To understand what IP multicast is, engineers must have a solid understanding of the three different communication methods in IP networks: Unicast, Broadcast, and Multicast. Let's quickly discuss each one at a high level and then zoom into each in more detail.

Unicast communication in IP networking is the process of sending packets from a source to a destination based on the destination IP address in the Layer 3 header of the packet. The main property of this method is that it is a one-to-one communication between a source and a destination, as shown in the following diagram.  

Unicast High-level Diagram
Figure 1. Unicast High-level Diagram

For example, PC1 is sending one traffic stream destined for PC2, another to PC3, and another for each host it wants to communicate with. Therefore, the number of streams increases proportionally with the number of receivers. This is a scaling limitation in scenarios where a single source must send streams to a large number of receivers. For example, suppose PC1 must send a video stream to 100,000 receivers. Even though the content of the stream may be the same for every receiver, PC1 must replicate the stream 100,000 times using unicast traffic flows. This may completely exhaust the available resources on the source, even if it is the most powerful server or cluster. Additionally, replicating the same stream a thousand times substantially impacts the network. It may consume all available bandwidth and impact the transmitted data's quality by incurring packet loss and latency.

Broadcast is a very different communication method that delivers each packet to all hosts within a network segment. Broadcast communication within a local segment is typically referred to as "flooding" because it has flooding behavior. When a host sends a broadcast message, the LAN network replicates it and sends a copy of the message to ALL hosts on the segment, even if the message is not intended for them and they do not want to receive it.

Broadcast High-level Diagram
Figure 2. Broadcast High-level Diagram

Broadcast is essential for various network functions such as ARP, DHCP, SNMP, and WoL. It is the foundation of the "flood and learn" behavior of Ethernet networks. However, it has two main inefficiencies:

  • Broadcast communication is generally confined to a local network segment (called the broadcast domain). Routers do not forward broadcast messages between networks. (Technically, a "directed broadcast" capability can be used to send broadcast messages to remote network segments; it is considered a legacy technology now and is generally not allowed in modern networks because it has significant cybersecurity implications. More on it later.)
  • Broadcast messages go to ALL hosts. This may not be desired in scenarios where you want to send a stream only to the interested receivers.

Multicast combines the best of both unicast and broadcast communications while offsetting the inefficiencies of broadcast. With multicast, the network replicates each packet and forwards it ONLY to interested receivers, as shown in the following diagram. For example, PC1 sends a video stream that only hosts PC3 and PC8 want to receive. 

Multicast High-level Diagram
Figure 3. Multicast High-level Diagram

Another important difference between multicast and broadcast is that, with multicast, the receivers can be on any IP segment, while with broadcast, all receivers must be on the local segment.

Multicast packets can be transmitted from one source to many interested receivers, from many sources to many receivers, and from many receivers to one source. Multicast communication is the most efficient from a network resources point of view. The network can replicate a single multicast stream to a large number of receivers.

In summary, there are three main communication modes in TCP/IP networks:

  • Unicast: One-to-One
  • Broadcast: One-to-ALL
  • Multicast: One-to-Many

How do network devices differentiate Unicast, Broadcast, and Multicast?

At this point, you might be wondering how network devices differentiate the different types of traffic. How does a LAN switch differentiate unicast from multicast from broadcast frames?

The answer is that network devices look at the information in packets' headers to determine whether they are unicast, multicast, or broadcast. Keep in mind that network devices process MAC and IP addresses in binary (as ones and zeros). The decimal representation of IP addresses and the hexadecimal of MAC addresses are only used so that humans can make sense of the addresses.

  • Layer 2 switches differentiate different types of traffic by looking at the destination MAC address in the frame's layer 2 header. 
    • Broadcast: A frame with the destination MAC address set to all 1s (in hex FFFF.FFFF.FFFF) is a broadcast frame.
    • Multicast: The IEEE 802.3 Ethernet standard specifies that all MAC addresses with the 8th bit set to “1” are multicast addresses.
    • Unicast:  On the other hand, all MAC addresses with the 8th bit set to “0” are unicast ones.
  • Layer 3 switches and routers differentiate different types of traffic by looking at the destination IP address in the packets' layer 3 header.
    • Broadcast: If the destination IP address is the last address in the subnet (according to the subnet mask, it means the packet is broadcast.
    • Multicast: If the destination IP address is from the multicast address range 224.0.0.0/4, it means the packet is multicast.
    • Unicast: If the destination IP address is a valid address (not the first or the last address in a subnet, according to the subnet mask), it is unicast.

Now, let's look at a few detailed examples.

