If I want to send an IPv6 UDP multicast message, how does L3 to L2 address resolution occur?

I think I understand ARP and how this same idea applies to unicast, but I am struggling to grasp the idea of how it works for multicast.

I am aware of MLD and NDP, but not sure how they come into play with my question.


1 Answer 1


IPv6 does not use ARP, it uses ND. ARP uses broadcast, which interrupts every host on the LAN, but IPv6 doesn't have broadcast. Instead, each IPv6 interface must subscribe to a solicited-node multicast address for each IPv6 unicast or anycast address configured on the interface. These solicited-node multicast addresses are based on the IPv6 unicast or anycast addresses, so, in all likelihood, the resolution request only interrupts the one host with that IPv6 address, or possibly a very few hosts. This is a better solution than ARP.

See RFC 4291, IP Version 6 Addressing Architecture, Section 2.7.1. Pre-Defined Multicast Addresses:

Solicited-Node multicast address are computed as a function of a node's unicast and anycast addresses. A Solicited-Node multicast address is formed by taking the low-order 24 bits of an address (unicast or anycast) and appending those bits to the prefix FF02:0:0:0:0:1:FF00::/104 resulting in a multicast address in the range




For example, the Solicited-Node multicast address corresponding to the IPv6 address 4037::01:800:200E:8C6C is FF02::1:FF0E:8C6C. IPv6 addresses that differ only in the high-order bits (e.g., due to multiple high-order prefixes associated with different aggregations) will map to the same Solicited-Node address, thereby reducing the number of multicast addresses a node must join.

A node is required to compute and join (on the appropriate interface) the associated Solicited-Node multicast addresses for all unicast and anycast addresses that have been configured for the node's interfaces (manually or automatically).

IPv6 uses the solicited node multicast address for the IPv6 layer-3 unicast or anycast address which it wants to resolve to the layer-2 address. A host will compute the solicited node multicast address for the address to resolve, and it will multicast a Neighbor Solicitation message to the multicast group. The host with the layer-3 address will reply with its layer-2 address.

See RFC 4861, Neighbor Discovery for IP version 6 (IPv6):

Nodes accomplish address resolution by multicasting a Neighbor Solicitation that asks the target node to return its link-layer address. Neighbor Solicitation messages are multicast to the solicited-node multicast address of the target address. The target returns its link-layer address in a unicast Neighbor Advertisement message. A single request-response pair of packets is sufficient for both the initiator and the target to resolve each other's link-layer addresses; the initiator includes its link-layer address in the Neighbor Solicitation.

To create an IPv6 layer-2 multicast address from an IPv6 layer-3 multicast address you simply use 33-33 and append the last 32-bits of the IPv6 layer-3 multicast address. This gives you a lot more layer-2 multicast addresses than IPv4 has because IPv4 only uses 23 bits of the layer-3 multicast address in the layer-2 multicast address.

See RFC 2464, Transmission of IPv6 Packets over Ethernet Networks:

  1. Address Mapping -- Multicast

An IPv6 packet with a multicast destination address DST, consisting of the sixteen octets DST1 through DST[16], is transmitted to the Ethernet multicast address whose first two octets are the value 3333 hexadecimal and whose last four octets are the last four octets of DST.

              |0 0 1 1 0 0 1 1|0 0 1 1 0 0 1 1|
              |   DST[13]     |   DST[14]     |
              |   DST[15]     |   DST[16]     |

Also, RFC 7042, IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters, Section 2.3.1. Identifiers Prefixed "33-33":

2.3.1. Identifiers Prefixed "33-33"

All MAC-48 multicast identifiers prefixed "33-33" (that is, the 2**32 multicast MAC identifiers in the range from 33-33-00-00-00-00 to 33-33-FF-FF-FF-FF) are used as specified in [RFC2464] for IPv6 multicast. In all of these identifiers, the Group bit (the bottom bit of the first octet) is on, as is required to work properly with existing hardware as a multicast identifier. They also have the Local bit on and are used for this purpose in IPv6 networks.

(Historical note: It was the custom during IPv6 design to use "3" for unknown or example values, and 3333 Coyote Hill Road, Palo Alto, California, is the address of PARC (Palo Alto Research Center, formerly "Xerox PARC"). Ethernet was originally specified by the Digital Equipment Corporation, Intel Corporation, and Xerox Corporation. The pre-IEEE [802.3] Ethernet protocol has sometimes been known as "DIX" Ethernet from the first letters of the names of these companies.)

  • How does the address mapping of multicast occur? "To create an IPv6 layer-2 multicast address from an IPv6 layer-3 multicast address you simply use 33-33 and append the last 32-bits of the IPv6 layer-3 multicast address." I understand this part, but does the stack take care of this mapping, the kernel, is it part of the neighbor cache? I am trying to understand the internals of how this occurs.
    – user_ABCD
    Jan 29, 2017 at 23:47
  • That is up to the particular OS in use, but OS operations are off-topic here. For instance, in an application opening a multicast socket, how Windows does this can be completely different than how Linux does it.
    – Ron Maupin
    Jan 29, 2017 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.