IPv6 over Token Ring: Transmission of IPv6 Packets over Token Ring Networks
How to carry IPv6 packets on IEEE 802.5 Token Ring, from the frame layout to the link-local address.
Crawford, M., Narten, T., and S. Thomas, "Transmission of IPv6 Packets over Token Ring Networks", RFC 2470, DOI 10.17487/RFC2470, December 1998, <https://www.rfc-editor.org/info/rfc2470>.
@misc{rfc2470,
series = {Request for Comments},
number = 2470,
howpublished = {RFC 2470},
publisher = {RFC Editor},
doi = {10.17487/RFC2470},
url = {https://www.rfc-editor.org/info/rfc2470},
author = {M. Crawford and T. Narten and S. Thomas},
title = {{Transmission of IPv6 Packets over Token Ring Networks}},
pagetotal = 11,
year = 1998,
month = dec,
} RFC text
Contents
Network Working Group M. Crawford
Request for Comments: 2470 Fermilab
Category: Standards Track T. Narten
IBM
S. Thomas
TransNexus
December 1998
Transmission of IPv6 Packets over Token Ring Networks
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (1998). All Rights Reserved.
1. Introduction
This memo specifies the MTU and frame format for transmission of IPv6
packets on Token Ring networks. It also specifies the method of
forming IPv6 link-local addresses on Token Ring networks and the
content of the Source/Target Link-layer Address option used the
Router Solicitation, Router Advertisement, Redirect, Neighbor
Solicitation and Neighbor Advertisement messages when those messages
are transmitted on a Token Ring network.
Implementors should be careful to note that Token Ring adaptors
assume addresses are in non-canonical rather than canonical format,
requiring that special care be taken to insure that addresses are
processed correctly. See [CANON] for more details.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [KWORD].
2. Maximum Transmission Unit
IEEE 802.5 networks have a maximum frame size based on the maximum
time a node may hold the token. This time depends on many factors
including the data signaling rate and the number of nodes on the
ring. Because the maximum frame size varies, implementations must
rely on manual configuration or router advertisements [DISC] to
determine actual MTU sizes. Common default values include
approximately 2000, 4000, and 8000 octets.
In the absence of any other information, an implementation should use
a default MTU of 1500 octets. This size offers compatibility with all
common 802.5 defaults, as well as with Ethernet LANs in an
environment using transparent bridging.
In an environment using source route bridging, the process of
discovering the MAC-level path to a neighbor can yield the MTU for
the path to that neighbor. The information is contained in the
largest frame (LF) subfield of the routing information field. This
field limits the size of the information field of frames to that
destination, and that information field includes both the LLC [LLC]
header and the IPv6 datagram. Since, for IPv6, the LLC header is
always 8 octets in length, the IPv6 MTU can be found by subtracting 8
from the maximum frame size defined by the LF subfield. If an
implementation uses this information to determine MTU sizes, it must
maintain separate MTU values for each neighbor.
A detailed list of the LF values and the resulting maximum frame size
can be found in [BRIDGE]. To illustrate the calculation of IPv6 MTU,
the following table lists several common values. Note that some of
the 802.1D LF values would result in an IP MTU less than 1280 bytes.
This size is less than the IPv6 minimum, and communication across
paths with those MTUs is generally not possible using IPv6.
LF (base) LF (extension) MAC MTU IP MTU
001 000 1470 1462
010 000 2052 2044
011 000 4399 4391
100 000 8130 8122
101 000 11407 11399
110 000 17749 17741
111 000 41600 41592
When presented with conflicting MTU values from several sources, an
implementation should choose from those sources according to the
following priorities:
1. Largest Frame values from source route bridging
(only for specific, unicast destinations), but only if not
greater than value from any router advertisements
2. Router advertisements, but only if not greater than any manual
configuration (including DHCP)
3. Manual configuration (including DHCP)
4. Default of 1500
3. Frame Format
IPv6 packets are transmitted in LLC/SNAP frames. The data field
contains the IPv6 header and payload. The following figure shows a
complete 802.5 frame containing an IPv6 datagram.