Unicast

Network devices forward unicast packets following the route to the destination IP/MAC address. Let's look at the example shown in the following diagram.

Unicast Low-Level Overview
Figure 4. Unicast Low-Level Overview

PC1 wants to send traffic to PC5. It inserts the default gateway's MAC address (R1) as DST MAC and PC5's IP address as DST IP and sends the packet onto the local LAN segment. PC1 finds the MAC address it needs using ARP. 

When a layer 2 switch receives a frame with a unicast destination MAC address, it forwards the frame to the switchport according to its MAC address table. If there is no entry in the table, it floods the frame to all switchports except the incoming port (the flood-and-learn behavior). 

When a router receives a packet with an unicast IP destination address, it forwards it according to its unicast routing table. If there is no entry in the routing table, it discards the packet. 

In summary: 

  • Unicast is one-to-one - between PC1 and PC5.
  • A Layer 2 switch forwards unicast frames according to its MAC address table.
    • If there is no entry in the table, the switch floods the frame as broadcast.
  • A layer 3 switch or router forwards unicast packets according to its routing table.
    • If there is no entry in the routing table (and no default route), the device discards the packet.

Broadcast

When a layer 2 switch receives an Ethernet frame with the destination MAC address set to 48 1s in binary (hexadecimal 0xFFFF.FFFF.FFFF), it knows that this broadcast message must be replicated to all hosts on the segment. The switch sends a copy of the Ethernet frame to all ports except the incoming one, as shown in the following diagram.

Broadcast-Low-Level Overview
Figure 5. Broadcast Low-Level Overview

Every device on an Ethernet LAN receives and processes a copy of every broadcast frame. Various network functions such as ARP, DHCP, SNMP, and WoL rely on this flood-and-learn mechanism. In summary:

  • A broadcast frame has the destination MAC address of all 1s (hex FFFF.FFFF.FFFF).
  • A layer 2 switch floods broadcast frames out all switchports except the incoming ones.
  • Broadcast stops at routers. Hence, routers divide the network into different broadcast domains.

Multicast

When a layer 2 switch receives a frame with a multicast destination MAC address, it sends a copy of the packet ONLY to the switchports with interested receivers, as shown in the following diagram. 

Multicast Low Level Overview
Figure 6. Multicast Low-Level Overview

For example, PC1 sends a multicast stream to group 239.1.1.1. It inserts the group address 239.1.1.1 as DST IP and the corresponding multicast 0100.5E01.0101 as DST MAC. The essential point here is that there is no ARP with multicast. The destination MAC is a result of the multicast group IPv4 address. We will see the process of converting multicast IP to MAC later on.

When the layer 2 switch receives the frame, it knows it is multicast by looking at the multicast MAC. It forwards the frame to PC2 and R1 because they are the only interested receivers. When the router gets the frame, it looks at the destination multicast IPv4 address and forwards the packet according to its multicast routing table. In the end, only the interested hosts receive a copy of the multicast packet. If you are new to multicast, at this point, you most probably ask yourself - "WTF is a multicast MAC address?"

What is a Multicast MAC address?

The Ethernet standard specifies that a MAC address with the 8th bit set to "1" is a multicast MAC address, as shown in the following diagram. When a layer 2 switch receives a frame, it looks at the destination MAC address. If the 8th bit of the destination MAC is set to 1, the switch knows that this is multicast traffic and must be switched based on the multicast control-plane protocols, which we are going to discuss in the next lessons.

A multicast MAC address
Figure 7. A multicast MAC address

All multicast MAC addresses are between 0x0100.0000.0000 and 0xFFFF.FFFF.FFFF, where the 0xFFFF.FFFF.FFFF is the well-known broadcast MAC address, as shown in the following diagram.

All Multicast MAC addresses
Figure 8. All Multicast MAC addresses

A specific subset of the multicast MAC address range - 0100.5E00.0000 to 0100.5E7F.FFFF - is reserved for mapping the IPv4 multicast addresses to Ethernet MAC addresses. We will cover the process of this mapping in great detail later. However, you must be aware that other subsets of the multicast MAC address range are reserved for other network functions. For example, the range 3333.0000.0000 to 3333.FFFF.FFFF is reserved for IPv6 multicast.

In summary, if the 8th bit of a MAC address is set to 1, it is a multicast MAC address.

Multicast IP addresses

A multicast IPv4 address is an IP address used to simultaneously deliver packets to a group of destination hosts. Multicast allows efficient data distribution to multiple recipients simultaneously Instead of sending packets individually to each host. The multicast IPv4 address range is referred to as the "Class D" address space:

  • 224.0.0.0/4 - from 224.0.0.0 to 239.255.255.255

An important point here is that a multicast IPv4 address cannot be used as a source IP. Multicast IP is always used as a destination address.

