I picture IP multicast as groups in whatsapp, or to send a packet of data to all endpoints under a node in the network.

The maximum group is the top 104 bits of an IP V6 TCPIP address – or, to put it a different way, having a different right 24 bits.

With an IP address of 2001:0123:4567:89ab:cdef:0123:4567:89ab the maximum group is 2001:0123:4567:89ab:cdef:0123:45..:…. to send a packet to members of the group you use address ff02:0000:0000:0000:0000:0001:ff.:…. or (in abbreviated form) ff02::1:ff .

There are different groups. One of my interfaces is a member of the following “groups”

• ff01::1 all nodes
• ff02::2 all routers
• ff02::1:ff67:89ab this is a group for this specific address. When an interface is started, it sends a packet saying “does anyone have this address 67:89ab” to the group ff02::1:ff67:89ab. If there is a reply – then the value you are using is a duplicate. This is known as DAD Duplicate Address Detection.
• ff02::fb multicast DNS IPv6

IP V4

When an IP V4 interface starts it broadcasts (similar to multicast) “ARP: I am address 10.1.1.2, this is my MAC address, and I my status is UP”

Displaying multicast information on Linux

linux netstat –groups

This gives information like

IPv6/IPv4 Group Memberships
Interface       RefCnt Group
--------------- ------ ---------------------
lo              1      mdns.mcast.net
lo              1      all-systems.mcast.net
eno1            1      mdns.mcast.net
eno1            1      all-systems.mcast.net
...
lo              1      ff02::fb
lo              1      ip6-allnodes
lo              1      ff01::1
eno1            1      ff02::fb
eno1            1      ff02::1:ffa8:b879
eno1            1      ip6-allnodes
eno1            1      ff01::1
...

Where ip6-allnodes is ff02::1

For z/OS

For an interface with addresses 2001:db8:8::f and 2001:DB8::0067:89ab
TSO NETSTAT DEVLINKS

IntfName: JFPORTCP6         IntfType: IPAQENET6  IntfStatus: Ready 
...
   Multicast Specific: 
     Multicast Capability: Yes
     Group:     ff02::1:ff67:89ab 
       RefCnt:  0000000001  SrcFltMd: Exclude 
       SrcAddr: None  
     Group:     ff02::1:ff00:4 
       RefCnt:  0000000001  SrcFltMd: Exclude 
       SrcAddr: None 
     Group:     ff02::1:ff00:9 
       RefCnt:  0000000001  SrcFltMd: Exclude 
       SrcAddr: None 
     Group:     ff02::1:ffa2:a2a2 
       RefCnt:  0000000001  SrcFltMd: Exclude 
       SrcAddr: None 
     Group:     ff01::1 
       RefCnt:  0000000001  SrcFltMd: Exclude 
       SrcAddr: None 
     Group:     ff02::1 
       RefCnt:  0000000001  SrcFltMd: Exclude 
       SrcAddr: None 

• ff02::1:ff67:89ab is a group for the address 2001:DB8::0067:89ab
• ff02::1:ff00:9 is group for the address with 2001:db8:8::9
• ff01::1 is for all nodes.

Issuing the first ping

I have a laptop connected to a server over Ethernet. The laptop had address 2001:7::1, and the server had IP address 2001:7::2. I defined a route from the laptop to the server

The first time an IP address 2001:7::2 was used on the laptop, there was a flow to all nodes ff02::1:ff, for address 2001:7::2, and a response from 2001:7::2

2001:7::1 ff02::1:ff00:2 ICMPv6 Neighbor Solicitation for 2001:7::2 from ...
2001:7::2 2001:7::1      ICMPv6	Neighbor Advertisement 2001:7::2 (sol, ovr) is at ...

This sends a request from 2001:7::1 to all routers asking “does any one have address 2001:7::2”. Device 2001:7::2 advertises to 2001:7::1 “I have the address”.