IP Multicast & Ethernet MAC addressing

Which address is a valid Ethernet MAC address used for IP multicast?

1. 0100.5f80.001c
   
2. 0100.5e1b.0110
   
3. 0100.4e70.0011
   
4. 0100.4f1f.111c
   

Well, this one surprised me a little bit. You know, I've heard about it, but never thought I would have to be able to answer it on the spot. In the exam it's not possible to look up any reference material, and this question shows the level of detail that one has to master to pass.

There are a number of good tutorials on IP Multicast Addressing. The basic idea: there must be a simple and efficient way to map layer 3 multicast addresses to layer 2. The RFC 1112 (Host Extensions for IP Multicast) specifies a combination of the Ethernet native mechanism for broadcast with a clever direct mapping technique to solve this problem.

Ethernet provides a native mechanism to handle broadcast and multicast traffic; in short, any frame which has the least significant bit of the first octet of its MAC address set is a broadcast frame, and will be retransmitted by a Ethernet switch or bridge to all destinations. In the question above, all frames match the criteria for layer 2 (the first octet is 01, so the least significant bit is set), which leaves us with the direct mapping to solve the question; it uses another property of how MAC addresses are built.

Ethernet MAC address have 48 bits; the first 24 bits comprise the OUI (organizationally uniquer identifier), which is a standard prefix that is allocated by the IEEE for specific usages. Each Ethernet adapter vendor has OUIs assigned to them; the remaining 24 bits are allocated by the vendor, the only criteria being that all addresses must be unique. The IANA (Internet Assigned Numbers Authority) has a OUI reserved (01:00:5E). For IP multicast, the first bit of the second 24-bit block is set to zero. The remaining 23 bits are used to map the IP multicast address.

IP Multicast address have a standard 4-bit prefix (1110). It's equivalent to the range from 224.0.0.0 to 239.255.255.255, also known as 'Class D' addresses in the old, pre-CIDR IP allocation scheme. The remaining 28 bits are mapped to 23 bits in the MAC address. As you may have noted, that's 5 bits less than the available space; the solution is to map the lower 23 bits and forget the 5 most significant ones. It means that there is a potential clash between 32 different IP multicast addresses to the same Ethernet MAC address; in practice, it's not a problem, because there's still plenty of space to allocate IP multicast addresses.

Looking back at the question, it's clear that the answer is (2), or "0100.5e1b.0110". All the other options have different prefixes, and thus are not valid IP multicast addresses.