0

I have what I believe is a somewhat obscure question. I have a very specific use case here, so please consider this question purely academic.

I have a device (running Linux 2.4 kernel) which transmits IP UDP multicast packets via Ethernet. I need to be able to control the destination MAC address of the frames. Normally, when sending a UDP multicast frame via a regular UDP socket, the destination MAC is automatically derived by means of the standard mapping, which is basically 01:00:5E:XX:XX:XX, where XX represent the last 3 octets (actually 23 bits I think) of the IP. For unicast frames, the destination MAC is obviously obtained via ARP.

My question is:

If I add a static ARP entry for the multicast IP, is there a guarantee that the system will use that destination MAC instead of the standard mapping? I’ve tested this out on the system and it does seem to work, but I was curious if this is a defined behavior.

I would have expected UDP multicast packets to bypass the whole ARP table lookup mechanism as an optimization, but apparently that’s not the case.

It seems like it does in fact scan the static ARP table even for multicast packets. However, it will not transmit an ARP request if it doesn’t find an entry. Instead, it seems to fall back to the standard mapping. This is a sensible behavior to me.

I’ve tried to navigate the kernel IP stack source to better understand where the decision is made about whether to do an ARP lookup or not, but I’m having a little trouble.

If someone could point me to where this decision is made in the kernel source, that would be greatly appreciated. From what I gather now, the packet first goes to udp_sendmsg in “udp.c”. Then, from there, it gets handed off to “ip_output.c”. I'm not sure where the ARP lookup happens though.

Jake

Corvette1250
  • 3
  • 1

1 Answers1

0

I can't tell you where exactly the Kernel decides where to send the packets but this behaviour is definitely standard and was implemented with performance and the OSI-model in mind. ARP is on a lower layer than IP so if the Kernel finds an ARP entry for an IP it doesn't have to check for anything else. It doesn't need to know if it's a multicast address or not, it just sends the packets to the given MAC.

Also keep in mind that there is only one ARP table, static entries just have an additional (PERM) flag, so basically the Kernel always checks this table first since once an IP (static or not) is present the Kernel doesn't have to do any additional lookups/calculations for it like what is the network address, what is the netmask, what is the multicast address, is the given IP is a multicast IP and if it is create the multicast frame. In fact, multicasts are more of a special case than unicasts so doing a multicast check BEFORE checking the ARP-table wouldn't be an optimization at all.

Though in this case it might be a bit distracting since ARP is kind of a transitional layer between IP and Ethernet but in principle you can keep in mind that ARP is on a lower layer than IP, thus ARP always overrules IP.

Broco
  • 1,919
  • 12
  • 21