Imagine a CEO delivering a live video address to thousands of employees across the globe. Sending a separate copy of that video to each employee would choke the network and the server. IP Multicast solves this by sending a single stream that is replicated only at the last possible point — the network itself. For the CCNA 200-301 exam (Objective 1.6), understanding multicast basics is essential for grasping how modern IP networks efficiently deliver streaming media, financial data, and real-time updates. This chapter covers the core mechanisms of IP multicast, including group addresses, IGMP, and multicast forwarding, providing you with a solid foundation for the exam and real-world network engineering.
Jump to a section
Think of IP Multicast like a corporate conference call system. In a traditional unicast model (one-to-one), if a manager wants to share an announcement with 100 employees, they would have to call each employee individually, repeating the same message 100 times. That's inefficient and wastes the manager's time — just like unicast wastes bandwidth by sending separate packets to each receiver. In a broadcast model (one-to-all), the manager would shout the announcement over the office PA system, reaching everyone, including those in the break room who don't care about the announcement. That's like Ethernet broadcast — it reaches all hosts, but many ignore it, and it can't scale beyond a single LAN because routers don't forward broadcasts. Now, consider a conference call: the manager speaks once into the phone, and the phone company's infrastructure (the bridge) replicates the audio stream only to the employees who have dialed in. The manager doesn't need to know who is listening; they just speak. The bridge handles the replication. In IP multicast, the source (manager) sends a single stream to a multicast group address (like a conference call bridge number). Hosts that want to receive the stream use IGMP to 'join' that group, telling their local router they are interested. The router then forwards copies of the stream only to those hosts. Routers between the source and receivers use multicast routing protocols (like PIM) to build a distribution tree, ensuring that the stream is replicated only when paths diverge — just like the phone bridge only sends the audio to participants. This analogy highlights the key multicast concepts: a single source, a group address, receivers expressing interest, and network devices replicating as needed.
What is IP Multicast and Why Does It Exist?
IP multicast is a one-to-many or many-to-many communication model where a single packet sent by a source is delivered to multiple receivers that have expressed interest in receiving it. The source sends packets to a multicast group address (a Class D IPv4 address, 224.0.0.0/4), and the network infrastructure (routers and switches) replicates the packets only when necessary, forwarding them to all group members. This is far more efficient than unicast (one copy per receiver) or broadcast (flooded everywhere, even to uninterested hosts). Multicast is used for applications like IPTV, video conferencing, stock market data feeds, software updates, and routing protocol updates (e.g., OSPF and EIGRP use multicast addresses 224.0.0.5/6 and 224.0.0.10 respectively).
How IP Multicast Works at the Packet/Frame Level
Let's walk through the process step by step:
Source sends to a multicast group: A video server sends an IP packet with destination address 239.1.1.1 (a private multicast address). The source IP is its own unicast address.
Layer 2 mapping: The multicast IP address is mapped to a multicast MAC address. For IPv4, the low-order 23 bits of the IP address are copied into the low-order 23 bits of the MAC address 01-00-5E-00-00-00 (the OUI for multicast). For example, 239.1.1.1 in binary ends with ...0001 0000 0001 0000 0001. The multicast MAC becomes 01-00-5E-01-01-01. Note: This mapping is not one-to-one; 32 IP multicast addresses map to the same MAC address, so switches and hosts must check the IP header to confirm membership.
IGMP – Hosts join the group: Receivers (hosts) must signal their interest. They send IGMP (Internet Group Management Protocol) messages. The host sends an IGMP Membership Report (type 0x16) to the group address (e.g., 239.1.1.1) to join. The local router receives this and adds the interface to its multicast forwarding table for that group.
Multicast routing – Building the distribution tree: Routers use a multicast routing protocol, typically Protocol Independent Multicast (PIM), to build a tree from the source to all receivers. In PIM Sparse Mode (PIM-SM), a Rendezvous Point (RP) is used as a meeting point. Routers send PIM Join messages toward the source or RP to request the multicast stream. The tree is built only where receivers exist, saving bandwidth.
Forwarding: When a packet arrives at a router's interface, the router checks its multicast forwarding table (mroute) to see if there are any outgoing interfaces for that (source, group) pair. If yes, it replicates the packet out those interfaces. The router does not forward back out the interface it came from (RPF check).
Key States, Timers, and Defaults
- IGMPv2 Timers: - Query Interval: 60 seconds (default) – the router sends IGMP General Queries every 60 seconds to ask hosts to report their group memberships. - Query Response Interval: 10 seconds – maximum time a host can wait before responding to a query. - Group Membership Interval: 130 seconds (2 * Query Interval + 1 Query Response Interval) – if no report is received for a group, the router assumes no members remain. - Last Member Query Interval: 1 second – when a host leaves a group, the router sends a group-specific query to confirm no other members exist. - Robustness Variable: 2 (default) – affects timers; used to compensate for packet loss.
