TCP/IP - data transmission methods

The article was updated on 11.8. 2008.

When we want to send some data in a computer network, it is important to correctly address the message, and this is related to the method of transmission. It depends on whether we want to send data to only one station, several stations at once, or all stations in the same subnet.

Broadcast

Broadcast is one of the methods of transmission in a TCP/IP network (a connectionless protocol like UDP is used). It is a one-to-all transmission, meaning the transmitted packet is (theoretically) captured by all devices in the network, or more precisely, in the given broadcast domain (subnet). This transmission is mainly used in LAN networks (not WAN). Broadcasts are used today for many purposes (e.g., DHCP, ARP) and are utilized by many applications. They form a large part of the traffic in a LAN network and burden active network elements and stations, so there is an effort to minimize them.

Broadcast address is the address to which communication is sent in the case of broadcast transmission. It is an address that has all ones in binary. At the 3rd layer of the OSI model, it is the IP address 255.255.255.255 (sometimes the broadcast address of the subnet, i.e., the last address in the subnet, is inaccurately referred to as this, see below). At the 2nd layer (physical), the broadcast MAC address is identically the address "with all ones" FF:FF:FF:FF:FF:FF.

Broadcast domain is a logical part of the network where connected devices can communicate directly. It should be a single subnet, and the boundary is a router, which should not forward broadcasts.

Routers or VLAN technology are used to divide the network into smaller broadcast domains.

Broadcast storm is a critical state when the number of broadcasts in the network is so large that new connections cannot be created, and old connections are disrupted. It often arises due to loops in the network.

Subnet Directed Broadcast

Subnet Directed Broadcast is a special case of broadcast used when we want to send a broadcast to another subnet than the one we are in. It works by the frame traveling through the network as a unicast through routers to the router that has the target subnet (determined by the subnet's broadcast address) as directly connected. This router modifies the frame to a regular broadcast and sends it to the corresponding interface. However, because this technique was used for attacks, it is usually disabled on routers or even firewalls. This concerns the router that should convert the frame to a broadcast; it should pass through the others normally.

Subnet broadcast address (sometimes also called directed broadcast address) is an IP address consisting of the network ID and all ones in the host ID. In other words, it is the last address of the subnet (which cannot be assigned to a station). For a simple example, we have a computer with the address 192.168.10.39 and a mask of 255.255.255.0, according to the mask, we see that the first three octets form the network ID and the last octet is the host ID, so the subnet broadcast address is 192.168.10.255.

Smurf Attack is the most common case of an attack using Subnet Directed Broadcast, intended to cause a Denial of Service (DoS). The attacker sends a large number of ICMP echo reply packets with a spoofed source address as a directed broadcast, all stations in the subnet respond with echo reply, and the station whose address is spoofed is overwhelmed.

Unicast

Unicast is a transmission where the packet is sent to a single target. It is common communication where two stations communicate with each other.

Multicast

In this communication, one piece of information is delivered to a group of targets. Multicast uses an efficient delivery method so that packets travel through the network only once. The principle is that a multicast address from the range 224.0.0.0/4 (for LAN it is 224.0.0.0/24) is created, and clients register to this address. The Internet Group Management Protocol (IGMP) is used for creating groups and registration.