Solved

UNKNOWN /Unicast-Multicast and Broadcast Terminology

Posted on 2016-08-28
8
110 Views
Last Modified: 2016-09-25
I have encontered some words that are not really clear to understand such as:

Unknown Unicast, is it a Broadcast ?
Unknown Multicast ?


any clarifications ?

Thank you
0
Comment
Question by:jskfan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 81

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 250 total points (awarded by participants)
ID: 41773825
This happens when you plug in a new client into a network and someone tries to access it. Since no other switch knows how to route to that device (which switch and port) So the switch will send an unknown unicast packet (like a broadcast) to discover which switch and which port the destination is. It will then learn that route.

Unknown unicast traffic consists of unicast packets with unknown destination MAC addresses. By default, the switch floods these unicast packets that traverse a VLAN to all interfaces that are members of that VLAN. Forwarding this type of traffic can create unnecessary traffic that leads to poor network performance or even a complete loss of network service. This flooding of packets is known as a traffic storm.

To prevent a traffic storm, you can disable the flooding of unknown unicast packets to all VLAN interfaces by configuring specific VLANs or all VLANs to forward all unknown unicast traffic traversing them to a specific interface. You can configure multiple VLANs to forward unknown unicast packets to the same interface or configure different interfaces for different VLANs. This channels the unknown unicast traffic traversing VLANs to specific interfaces instead of flooding all interfaces.
https://www.juniper.net/documentation/en_US/junos16.1/topics/concept/rate-limiting-unknown-unicast-forwarding-understanding.html

From a switch's forwarding point of view, there is not much of a difference between unknown unicast and broadcast. The main difference is that broadcast frames are by nature meant to be sent to all ports in the specific VLAN, while unknown unicast are only initially sent to all ports - once the outgoing port is learned, the switch will only forward it out the port where the receiver is located.

A broadcast frame can be identifed by examining the destination MAC address - it will be all one's (FF:FF:FF:FF:FF:FF).



Unknown multicast is when the switch isn’t running IGMP Snooping.  Without multicast support, the switch doesn’t know which ports the receivers are on.  So instead, it just treats multicast like a broadcast and sends it everywhere.  If IGMP snooping is on then multicast is forwarded like unicast, where the CAM table is checked to see which ports are subscribed to the MAC address.  The difference is that in unicast only one port can be subscribed to a MAC address at a time (i.e. the same MAC can’t be on 2 ports at the same time) but with multicast it can.

http://ieoc.com/forums/t/29903.aspx
1
 

Author Comment

by:jskfan
ID: 41775138
I checked the link above http://ieoc.com/forums/t/29903.aspx


<<The main difference is that broadcast frames are by nature meant to be sent to all ports in the specific VLAN>>

Ok the Broadcast is clear

the Unknown Unicast is not clear , on the same site it says :
<< while unknown unicast are only initially sent to all ports - once the outgoing port is learned, the switch will only forward it out the port where the receiver is located.>>

Initially sent to all ports ? are all ports on the switch or all ports on the same VLAN ?

Not clear yet
0
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 41775517
all ports just like a broadcast packet. it is so it can learn the path and port for future reference.
0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 

Author Comment

by:jskfan
ID: 41776521
so where is the difference between Unknown Unicast and Broadcast?
0
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 41776797
The packet header is different
0
 

Author Comment

by:jskfan
ID: 41782002
The packet header is different
How is it different? can you please elaborate a little bit on that ?
0
 
LVL 30

Accepted Solution

by:
Predrag Jovic earned 250 total points (awarded by participants)
ID: 41786623
example - L3 network 192.168.0.0/24

Unknown unicast - packet with destination IP address other than broadcast IP address (e.g 192.168.0.14)
Broadcast - packet with destination address 192.168.0.255
the Unknown Unicast is not clear, on the same site it says :
<< while unknown unicast are only initially sent to all ports - once the outgoing port is learned, the switch will only forward it out the port where the receiver is located.>>
Process is called flooding. Once when host that is destination for unknown unicast traffic send any traffic - flooding stops since need for flooding is gone, destination address is known from that moment. If there is no host with specific IP address present flooding continues - that's the actual problem that should be prevented. :)
0
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 41814546
Predrag's comment was a real life scenario rather than a textbook answer
0

Featured Post

Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question