Multicast

Between unicast (one receiver) and broadcast (everyone), multicast reaches only those who joined the group. Routing protocols use link-local multicast groups so their messages stay on one network. IPv6 has no broadcast at all: ff02::1 (all nodes) and solicited-node groups do that work. On Ethernet, an IPv6 group maps to a MAC starting 33:33.

How multicast works, step by step

Unicast sends to one receiver, broadcast to everyone on the network. Multicast sends one packet to a group, and only the devices that joined the group receive it. The sender does not know who they are or how many.

IPv4 group addresses are 224.0.0.0/4, 224.0.0.0 to 239.255.255.255. Some ranges have fixed meanings:

A camera streaming to TVs on one network goes like this:

1. A receiver joins. A program asks its kernel to join 239.1.1.1. The kernel tells the network with an IGMP membership report (IGMPv2, RFC 2236; IGMPv3, RFC 3376, adds "only from this source") and tells its card to accept one more MAC address.
2. The group MAC. On Ethernet a group address maps to 01:00:5e followed by its low 23 bits, so 239.1.1.1 becomes 01:00:5e:01:01:01. A group address has 28 variable bits, so 32 groups share each MAC; the kernel drops what it did not join.
3. The switch snoops. A switch with IGMP snooping reads the reports and records which ports have members.
4. The sender sends once, to the group address and group MAC. The switch copies the frame only to member ports.
5. The querier keeps it fresh. One device, usually a router, sends a general query to 224.0.0.1 every 125 seconds by default. Members answer, and entries with no answer expire.
6. A receiver leaves with an IGMP leave to 224.0.0.2. The querier asks that group once more, and if no one answers, the port is dropped within a couple of seconds.

To cross routers, the routers must run multicast routing, usually PIM, and build a tree from the sender to every network with members. IPv6 does the same with MLD instead of IGMP, groups in ff00::/8 and MACs starting 33:33.

What it looks like on a Linux machine

In the multicast lab a TV joins 239.1.1.1 with socat, and its card's list of group addresses grows:

$ ip maddr show dev eth0
2:	eth0
	link  01:00:5e:00:00:01
	link  01:00:5e:01:01:01
	inet  239.1.1.1
	inet  224.0.0.1

The switch is a Linux bridge with snooping on, acting as querier. bridge mdb is its table of members, the multicast counterpart of the MAC table:

$ bridge mdb show
dev br0 port tv1 grp 239.1.1.1 temp
dev br0 port tv2 grp 239.1.1.1 temp

A capture on a member port shows the cycle:

$ tcpdump -nni tv1 igmp
IP 10.0.1.14 > 224.0.0.1: igmp query v2
IP 10.0.1.11 > 239.1.1.1: igmp v2 report 239.1.1.1

The camera's frames reach tv1 and tv2 and not the laptop next to them. Turn snooping off (ip link set br0 type bridge mcast_snooping 0) and the switch floods the stream to every port, like a broadcast.

What goes wrong, and how you see it

The stream stops after a few minutes. Snooping is on but nobody is querier, so memberships expire although every receiver still wants the group. bridge mdb empties; turning on a querier fixes it.

Every port gets everything. No snooping, or the group is unknown to the switch, and multicast floods like a broadcast. A few HD streams can fill a network of phones and printers.

It stops at the router. A router forwards multicast only with multicast routing (ip mroute is empty without it), and a sender's default TTL of 1 keeps packets on its own network anyway. Groups in 224.0.0.0/24 never leave the link at any TTL.

Two groups, one MAC. 239.1.1.1 and 239.129.1.1 share 01:00:5e:01:01:01, so switches and cards cannot tell them apart. Choose group addresses that differ in their low 23 bits.

Questions people ask

What is the difference between multicast and broadcast? A broadcast reaches every device on the network, whether it wants it or not. Multicast reaches only members, and can cross routers that support it.

Does multicast work on the internet? Not generally: most providers do not route it between networks. It is used inside networks: IPTV, market data, routing protocols, service discovery.

Does multicast use TCP? No. TCP needs one peer per connection, so multicast traffic is UDP or raw IP.

See it on real machines