IGMPv3: Adds Source-Specific Multicast (SSM) support, allowing hosts to join groups from specific sources. Timers similar but with additional source filtering.
Multicast MAC address range: 01-00-5E-00-00-00 to 01-00-5E-7F-FF-FF (low-order 23 bits).
- PIM-SM Defaults: - PIM Hello Interval: 30 seconds. - PIM Join/Prune Interval: 60 seconds. - RP Discovery: via Auto-RP, BSR, or static configuration.
IOS CLI Verification Commands
To verify multicast operation on a Cisco router, use these commands:
show ip igmp groups – displays multicast groups that the router has learned about via IGMP.
show ip igmp interface [interface] – shows IGMP configuration and state on an interface.
show ip mroute – displays the multicast routing table (mroute), showing (S,G) and (*,G) entries.
show ip pim neighbor – shows PIM neighbors.
show ip pim interface – shows PIM-enabled interfaces.
Example output:
Router# show ip igmp groups
IGMP Connected Group Membership
Group Address Interface Uptime Expires Last Reporter
239.1.1.1 GigabitEthernet0/0 00:02:15 00:02:45 192.168.1.10
224.0.1.40 GigabitEthernet0/1 01:00:00 00:02:30 192.168.2.1Router# show ip mroute
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 239.1.1.1), 00:00:30/00:02:30, RP 10.0.0.1, flags: S
Incoming interface: GigabitEthernet0/1, RPF nbr 10.0.0.1
Outgoing interface list:
GigabitEthernet0/0, Forward/Sparse, 00:00:30/00:02:30
(192.168.1.100, 239.1.1.1), 00:00:20/00:02:40, flags: S
Incoming interface: GigabitEthernet0/1, RPF nbr 10.0.0.1
Outgoing interface list:
GigabitEthernet0/0, Forward/Sparse, 00:00:20/00:02:40How Multicast Interacts with Related Protocols
IGMP Snooping: On switches, IGMP snooping listens to IGMP messages between hosts and routers to build a multicast forwarding table. The switch then forwards multicast frames only to ports that have interested receivers, preventing flooding to all ports. Without IGMP snooping, switches treat multicast frames as unknown unicast or broadcast and flood them.
PIM: PIM is the multicast routing protocol that runs between routers. It uses unicast routing information (hence 'Protocol Independent') to perform Reverse Path Forwarding (RPF) checks. RPF ensures that multicast packets arrive on the interface that the router would use to reach the source – this prevents loops.
RPF Check: Every multicast packet is checked: if it arrives on the interface that the router would use to send unicast packets back to the source, the packet is accepted; otherwise, it is dropped. This is fundamental to loop-free multicast forwarding.
Multicast over WAN: Multicast can be transported over GRE tunnels, DMVPN, or using Multipoint Generic Routing Encapsulation (mGRE). For non-multicast-capable WANs, techniques like unicast replication or MSDP (Multicast Source Discovery Protocol) are used.
Troubleshoot Common Issues
Common multicast issues include: RPF failure (packet arriving on wrong interface), missing RP, or IGMP query interval mismatch. Use `debug ip igmp` and `debug ip pim` with caution. Check RPF with `show ip rpf 192.168.1.100`. Ensure unicast routing is working correctly. If receivers don't get traffic, verify IGMP reports are being sent (Wireshark, `debug ip igmp`). Also, check PIM neighbor adjacency. Example: ``` Router# show ip rpf 192.168.1.100 RPF information for 192.168.1.100? RPF interface: GigabitEthernet0/1 RPF neighbor: 10.0.0.1 ? RPF route/mask: 192.168.1.0/24 RPF type: unicast (ospf 1) ``` If the RPF interface is not the expected one, the packet will be dropped.
In enterprise networks, IP multicast is a workhorse for efficient one-to-many delivery. Consider a financial trading firm: stock market data feeds (e.g., from NASDAQ) are multicast to hundreds of trading desks. Each desk subscribes to specific groups (e.g., NYSE stocks, options). Without multicast, the feed source would have to send hundreds of unicast streams, consuming massive bandwidth. With multicast, a single stream enters the network, and routers replicate only when necessary. The network engineer configures PIM-SM with a static RP, and IGMP snooping on access switches ensures that only desks that have joined the group receive the data. This reduces bandwidth on the WAN link from the data center to the campus core from, say, 1 Gbps to 10 Mbps.
