Ethernet Broadcast MAC Address – Document or Standard Designation ffff.ffff.ffff

How Routers Handle Limited and Directed Broadcasts

The first thing to understand to answer your questions is that limited broadcast frames are not routed. By default when a router receives a frame with a destination address that is broadcast at either layer 2 or layer 3, the router simply drops the frame. That's why routers are said to be the boundary of broadcast domains.

Some examples of these would be:

• ff-ff-ff-ff-ff-ff (layer 2 broadcast)
• 255.255.255.255 (layer 3 limited broadcast)

Thinking about it, this makes sense. If routers forwarded broadcasts a single arp request would reach every single reachable host on the internet which would be terribly inefficient and rather silly.

Directed broadcasts on the other hand are sometimes routed. (I.E. 192.168.1.255/24) Normally by default this functionality is disabled but can be enabled by issuing the ip directed-broadcast command on the router. This will allow it to forward directed broadcasts according to its routing table as if they were normal packets. This does not however allow the router to forward limited broadcasts, those are still blocked by default. This is also slightly off topic as to your original question, see this cisco forms page for more on this.

Layer 3 Broadcast But not Layer 2?

To answer your second question, it would make no sense to have a frame with a layer 3 broadcast address without a layer 2 broadcast address. This would defeat the entire purpose of it being a broadcast frame and just not work outright. Having a unicast layer 2 destination address would not change the router's behavior at all since the router makes its decisions at layer 3. All the router cares about is that 255.255.255.255 destination address and drops the packet.

Where this would matter is with switches which don't care about the layer 3 address at all. The switches would only see the unicast layer 2 address. Instead of sending the packet out all interfaces on the same vlan it would use the source address table (SAT) like it would with any other unicast destination address. In effect, by assigning a unicast layer 2 address the frame is no longer a broadcast frame at all even though it has the 255.255.255.255 address at layer 3.

How DHCP Relay Works in Practice

As for your last question, DHCP relay is a router's way of "cheating" around the rule about not forwarding broadcast packets. Let's look at a DHCP Discover packet:

• Source MAC: [unicast mac of the source]
• Dest MAC: ff-ff-ff-ff-ff-ff
• Source IP: 0.0.0.0
• Destination IP: 255.255.255.255
• Source Port: UDP 68
• Destination Port: UDP 67

When the router sees a packet arrive on an interface with the ip helper-address command configured it checks to see is it matches any of the protocols that are "helped" by default or configured with the global ip forward-protocol command. In this case because it's DHCP the router sees that the destination port matches UDP 67 and allows the packet to be "helped". The router then changes the destination IP address from 255.255.255.255 to the IP address configured by the ip helper-address command as well as changing the source address to the address of the router interface on which the packet arrived and passes the packet along to the rest of the routing logic.

Now that the packet has a unicast destination address the router treats it like any other packet. It arps for the destination IP address (which is now that helper address) and then replaces the layer 2 addresses before sending the packet out the appropriate interface.

Getting Back Again

The router uses essentially the same process in reverse for the DHCP offer that is sent back to the client. The DHCP servers sends the offer to the IP address that was specified as the source address on the DHCP Discover packet. So the packet leaving the DHCP server looks like:

• Source MAC: unicast mac of the DHCP server
• Dest MAC: mac address of the router or the DHCP server's default gateway
• Source IP: unicast IP address of the DHCP server
• Destination IP: ip address of the first router interface that the DHCP Discover packet reached
• Source Port: UDP 67
• Destination Port: UDP 68

Since this packet has a unicast layer 3 destination address routers will forward the packet normally until it reaches the router with an interface that has an IP address matching the destination IP of the packet. Remember from earlier that this router has the ip helper-address configuration on that interface still. The router checks if the packet is a DHCP Offer then rewrites the packet to become a broadcast packet and sends it back out that interface knowing that the DHCP client is somewhere on that network segment. The packet leaving the router now looks like this.

• Source MAC: unicast mac of the router interface
• Dest MAC: ff-ff-ff-ff-ff-ff
• Source IP: unicast IP address of the DHCP server
• Destination IP: 255.255.255.255
• Source Port: UDP 67
• Destination Port: UDP 68

TL:DR; DHCP relay using the ip helper-address interface subcommand "cheats" around the rule that routers cannot forward limited broadcasts by changing the packet's destination IP address to the unicast IP address of the DHCP server before routing it. This allows all routers down the line to route the packet appropriately to the DHCP server. When replying the DHCP server sends the packet back to the unicast IP address of the router interface that first received the DHCP Discover packet (the one with the ip helper-interface command). When the router receives the offer back it converts it back to a broadcast packet and sends it out the interface with the client in its broadcast domain.

There is no real advantage to sending LSB (Little-endian) or MSB (Big-endian) first. As long as the same convention is followed by everyone, this allows communication to take place. To your final note, other communications protocols such as RS-232 (serial) also used Little-endian and in general, I believe it was much more common to do so.

Keep in mind that computers operate based purely on bits. Anything else you see is simply a conversion to a more "human" way to deal with the bits.

If you were to use Big-endian, then the easiest way to store the same 48-bit address in memory would be as follows:

0100 1000 0010 1100 0110 1010 0001 1110 0101 1001 0011 1101

If the bits actually had significance beyond being just bits, then you would end up with the following in hex:

4 8 2 C 6 A 1 E 5 9 3 D

So your Little-endian address hex representation of the bits is 12-34-56-78-9A-BC, but the very same address in a Big-endian network would be 48-2C-6A-1E-59-3D (if I did all that right...been a while since I had to convert Little-endian addressing to Big-endian). The exact same address, just a different way to store/transmit the bits.

Heading off the beaten path, so feel free to stop reading...

This lead to some really interesting interactions with TCP/IP. Since Ethernet (Little-endian) came before Token Ring (Big-endian), ARP was designed around the Little-endian addressing. When you bridged traffic between Ethernet and Token Ring, the bridge has to support IP (in order to recognize ARP packets) and re-order the bits in the ARP address fields appropriately. This was a less than ideal solution as it forced L3 functionality on L2, but it did resolved the problem.

When FDDI (Big-endian) came along even later, the TCP/IP designers wanted to avoid this problem and designed ARP on FDDI to use Little-endian for the address fields. This avoided having to modify both the headers and the payload of ARP packets when bridging Ethernet to FDDI. However, it also meant a bridge connecting Token Ring to FDDI would need to re-order the bits in the address fields. It was just much rarer to bridge Token Ring to FDDI than it was to bridge Ethernet to FDDI.

Other protocols such as AppleTalk were also similarly affected, but generally weren't provided a solution as they were not as prevalent as TCP/IP. So, if you were to bridge Ethernet to Token Ring, this would break AppleTalk.