To understand what we are going to talk about, you must be familiar with how MAC addresses are structured and how they work. The MAC Addresses page is available to help you learn more about them..

A multicast is similar to a broadcast in the sense that its target is a number of machines on a network, but not all. Where a broadcast is directed to all hosts on the network, a multicast is directed to a group of hosts. The hosts can choose whether they wish to participate in the multicast group (often done with the Internet Group Management Protocol), whereas in a broadcast, all hosts are part of the broadcast group whether they like it or not .

As you are aware, each host on an Ethernet network has a unique MAC address, so here’s the million dollar question: How do you talk to a group of hosts (our multicast group), where each host has a different MAC address, and at the same time ensure that the other hosts, which are not part of the multicast group, don’t process the information ? You will soon know exactly how all this works.

To keep things in perspective and make it easy to understand, we are going to concentrate only on an Ethernet network using the IP protocol, which is what 80-90 % of home networks and offices use.

Breaking things down…

In order to explain Multicasting the best I can and to make it easier for you understand, I decided to break it down into 3 sections:

1) Hardware/Ethernet Multicasting

2) IP Multicasting

3) Mapping IP Multicast to Ethernet Multicast

A typical multicast on an Ethernet network, using the TCP/IP protocol, consists of two parts: Hardware/Ethernet multicast and IP Multicast. Later on I will talk about Mapping IP Multicast to Ethernet Multicast which is really what happens with multicasting on our Ethernet network using the TCP/IP protocol.

The brief diagram below shows you the relationship between the 3 and how they complete the multicasting model:

Hardware/Ethernet Multicasting

When a computer joins a multicast group, it needs to be able to distinguish between normal unicasts (which are packets directed to one computer or one MAC address) and multicasts. With hardware multicasting, the network card is configured, via its drivers, to watch out for particular MAC addresses (in this case, multicast MAC addresses) apart from its own. When the network card picks up a packet which has a destination MAC that matches any of the multicast MAC addresses, it will pass it to the upper layers for further processing.

And this is how they do it :

To understand this, we need to analyse the destination MAC address of a unicast and multicast packet, so you can see what we are talking about:

When a normal (unicast) packet is put on the network by a computer, it contains the Source and Destination MAC address, found in the 2nd Layer of the OSI model. The following picture is an example of my workstation (192.168.0.6) sending a packet to my network’s gateway (192.168.0.5):

Now let’s analyse the destination MAC address:

When my gateway receives the packet, it knows it’s a unicast packet as explained in the above picture.

Let’s now have a look at the MAC address of a multicast packet. Keep in mind, a multicast packet is not directed to one host but a number of hosts, so the destination MAC address will not match the unique MAC address of any computer, but the computers which are part of the multicast group will recognise the destination MAC address and accept it for processing.

The following multicast packet was sent from my NetWare server. Notice the destination MAC address (it’s a multicast):

Analysis of a multicast destination MAC address:

So now you should be able to understand how computers can differentiate between a normal or unicast packet and a multicast packet. Again, the destination MAC address 01-00-5E-00-00-05 is not the MAC address of a particular host-computer but the MAC address that can be recognised by computers that are part of the multicast group. I should also note that you will never find a source address that is a multicast MAC address, the source address will always be a real one, to identify which computer the packet came from.

The IEEE group used a special Rule to determine the various MAC addresses that will be considered for multicasting. This Rule is covered in the last section of this page, but you don’t need to know it now in order to understand Hardware multicasting. Using this special rule it was determined that MAC address 01:00:5E:00:00:05 will be used for the OSPF protocol, which happens to be a routing protocol, and then this MAC address also maps to an IP address which is analysed in IP Multicast.

IP Multicast

The IP Multicast is the second part of multicasting which, combined with the hardware multicasting, gives us a multicasting model that works for our Ethernet network. If hardware multicasting fails to work, then the packet will never arrive at the network layer upon which IP multicasting is based, so the whole model fails.

With IP multicasting the hardware multicasting MAC address is mapped to an IP Address. Once Layer 2 (Datalink) picks the multicast packet from the network (because it recognises it, as the destination MAC address is a multicast) it will strip the MAC addresses off and send the rest to the above layer, which is the Network Layer. At that point, the Network Layer needs to be able to understand it’s dealing with a multicast, so the IP address is set in a way that allows the computer to see it as a multicast datagram. A host may send multicast datagrams to a multicast group without being a member.

Multicasts are used a lot between routers so they can discover each other on an IP network. For example, an Open Shortest Path First (OSPF) router sends a “hello” packet to other OSPF routers on the network. The OSPF router must send this “hello” packet to an assigned multicast address, which is 224.0.0.5, and the other routers will respond.

IP Multicast uses Class D IP Adresses:

Let’s have a look at an example so we can understand that a bit better:

The picture below is a screenshot from my packet sniffer, it shows a multicast packet which was sent from my NetWare server, notice the destination IP address: