What are unicast/non-unicast packets?

Discussion in 'Networking Issues' started by swiego, Nov 1, 2007.

  1. swiego

    swiego LI Guru Member

    netstat -e shows a bunch of unicast packets and fewer non-unicast packets. Exactly what is the difference? Is there anything bad or interesting about non-unicast packets? What causes them?

    I searched online and had quite a tough time finding something that actually explained what these were....
  2. thepianobar

    thepianobar Network Guru Member

    there isn't anything bad about a non-unicast packet that I'm aware.

    there are basically three types of packets in this sense... unicast, multicast and broadcast.

    a unicast packet is a packet sent directly from one device to one other device, it has a destination ip address that falls within the following range (besides the network address and broadcast address for each network/subnet, which are the first and last address in a subnet's address range).

    a multicast address is an address in the range of multicast addresses are used to send one packet from a source and have it propagated to multiple destinations. think of a corporate meeting where one person is sharing their desktop or presentation to multiple attendees. If there are 25 attendees the source computer sends one multicast packet rather than 25 copies of the same multicast packet.

    you can also send broadcast messages. layer-3 broadcast addresses are always the last address in a subnet's address range, for instance for the network, the broadcast address for the subnet is a layer-2 broadcast mac address is 1111.1111.1111 which is used by clients sending a dhcpdiscover packet when trying to get a DHCP lease. but these messages are not forwarded by layer-3 devices (i.e. they are not routed), so they don't travel outside of a subnet or network. interestingly, broadcasts go away entirely in IPv6 since they unnecessarily use up so much bandwidth.

    Multicast isn't all that widely used outside of corporations, so I'm curious if MS is counting broadcasts as "non-unicast" packets since I see a decent number of them when I do a netstat -e. I had trouble searching for a specific answer to the question of what MS thinks is a "non-unicast" packet as well. But suffice to say, it's not a bad thing.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice