[c-nsp] Fwd: difference between "multicast" and "multicasts" counters in Catalyst "sh int" output?

[Martin T]

I crafted some packets with well-known multicast destination addresses
using Scapy and checked how switch(WS-C2950C-24) interface counts those
packets.

1) Destination MAC "01:00:0c:cc:cc:cc"(used for example by VTP or CDP) is
counted both as broadcast and multicast:

>>> sendp(Ether(dst="01:00:0c:cc:cc:cc", src="00:11:22:33:44:55"),
iface="eth0")
.
Sent 1 packets.
>>>

SW3#sh int Fa0/6 | i multi
     Received 1 broadcasts (0 multicast)
     0 watchdog, 1 multicast, 0 pause input
SW3#


2) Destination MAC "01:00:0c:cc:cc:cd"(used for example by STP) is counted
both as broadcast and multicast:

>>> sendp(Ether(dst="01:00:0c:cc:cc:cd", src="00:11:22:33:44:55"),
iface="eth0")
.
Sent 1 packets.
>>>

SW3#sh int Fa0/6 | i multi
     Received 1 broadcasts (0 multicast)
     0 watchdog, 1 multicast, 0 pause input
SW3#


3) Destination MAC "01:80:c2:00:00:00":

>>> sendp(Ether(dst="01:80:c2:00:00:00", src="00:11:22:33:44:55"),
iface="eth0")
.
Sent 1 packets.
>>>

SW3#sh int Fa0/6 | i multi
     Received 1 broadcasts (0 multicast)
     0 watchdog, 1 multicast, 0 pause input
SW3#


4) Destination MAC "01:80:C2:00:00:02":

>>> sendp(Ether(dst="01:80:C2:00:00:02", src="00:11:22:33:44:55"),
iface="eth0")
.
Sent 1 packets.
>>>

SW3#sh int Fa0/6 | i multi
     Received 1 broadcasts (0 multicast)
     0 watchdog, 1 multicast, 0 pause input
SW3#


5) Destination MAC "01:00:5e:00:11:22"(IPv4 multicast) and IPv4 multicast
destination address 239.1.1.1:

>>> sendp(Ether(dst="01:00:5e:00:11:22",
src="00:11:22:33:44:55")/IP(src="10.10.10.1", dst="239.1.1.1", proto=17),
iface="eth0")
.
Sent 1 packets.
>>>

SW3#sh int Fa0/6 | i multi
     Received 1 broadcasts (0 multicast)
     0 watchdog, 1 multicast, 0 pause input
SW3#


Finally when I send a broadcast frame, the switch counts it only as
broadcast which makes sense:

>>> sendp(Ether(dst="ff:ff:ff:ff:ff:ff",
src="00:11:22:33:44:55")/IP(src="10.10.10.1", dst="239.1.1.1", proto=17),
iface="eth0")
.
Sent 1 packets.
>>>

SW3#sh int Fa0/6 | i multi
     Received 1 broadcasts (0 multicast)
     0 watchdog, 0 multicast, 0 pause input
SW3#


I even streamed a video using ffmpeg to multicast address 239.1.1.1 using
UDP protocol through a router where multicast routing was enabled and
allowed IGMP snooping on the switch, but still multicast traffic was
counted both as broadcast and multicast in "sh int" output. In addition,
this second "multicast" counter inside the round brackets stayed 0. In a
nutshell:

1) Why does switch count frames with multicast L2 destination address both
as multicast and broadcast?

2) What is this "multicast" counter inside the round brackets in example
below?

SW3#sh int Fa0/19 | i multi
     Received 4071 broadcasts (0 multicast)
     0 watchdog, 4071 multicast, 0 pause input
SW3#



regards,
Martin

---------- Forwarded message ----------
From: Martin T <m4rtntns at gmail.com>
Date: Wed, Sep 4, 2013 at 12:01 AM
Subject: difference between "multicast" and "multicasts" counters in
Catalyst "sh int" output?
To: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>


Hi,

interface Fa0/19 on WS-C3550-24 receives various multicast frames like
VTP(dst MAC 01:00:0c:cc:cc:cc), CDP(dst MAC 01:00:0c:cc:cc:cc) and PVST(dst
MAC 01:00:0c:cc:cc:cd). Switch counts those frames as "multicast" as it
should, but besides that, it counts those as "broadcasts" as well:

SW3#sh int Fa0/19 | i multi
     Received 4071 broadcasts (0 multicast)
     0 watchdog, 4071 multicast, 0 pause input
SW3#

Is this because Ethernet switch doesn't distinguish between broadcasts and
multicasts? I mean either broadcast or multicast frame is sent out via all
ports except the port where the frame came in. Either way, I find it bit
confusing and IMHO it would be better if only FF:FF:FF:FF:FF:FF frames are
counted as "broadcasts". Last but not least, what is this "multicast"
counter with value 0?

I can see a similar behavior on Cisco 2950 series L2 switch as well:

SW4#sh int Fa0/24 | i multi
     Received 22903 broadcasts (0 multicast)
     0 watchdog, 22903 multicast, 0 pause input
SW4#


regards,
Martin