+-------+-------+-------+-------+
| SD | AC | FC | |
+-----------------------+ |
| Destination Address |
| +-----------------------+
| | Source |
+-------+ Address +-------+
| | DSAP |
+-------+-------+-------+-------+
| SSAP | CTL | OUI |
+-------+-------+-------+-------+
| OUI | EtherType | |
+-------+---------------+ |
| |
~ IPv6 header and payload... ~
| |
+-------------------------------+
| FCS |
+-------+-------+---------------+
| ED | FS |
+-------+-------+
Token Ring Header Fields
SD: Starting Delimiter
AC: Access Control
FC: Frame Control
Destination Address: 48-bit IEEE address of destination
station
Source Address: 48-bit IEEE address of source station
DSAP: Destination Service Access Point (for LLC/SNAP
format, shall always contain the value 0xAA)
SSAP: Source Service Access Point (for LLC/SNAP format,
shall always contain the value 0xAA)
CTL: Control Field (for Unnumbered Information, shall
always contain the value 0x03)
OUI: Organizationally Unique Identifier (for EtherType
encoding, shall always contain the value 0x000000)
EtherType: Protocol type of encapsulated payload (for
IPv6, shall always contain the value 0x86DD)
FCS: Frame Check Sequence
ED: Ending Delimiter
FS: Frame Status
In the presence of source route bridges, a routing information field
(RIF) may appear immediately after the source address. A RIF is
present in frames when the most significant bit of the source address
is set to one. (This is the bit whose position corresponds to that of
the Individual/Group bit in the Destination Address.)
The RIF is a variable-length field that (when present) contains a
two-octet Routing Control (RC) header, followed by zero or more two-
octet Route Designator fields:
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Routing Control: |Bcast| Length |D| LF |rsvd |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Route Designator 1: | Segment 1 |Bridge1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ ... ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Route Designator N: | Segment N |BridgeN|
(0 <= N <= 7) +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Route Designator Fields:
Bcast: Broadcast Indicator, Defined values:
10x: All Routes Explorer
11x: Spanning Tree Explorer
0xx: Specifically Routed Frame
Length: Total length of RIF field in octets
D: Direction of source route. A value of 0 means that
the left-to-right sequence of Route Designators
provides the path from the sender to recipient. A
value of 0 indicates the sequence goes from
recipient to sender.
LF: Largest Frame
rsvd: Reserved
On transmission, the Route Designator fields give the sequence of
(bridge, LAN segment) numbers the packet is to traverse. It is the
responsibility of the sender to provide this sequence for
Specifically Routed Frames, i.e., unicast IP datagrams.
4. Stateless Autoconfiguration
The Interface Identifier [AARCH] for a Token Ring interface is based
on the EUI-64 identifier [EUI64] derived from the interface's built-
in 48-bit IEEE 802 address. The OUI of the Token Ring address (the
first three octets) becomes the company_id of the EUI-64 (the first
three octets). The fourth and fifth octets of the EUI are set to the
fixed value FFFE hexadecimal. The last three octets of the Token Ring
address become the last three octets of the EUI-64.
The Interface Identifier is then formed from the EUI-64 by
complementing the "Universal/Local" (U/L) bit, which is the next-to-
lowest order bit of the first octet of the EUI-64. Complementing
this bit will generally change a 0 value to a 1, since an interface's
built-in address is expected to be from a universally administered
address space and hence have a globally unique value. A universally
administered IEEE 802 address or an EUI-64 is signified by a 0 in the
U/L bit position, while a globally unique IPv6 Interface Identifier
is signified by a 1 in the corresponding position. For further
discussion on this point, see [AARCH].
For example, the Interface Identifier for a Token Ring interface
whose built-in address is, in hexadecimal and in canonical bit order,
34-56-78-9A-BC-DE
would be
36-56-78-FF-FE-9A-BC-DE.
A different MAC address set manually or by software should not be
used to derive the Interface Identifier. If such a MAC address must
be used, its global uniqueness property should be reflected in the
value of the U/L bit.
An IPv6 address prefix used for stateless autoconfiguration of a
Token Ring interface must have a length of 64 bits.