What business problems does IP multicast solve?

IP Multicast has been invented to solve the scaling and efficiency problem of sending multiple identical copies of the same information to a selected group of devices. The most famous example is live video/audio streams. Suppose there is no multicast, and you must send a live video stream with a resolution of 4k to hundreds or thousands of receivers:

  • Unicast requires a separate stream per receiver. Therefore, the sender of the stream must be capable of transmitting hundreds of 4 K video streams, which would be a challenge even with today's powerful servers. Additionally, the network must be able to handle 100+ 4 K video streams, which would be a challenge even with today's high-bandwidth networks.
  • Broadcast can minimize the number of video streams required. However, it poses a new challenge. Now, every device in the local segment receives the video stream, whether they want it or not. Additionally, sending broadcasts to remote networks is generally not allowed in modern networks.

That's where multicast comes into the picture. Let's see the most common applications that rely on multicast for efficient data delivery.

What are the use cases for IP Multicast?

Many applications rely on multicast for efficient data delivery. Some may consume an enormous amount of bandwidth, as with 4k video streams. Others can consume little bandwidth but require real-time updates delivered to hundreds of sensors, like in IoT networks. Different applications utilize IP multicast in different communication patterns: one-to-many, many-to-one, and many-to-many. Hence, we can differentiate three different multicast application categories:

One to Many

In some applications, a single source sends data to multiple receivers, as shown in the following diagram.

One to Many Multicast Applications
Figure 9. One to Many Multicast Applications

 

The most common use cases that rely on one-to-many multicast communication are as follows:

  • Live Video and Audio Streaming
    • Broadcasting Events: One broadcaster sends the stream to many viewers.
    • Corporate Communications: A single source (e.g., CEO) sends a live broadcast to all employees.
  • Financial Services
    • Market Data Distribution: One source (e.g., stock exchange) sends data to many traders.
  • Online Gaming
    • MMOGs: The game server sends updates to multiple players.
  • Software Distribution and Updates
    • Patch and Update Delivery: A central server sends updates to multiple devices.
  • Telecommunications
    • IPTV: One server sends TV channels to multiple subscribers.
    • Video Conferencing: One source sends a stream to multiple participants.
  • Educational Content Delivery
    • E-Learning and Distance Education: One instructor broadcasts to many students.
  • Real-Time Data Feeds
    • Weather and Traffic Updates: One source sends updates to many users.

Many-to-One

In other applications, multiple sources send data to a single receiver, as shown in the following diagram.

 

Many to One Multicast Applications
Figure 10. Many-to-One Multicast Applications

The most common use cases that rely on many-to-one multicast communication are as follows:

  • IoT and Sensor Networks
    • Data Collection and Distribution: Multiple sensors send data to a central server.
  • Network Control and Management
    • Network Monitoring: Multiple devices send performance data to a central monitoring system.

Many-to-Many

There are also applications that rely on multiple sources, sending data to multiple receivers. In essence, each sender acts as a receiver and vice versa. This allows groups of devices to communicate simultaneously in real-time.

Many-to-Many Multicast Applications
Figure 11. Many-to-Many Multicast Applications

The most common use cases that rely on many-to-many multicast communication are as follows:

  • Telecommunications
    • Video Conferencing: Multiple participants can send and receive streams to and from each other.
  • Military and Defense Applications
    • Command and Control Systems: Multiple units can send and receive situational updates and commands.

Key Takeaways

  • There are three fundamental communication methods in TCP/IP:
    • Unicast - one-to-one.
    • Broadcast - one-to-all.
    • Multicast - one-to-many.
  • A MAC address with the 8th bit set to 1 is a multicast MAC address.
    • A subset of the multicast MAC address range is used for IPv4 multicast communication. The subset range is 0100.5E00.0000 to 0100.5E7F.FFFF.
    • Another subset of the multicast MAC address range is used for IPv6 multicast communication. The subset range is 3333.0000.0000 to 3333.FFFF.FFFF.
  • In IP multicast communications, there is no ARP! The destination MAC address is a result of the destination multicast IPv4 address. There is a formula that converts an IPv4 address to a MAC address.
  • The class D of IP addresses are used for destination multicast IPv4. 
    • The range is 224.0.0.0/4 - from 224.0.0.0 to 239.255.255.255.
    • A multicast IP address cannot be a source IP. It can only be used as a destination IP address.