arpmac addressmulticastswitchswitching
So a few questions that I've struggled to find firm answers on.
1: Does multicast use arp? So does it ask for a corresponding IP address?
I think the answer is no, as it translates the IP to a MAC itself. But I'd like confirmation of this please. Wireshark would also suggest it doesn't.
2: When a machine engages in multicast, what MAC address in the CAM table does the switch record for the machine? On an access port we can't allow 2 ports to have the same mac can we?
I am assuming you're using "bridge-mode" for networking (your internal, virtual adapter is bridged to your host's physical adapter).
In any case (unless you explicitlly manually set them to the same address, which causes a lot of other problems), your guest (WinXP) machine will have a different MAC address than your host (CentOS). Due to bridge-mode, your host acts as an ethernet switch, and forwards packets to the guest.
So when an ARP broadcast comes, your host gets the packet and also forwards it to your guest machine. When packets for your host come, they are processed by your host's network stack. When packets for your guest come, the host forwards them to your guest, which then processes them as needed.
Good question. I'll answer it with an animation:
When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports.
This assures that if host B exists (which at this point, the switch does not know yet), that it will receive it. Hopefully, upon receiving the frame, Host B will generate a response frame, which will allow the Switch to learn the MAC address mapping from the return frame.
You can read more about how a Switch works here (where I took the animation from). I would also suggest reading the entire article series for a closer look at how a packet moves through a network.
One last note regarding the terms Flooding vs Broadcast. A switch never broadcasts frames, a broadcast is not an action a switch can take. A switch can only flood a frame. A broadcast is simply a frame with a destination MAC address of ffff.ffff.ffff. This is often confused because the end effect is the same, but they are actually different.
Best Answer
Multicast is a version of broadcast, which sends the frames to all switch interfaces.
Having said that, there is something called IGMP snooping that allows switches that support this to listen in on the IGMP conversations between hosts and a multicast router to see which switch interfaces want traffic from specific multicast groups. Switches that support this will only send traffic destined for a multicast group to those interfaces that have a destination interested in the traffic destined to that multicast group.
Not all switches support IGMP snooping. It is not something that is required, and pure layer-2 switches will send multicast frames to all switch interfaces.
By the way, switches don't use ARP, which is a layer-3 to layer-2 resolution protocol. Layer-2 switches don't know anything about layer-3. Layer-2 switches do maintain MAC address tables to resolve layer-2 addresses to switch interfaces, but not to layer-3 addresses.