Multicasting and the Small Network, Part 2

Photo of author

Doug Reid

In my last post, I discussed multicasts and some of the basic concepts. This time, I’m going to discuss technologies used by switches and routers to enable and configure multicasts. Specifically, I’m going to dive into addressing and IGMP. Understanding the details behind multicasts helps understand configuring multicasts as well as the issues limiting the use of multicasts on the web.

Let’s start with two simple rules:

Rule #1: Switches, by default, flood multicasts out all ports. This means a multicast originating on port 1 of an 8 port switch will be forwarded out ports 2-8, even if the only receiving host is on port 8.

Rule #2: Routers, by default, do not forward multicasts. This means a router that doesn’t support or isn’t configured for multicast traffic will drop the multicast packets.

These rules are helpful in understanding the default performance of multicast. Unmanaged switches will flood multicasts, while some routers may not support multicast traffic at all. However, many switches and routers can be configured to support multicast traffic, and that support is based on the network addresses uses by multicasts.

Unicasts use source and destination addresses, with switches using Layer 2 MAC addresses and routers using Layer 3 IP address. Multicasting also uses MAC and IP addresses, but of specific ranges and formats.

Multicasts use a "derived" Layer 2 MAC address, and a "Group" Layer 3 IP address. The "derived" MAC address is in the range of 01:00:5E:00:00:00 – 01:00:5E:7F:FF:FF. The "Group" IP is in the range starting of –, also known as a Class D address.

The derived multicast MAC address is a concatenation of 01:00:5E and the last 23 bits of the Class D multicast IP. Figure 1 is an example showing a derived multicast MAC.

Multicast MAC addressing

Figure 1: Multicast MAC addressing

Fortunately, host applications determine the appropriate multicast MAC address, so we humans don’t have to do the decimal-to-binary to hex conversions. The key is this new MAC is not associated to a specific device, thus will not be learned by a switch and won’t be added to the switch MAC table. Subsequently, unmanaged or unconfigured switches flood multicasts to all ports.

The different multicast Layer 2 and Layer 3 addresses are used by the multicast protocol, IGMP, to provide the network services necessary to recognize, transport and replicate the multicast stream.

IGMP, or Internet Group Management Protocol is a Layer 4 protocol used to differentiate and manage multicast streams. Hosts use IGMP with multicast applications to receive multicast transmissions and to communicate with network routers. Switches use IGMP to limit the transmission of multicasts to the ports with interested receivers. Routers use IGMP to know which interfaces will forward the multicast stream.

Let’s take a simple example where the multicast source and host(s) are on the same LAN, without a router between them. Hosts interested in receiving the multicast will configure their NIC to listen to multicasts using the derived MAC address from the Group IP address advertised by the multicast source.

The multicast media stream is be sent by the source to the switch. If it is an unmanaged switch, the multicast will be flooded out all ports. If it is a managed switch with IGMP capability, the multicast can be confined to the appropriate ports with a switch feature known as IGMP Snooping. In either case, the hosts that have configured their NICs for the correct MAC will process the multicast stream.

Switch-based IGMP Snooping learns which ports have hosts that have requested the particular multicast. The upside to enabling IGMP Snooping on a network switch that carries multicast traffic is a reduction in network activity, freeing up processing and network resources. A switch with IGMP Snooping enabled, such as the Linksys SRW2008 [reviewed] (configuration shown in the diagram below), will limit multicasts to just the ports requesting the multicast.

Enabling IGMP Snooping - Linksys SRW2008
Click to enlarge image

Figure 2: Enabling IGMP Snooping – Linksys SRW2008

The downside to enabling IGMP Snooping on a LAN switch is that it can cause a switch to use its CPU more frequently. Most LAN switches have limited CPU and RAM resources, relying more on their switching hardware for fast forwarding of data frames. If there is very little multicast traffic on your LAN, enabling IGMP Snooping may be of little value.

Now that we’ve described addressing, IGMP, and switch configuration, we can go into router configuration and support for multicasting. This will enable discussing the issues surrounding multicasting over the Internet, as well. Tune in to my next post for this discussion!

Related posts

Vendor Views: Is Your Network Media Aware?

In our first vendor-contributed article, Ubicom makes the case for its StreamEngine auto-QoS technology.

Router Ranker and Charts Improvements

We have made a few improvements to our Router product research tools and tweaked the way we rank routers.

Introducing SmallNetBuilder’s Router Ranker

We have a new and easier way to find your perfect router!