5. Link-Local Address
The IPv6 link-local address [AARCH] for a Token Ring interface is
formed by appending the Interface Identifer, as defined above, to the
prefix FE80::/64.
10 bits 54 bits 64 bits
+----------+-----------------------+----------------------------+
|1111111010| (zeros) | Interface Identifier |
+----------+-----------------------+----------------------------+
6. Address Mapping -- Unicast
The procedure for mapping unicast IPv6 addresses into Token Ring
link-layer addresses is described in [DISC]. The Source/Target Link-
layer Address option has the following form when the link layer is
Token Ring.
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+- Token Ring -+
| |
+- Address -+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Option fields:
Type: 1 for Source Link-layer address.
2 for Target Link-layer address.
Length: 1 (in units of 8 octets).
Token Ring Address: The 48 bit Token Ring IEEE 802
address, in canonical bit order. This is the address the
interface currently responds to, and may be different from
the built-in address used to derive the Interface
Identifier.
When source routing bridges are used, the source route for
the path to a destination can be extracted from the RIF
field of received Neighbor Advertisement messages. Note that
the RIF field of received packets can be reversed into a
source route suitable for transmitting return traffic by
toggling the value of the 'D' bit and insuring that the
Bcast field is set to indicate a Specifically Routed Frame.
7. Address Mapping -- Multicast
All IPv6 packets with multicast destination addresses are transmitted
to Token Ring functional addresses. The following table shows the
specific mapping between the IPv6 addresses and Token Ring functional
addresses (in canonical form). Note that protocols other than IPv6
may use these same functional addresses, so all Token Ring frames
destined to these functional addresses are not guaranteed to be IPv6
datagrams.
MAC Addr (canonical) IPv6 Multicast Addresses
03-00-80-00-00-00 All-Nodes (FF01::1 and FF02::1) and
solicited node (FF02:0:0:0:0:1:FFXX:XXXX)
addresses
03-00-40-00-00-00 All-Routers addresses (FF0X::2)
03-00-00-80-00-00 any other multicast address with three
least significant bits = 000
03-00-00-40-00-00 any other multicast address with three
least significant bits = 001
03-00-00-20-00-00 any other multicast address with three
least significant bits = 010
03-00-00-10-00-00 any other multicast address with three
least significant bits = 011
03-00-00-08-00-00 any other multicast address with three
least significant bits = 100
03-00-00-04-00-00 any other multicast address with three
least significant bits = 101
03-00-00-02-00-00 any other multicast address with three
least significant bits = 110
03-00-00-01-00-00 any other multicast address with three
least significant bits = 111
In a bridged token ring network, all multicast packets SHOULD be sent
with a RIF header specifying the use of the Spanning Tree Explorer.
Note: it is believed that some (very) old bridge implementations do
not properly support the Spanning Tree Explorer mechanism. In such
environments, multicast traffic sent through bridges must use a RIF
with the All Routes Explorer. Consequently, an implementation MAY
wish to allow the sending of IP multicast traffic using an All Routes
Explorer. However, such an ability must be configurable by a system
administrator and the default setting of the switch MUST be to use
the Spanning Tree Explorer.
8. Security Considerations
Token Ring, like most broadcast LAN technologies, has inherent
security vulnerabilities. For example, any sender can claim the
identity of another and forge traffic. It is the responsibility of
higher layers to take appropriate steps in those environments where
such vulnerabilities are unacceptable.
9. Acknowledgments
Several members of the IEEE 802.5 Working Group contributed their
knowledge and experience to the drafting of this specification,
including Jim, Andrew Draper, George Lin, John Messenger, Kirk
Preiss, and Trevor Warwick. The author would also like to thank many
members of the IPng working group for their advice and suggestions,
including Ran Atkinson, Scott Bradner, Steve Deering, Francis Dupont,
Robert Elz, and Matt Thomas. A special thanks is due Steve Wise, who
gave the most relevant advice of all by actually trying to implement
this specification while it was in progress.
