is the IPv4 multicast MAC prefix.
  5. Anycast. You cannot demonstrate this on one segment: anycast is the same address advertised from several places and resolved by routing. Instead run traceroute -n 1.1.1.1 from your laptop on a network you own, and note that the same address answers from different places depending on where you are.

Verify

sudo tcpdump -i eth0 -n -e -c 10 'broadcast or multicast'
ip maddr show

The capture must show both ff:ff:ff:ff:ff:ff for the broadcast and a 01:00:5e:... destination for the multicast, and ip maddr show must list the multicast groups the interface has joined, with 224.0.0.1 among them.

Notes

The MAC prefix is the detail worth taking away. Multicast is not a broadcast-with-manners at layer 2: the group address maps to a specific MAC range, which is what lets a switch running IGMP snooping forward it only to ports that asked for it. Without snooping, a switch floods multicast the way it floods broadcast, and that is a real cause of the saturation faults in domain 5.

Broadcast stops at the router, and you can prove it by watching Host B while step 3 runs. That is the same boundary the topology lab measured.