Who’s the Man Blog

If you have never logged into a *nix box on your network or onto a core router (if you have one) and ping-ed a couple multicast addresses your missing some fun. Lets say I was trying to track a router down the was misconfigured to use RIPv2. Obviously the easiest way is to wait for the router to send its broadcast out and read it with a packet sniffer.  But what if you don’t have a packet sniffer handy(wait everybody has at least wireshark) and your just logged into a *nix box or router/switch.  Answer: Ping the multicast address ! If you ping the address 224.0.0.9(the multicast address for RIPv2), your off and running. You should receive the pings from the devices configured to listen on that address. Unfortunately this doesn’t work the same in windows the ping program only looks for one reply and stops looking after that versus the *nix and router/switch see all the replies and list them all.

responses from multicast ping

Here is a list of well know router protocols and their multicast addresses: 

• 224.0.0.1 all hosts on a subnet
• 224.0.0.2 all routers on a subnet
• 224.0.0.4 Distance Vector Multicast Routing Protocols (DVMRP)
• 224.0.0.5 OSPF routers
• 224.0.0.6 OSPF designated routers
• 224.0.0.9 RIP Version 2 routers
• 224.0.0.10 EIGRP
• 224.0.0.13 Protocol independent Multicast (PIM)

 Happy pinging!