10. References
[802.5] 8802-5 : 1995 (ISO/IEC) [ANSI/IEEE 802.5, 1995
Edition] Information technology--Telecommunications and
information exchange between systems--Local and
metropolitan area networks--Specific requirements-- Part 5:
Token ring access method and physical layer specification.
[AARCH] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", RFC 2373, July 1998.
[ACONF] Thomson, S. and T. Narten, "IPv6 Stateless Address
Autoconfiguration", RFC 2462, December 1998.
[BRIDGE] 10038: 1993 (ISO/IEC) [ANSI/IEEE Std 802.1D, 1993 Edition]
Information technology--Telecommunications and information
exchange between systems--Local area networks--Media access
control (MAC) bridges.
[CANON] Narten, T. and C. Burton, "A Caution on Canonical Bit Order
Of Link-Layer Addresses", RFC 2469, December 1998.
[CONF] Thomson, S. and T. Narten, "IPv6 Stateless Address
Autoconfiguration", RFC 1971, August 1996.
[DISC] Narten, T., Nordmark, E. and W. Simpson, "Neighbor
Discovery for IP Version 6 (IPv6)", RFC 2461, December
1998.
[EUI64] "64-Bit Global Identifier Format Tutorial", http:
//standards.ieee.org/db/oui/tutorials/EUI64.html.
[IPV6] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, December 1998.
[KWORD] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels," BCP 14, RFC 2119, March 1997.
[LLC] 8802-2 : 1994 (ISO/IEC) [ANSI/IEEE 802.2, 1994 Edition]
Information technology--Telecommunications and information
exchange between systems--Local and Metropolitan area
networks--Specific requirements-- Part 2: Logical link
control.
11. Authors' Addresses
Matt Crawford
Fermilab MS 368
PO Box 500
Batavia, IL 60510 USA
Phone: +1 630 840 3461
EMail: crawdad@fnal.gov
Thomas Narten
IBM Corporation
P.O. Box 12195
Research Triangle Park, NC 27709-2195 USA
Phone: +1 919 254 7798
EMail: narten@raleigh.ibm.com
Stephen Thomas
TransNexus
430 Tenth Street NW Suite N204
Atlanta, GA 30318 USA
Phone: +1 404 872 4745
EMail: stephen.thomas@transnexus.com
Full Copyright Statement
Copyright (C) The Internet Society (1998). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
ISO Plain Language
On this page
§1What the RFC Specifies
RFC 2470 covers four things: the maximum transmission unit (MTU) and the frame format for sending IPv6 packets on Token Ring, the method for forming IPv6 link-local addresses on Token Ring, and the content of the Source/Target Link-layer Address option used in Router Solicitation, Router Advertisement, Redirect, Neighbor Solicitation and Neighbor Advertisement messages when those messages travel over Token Ring.
The RFC carries one warning that implementers are told to note carefully. Token Ring adaptors assume addresses are in non-canonical rather than canonical bit order, so special care has to be taken to make sure addresses are processed correctly. The RFC points to RFC 2469 for the details.
The scope is deliberately narrow. It is about IPv6 on one particular link technology, and it leans on the general IPv6 specifications for addressing and neighbour discovery rather than repeating them.
The RFC fixes the details that a Token Ring network needs for IPv6: the frame layout, the packet size, the address format and the neighbour discovery option. It also warns that Token Ring hardware uses a different bit order for addresses than most other technologies.
§2Maximum Transmission Unit
An IEEE 802.5 network has no single maximum frame size. The size depends on how long a node may hold the token, which in turn depends on the data signalling rate and the number of nodes on the ring. Implementations must therefore rely on manual configuration or on router advertisements to learn the real sizes. Common defaults are approximately 2000, 4000 and 8000 octets.
Where nothing else is known, an implementation should use a default MTU of 1500 octets, because that size works with all the common 802.5 defaults and with Ethernet LANs in a bridged environment. In a source route bridged network, the largest frame subfield of the routing information field gives the size for a particular path. Because the LLC header is always 8 octets long for IPv6, the IPv6 MTU is the largest frame size minus 8. An implementation that works this way must keep a separate MTU for each neighbour.
The RFC tabulates the common values. Some of the 802.1D largest frame values give an IP MTU below 1280 bytes, which is the IPv6 minimum, and communication across such a path is generally not possible with IPv6.
