Solved

UNKNOWN /Unicast-Multicast and Broadcast Terminology

Posted on 2016-08-28
8
37 Views
Last Modified: 2016-09-25
I have encontered some words that are not really clear to understand such as:

Unknown Unicast, is it a Broadcast ?
Unknown Multicast ?


any clarifications ?

Thank you
0
Comment
Question by:jskfan
  • 4
  • 3
8 Comments
 
LVL 78

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 250 total points (awarded by participants)
Comment Utility
This happens when you plug in a new client into a network and someone tries to access it. Since no other switch knows how to route to that device (which switch and port) So the switch will send an unknown unicast packet (like a broadcast) to discover which switch and which port the destination is. It will then learn that route.

Unknown unicast traffic consists of unicast packets with unknown destination MAC addresses. By default, the switch floods these unicast packets that traverse a VLAN to all interfaces that are members of that VLAN. Forwarding this type of traffic can create unnecessary traffic that leads to poor network performance or even a complete loss of network service. This flooding of packets is known as a traffic storm.

To prevent a traffic storm, you can disable the flooding of unknown unicast packets to all VLAN interfaces by configuring specific VLANs or all VLANs to forward all unknown unicast traffic traversing them to a specific interface. You can configure multiple VLANs to forward unknown unicast packets to the same interface or configure different interfaces for different VLANs. This channels the unknown unicast traffic traversing VLANs to specific interfaces instead of flooding all interfaces.
https://www.juniper.net/documentation/en_US/junos16.1/topics/concept/rate-limiting-unknown-unicast-forwarding-understanding.html

From a switch's forwarding point of view, there is not much of a difference between unknown unicast and broadcast. The main difference is that broadcast frames are by nature meant to be sent to all ports in the specific VLAN, while unknown unicast are only initially sent to all ports - once the outgoing port is learned, the switch will only forward it out the port where the receiver is located.

A broadcast frame can be identifed by examining the destination MAC address - it will be all one's (FF:FF:FF:FF:FF:FF).



Unknown multicast is when the switch isn’t running IGMP Snooping.  Without multicast support, the switch doesn’t know which ports the receivers are on.  So instead, it just treats multicast like a broadcast and sends it everywhere.  If IGMP snooping is on then multicast is forwarded like unicast, where the CAM table is checked to see which ports are subscribed to the MAC address.  The difference is that in unicast only one port can be subscribed to a MAC address at a time (i.e. the same MAC can’t be on 2 ports at the same time) but with multicast it can.

http://ieoc.com/forums/t/29903.aspx
1
 

Author Comment

by:jskfan
Comment Utility
I checked the link above http://ieoc.com/forums/t/29903.aspx


<<The main difference is that broadcast frames are by nature meant to be sent to all ports in the specific VLAN>>

Ok the Broadcast is clear

the Unknown Unicast is not clear , on the same site it says :
<< while unknown unicast are only initially sent to all ports - once the outgoing port is learned, the switch will only forward it out the port where the receiver is located.>>

Initially sent to all ports ? are all ports on the switch or all ports on the same VLAN ?

Not clear yet
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
Comment Utility
all ports just like a broadcast packet. it is so it can learn the path and port for future reference.
0
 

Author Comment

by:jskfan
Comment Utility
so where is the difference between Unknown Unicast and Broadcast?
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
Comment Utility
The packet header is different
0
 

Author Comment

by:jskfan
Comment Utility
The packet header is different
How is it different? can you please elaborate a little bit on that ?
0
 
LVL 26

Accepted Solution

by:
Predrag Jovic earned 250 total points (awarded by participants)
Comment Utility
example - L3 network 192.168.0.0/24

Unknown unicast - packet with destination IP address other than broadcast IP address (e.g 192.168.0.14)
Broadcast - packet with destination address 192.168.0.255
the Unknown Unicast is not clear, on the same site it says :
<< while unknown unicast are only initially sent to all ports - once the outgoing port is learned, the switch will only forward it out the port where the receiver is located.>>
Process is called flooding. Once when host that is destination for unknown unicast traffic send any traffic - flooding stops since need for flooding is gone, destination address is known from that moment. If there is no host with specific IP address present flooding continues - that's the actual problem that should be prevented. :)
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
Comment Utility
Predrag's comment was a real life scenario rather than a textbook answer
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now