When several sources disagree, the RFC sets the order of preference. Largest frame values from source route bridging come first, but only for specific unicast destinations and only if they are not greater than a value from router advertisements. Router advertisements come next, but only if not greater than any manual configuration, including DHCP. Manual configuration comes third, and the default of 1500 comes last.
Token Ring has no fixed maximum frame size, so the size has to be learned or configured. The default to use is 1500 octets, and when sources disagree the RFC says which one wins: a source route bridge first, then a router advertisement, then a manual setting, and the default last.
| LF (base) | MAC MTU | IP MTU |
|---|---|---|
| 001 | 1470 | 1462 |
| 010 | 2052 | 2044 |
| 011 | 4399 | 4391 |
| 100 | 8130 | 8122 |
| 101 | 11407 | 11399 |
| 110 | 17749 | 17741 |
| 111 THIS RFC | 41600 | 41592 |
- 1. Source route bridgingLargest frame values, for specific unicast destinations only.
- 2. Router advertisementsUsed only if not greater than any manual configuration.
- 3. Manual configurationIncludes settings made with DHCP.
- 4. Default1500 octets, when nothing else is known.
§3The Token Ring Frame Format
IPv6 packets travel in LLC/SNAP frames, and the data field holds the IPv6 header and payload. The frame starts with the Starting Delimiter, the Access Control and the Frame Control fields, followed by the 48-bit IEEE destination address and the 48-bit IEEE source address. After that come the LLC/SNAP fields: the Destination Service Access Point, the Source Service Access Point, the Control Field, the Organizationally Unique Identifier and the EtherType. The frame ends with the Frame Check Sequence, the Ending Delimiter and the Frame Status.
Several of those fields carry fixed values. For the LLC/SNAP format the DSAP and SSAP shall always contain the value 0xAA, the Control Field shall always contain 0x03 for Unnumbered Information, the OUI shall always contain 0x000000 for EtherType encoding, and the EtherType shall always contain 0x86DD for IPv6.
Where source route bridges are present, a routing information field may follow the source address. It is present when the most significant bit of the source address is set, and it holds a two-octet Routing Control header followed by up to seven two-octet Route Designator fields. The Routing Control carries a broadcast indicator, the length of the field, a direction bit and the largest frame value. On transmission, the Route Designator fields give the sequence of bridge and LAN segment numbers the packet is to traverse, and it is the sender's job to supply that sequence for unicast datagrams.
IPv6 packets are carried in LLC/SNAP frames with fixed values in the header fields and the EtherType 0x86DD. When source route bridges are present, the frame also carries the list of bridges and segments the packet has to pass through.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
SD | SD | 1 byte | Starting Delimiter. | |
AC | AC | 1 byte | Access Control. | |
FC | FC | 1 byte | Frame Control. | |
DESTINATION-ADDRESS | Destination Address | 6 bytes | 48-bit IEEE address of the destination station. | |
SOURCE-ADDRESS | Source Address | 6 bytes | 48-bit IEEE address of the source station. | |
DSAP | DSAP | 1 byte | 0xAA | Destination Service Access Point. Always 0xAA in LLC/SNAP format. |
SSAP | SSAP | 1 byte | 0xAA | Source Service Access Point. Always 0xAA in LLC/SNAP format. |
CTL | CTL | 1 byte | 0x03 | Control Field. Always 0x03 for Unnumbered Information. |
OUI | OUI | 3 bytes | 0x000000 | Organizationally Unique Identifier. Always 0x000000 for EtherType encoding. |
ETHERTYPE | EtherType | 2 bytes | 0x86DD | Protocol type of the encapsulated payload. Always 0x86DD for IPv6. |
FCS | FCS | 4 bytes | Frame Check Sequence. | |
ED | ED | 1 byte | Ending Delimiter. | |
FS | FS | 1 byte | Frame Status. |
§4Interface Identifiers and the Link-Local Address
The IPv6 interface identifier for a Token Ring interface is built from the EUI-64 identifier derived from the interface's built-in 48-bit IEEE 802 address. The first three octets of the Token Ring address, the OUI, become the first three octets of the EUI-64, the fourth and fifth octets of the EUI are set to the fixed value FFFE in hexadecimal, and the last three octets of the Token Ring address become the last three octets of the EUI-64.
The interface identifier is then formed by complementing the Universal/Local bit, the next-to-lowest-order bit of the first octet of the EUI-64. Complementing that bit generally changes a 0 into a 1, because a built-in address is expected to come from the universally administered address space, where a 0 in that position means globally unique. A globally unique IPv6 interface identifier is signalled by a 1 in the corresponding position. As an example, the built-in address 34-56-78-9A-BC-DE gives the interface identifier 36-56-78-FF-FE-9A-BC-DE.
A MAC address set manually or by software should not be used to derive the interface identifier. If such an address has to be used, its global uniqueness should be reflected in the value of the U/L bit. Any IPv6 address prefix used for stateless autoconfiguration of a Token Ring interface must be 64 bits long.
The link-local address is formed by appending the interface identifier to the prefix FE80::/64. The prefix is ten bits of 1111111010, then 54 zero bits, then the 64-bit interface identifier.
The interface identifier comes from the interface's own hardware address: the first three bytes are kept, two fixed bytes are inserted, the last three are kept, and one bit is flipped to mark the address as unique. The link-local address is that identifier placed after the fixed prefix FE80::/64.
§6Unicast Address Mapping
The general procedure for mapping unicast IPv6 addresses into link-layer addresses is described in the IPv6 neighbour discovery specification. What this RFC adds is the form the Source/Target Link-layer Address option takes on Token Ring.
The option has a Type field, where 1 means a source link-layer address and 2 means a target link-layer address, a Length field of 1 in units of 8 octets, and the Token Ring address itself: the 48-bit IEEE 802 address in canonical bit order. It is the address the interface currently responds to, which may differ from the built-in address used to derive the interface identifier.
Where source routing bridges are used, the source route for the path to a destination can be extracted from the routing information field of received Neighbor Advertisement messages. The field of a received packet can be turned back into a source route for sending return traffic by toggling the direction bit and making sure the broadcast field shows a Specifically Routed Frame.
Neighbour discovery messages carry the link-layer address of the sender or the target. On Token Ring that address is the 48-bit hardware address, and the RFC also explains how to recover the route back from a received frame.
§7Multicast Address Mapping
All IPv6 packets with a multicast destination address are sent to Token Ring functional addresses. The RFC gives the mapping. The functional address 03-00-80-00-00-00 carries the All-Nodes addresses and the solicited-node addresses. The functional address 03-00-40-00-00-00 carries the All-Routers addresses. Every other multicast address is mapped by its three least significant bits: 000, 001, 010, 011, 100, 101, 110 and 111 each have their own functional address, with the low bit of the third octet set accordingly.
The RFC notes that other protocols may use these same functional addresses, so a frame sent to one of them is not guaranteed to carry an IPv6 datagram.
In a bridged Token Ring network, all multicast packets should be sent with a routing information field that specifies the use of the Spanning Tree Explorer. Some very old bridge implementations are believed not to support that mechanism properly, and in such environments multicast traffic sent through bridges must use a routing information field with the All Routes Explorer. An implementation may therefore want to allow IP multicast traffic to be sent with the All Routes Explorer, but that ability must be configurable by a system administrator, and the default setting of the switch must be to use the Spanning Tree Explorer.
IPv6 group addresses are sent to fixed Token Ring functional addresses: one for all nodes, one for all routers, and eight more chosen by the low bits of the group address. Multicast frames crossing bridges need a route field, and the RFC says which explorer to use.
§8Security Considerations
Token Ring, like most broadcast LAN technologies, has inherent security weaknesses. Any sender on the ring can claim the identity of another and forge traffic. The RFC states that it is the responsibility of the higher layers to take appropriate steps in environments where such weaknesses are unacceptable.
Any station on a Token Ring can send frames that pretend to come from someone else. The RFC leaves the protection against that to the layers above, such as the security mechanisms built into IPv6.