Another scenario: IPTV in a hotel or university. The video head-end sends multiple TV channels as multicast groups. Set-top boxes (receivers) join the channel group when a guest selects that channel. The network must support IGMP snooping and PIM to avoid flooding all channels everywhere. The engineer must plan the multicast address range (e.g., 239.0.0.0/8 for private use) and ensure that the RP is redundant (e.g., using Anycast RP).
Common scale considerations: Each router can handle thousands of multicast groups, but memory and CPU are consumed by mroute entries. Misconfiguration, such as missing RP or incorrect PIM mode, can cause complete blackouts. For example, if the RP is unreachable, receivers will never get the stream. Also, without IGMP snooping, switches flood multicast to all ports, causing unnecessary load and potential security issues (e.g., a user can sniff financial data). In production, engineers often use tools like mtrace to trace the multicast path and verify RPF.
Performance: Multicast relies on unicast routing for RPF; if the unicast routing table changes (e.g., due to a link failure), multicast may experience temporary blackouts until the RPF information updates. Engineers must ensure fast convergence using routing protocols like OSPF or EIGRP with fast timers.
On the CCNA 200-301 exam, Objective 1.6 (Configure and verify IPv4 addressing and subnetting) is broad, but multicast appears in the context of understanding IPv4 address types, specifically Class D addresses (224.0.0.0/4). The exam may test your knowledge of multicast MAC address mapping, IGMP operation, and the difference between unicast, broadcast, and multicast. You will not be asked to configure PIM in depth, but you should understand the role of IGMP and multicast addresses.
Common wrong answers and why candidates choose them: 1. Multicast uses unicast MAC addresses: Wrong. Candidates confuse unicast and multicast MAC addresses. Multicast MACs always start with 01-00-5E. The right answer: The first 24 bits are 01-00-5E, and the 25th bit is always 0. 2. IGMP is a routing protocol: Wrong. IGMP operates between hosts and routers, not between routers. Candidates think it's like OSPF. The right answer: IGMP is a host-to-router signaling protocol. 3. All routers must run PIM for multicast to work on a LAN: Wrong. On a single LAN without routers, multicast works using switches with IGMP snooping. PIM is only needed when traversing routers. 4. Multicast addresses can be used as source IP addresses: Wrong. The source IP in a multicast packet must be a unicast address. Candidates may think any IP can be a source.
Specific values and commands that appear on the exam:
- Multicast IP range: 224.0.0.0 to 239.255.255.255 (Class D).
- Reserved link-local multicast: 224.0.0.0/24 (e.g., 224.0.0.1 all hosts, 224.0.0.2 all routers, 224.0.0.5 OSPF, 224.0.0.6 OSPF DR, 224.0.0.9 RIP, 224.0.0.10 EIGRP).
- Multicast MAC mapping: 01-00-5E-00-00-00 to 01-00-5E-7F-FF-FF.
- IGMPv2 timers: Query interval 60s, response interval 10s, group membership interval 130s.
- Command: show ip igmp groups to see groups joined.
Decision rule for scenario questions: If a question asks about sending one copy of data to multiple specific receivers efficiently, think multicast. If it asks about a host joining a group, think IGMP. If it asks about router-to-router multicast forwarding, think PIM. If asked about the MAC address for a multicast IP, remember the 01-00-5E prefix and the 23-bit mapping.
IP multicast uses Class D addresses (224.0.0.0/4) for group communication.
Multicast MAC addresses start with 01-00-5E and use 23 bits from the IP address.
IGMP (v2 or v3) is used by hosts to signal group membership to routers.
Default IGMPv2 timers: Query Interval 60s, Response Interval 10s, Group Membership Interval 130s.
PIM (Protocol Independent Multicast) is used between routers for multicast routing.
RPF (Reverse Path Forwarding) check prevents multicast loops.
IGMP snooping on switches prevents flooding of multicast frames.
Common link-local multicast addresses: 224.0.0.1 (all hosts), 224.0.0.2 (all routers), 224.0.0.5 (OSPF), 224.0.0.10 (EIGRP).
These come up on the exam all the time. Here's how to tell them apart.
Unicast
One-to-one communication
Source sends separate copy to each receiver
Uses unicast IP addresses (Class A, B, C)
No special protocol needed for group management
Bandwidth scales linearly with number of receivers
Multicast
One-to-many or many-to-many communication
Source sends single copy, network replicates
Uses Class D multicast addresses (224.0.0.0/4)
Requires IGMP for group membership and PIM for routing
Bandwidth efficient; independent of number of receivers
Mistake
Multicast packets use the source IP of the multicast group.
Correct
The source IP in a multicast packet is always a unicast address of the source host, not the multicast group address.
Candidates confuse the destination (group) with the source.
Mistake
IGMP is a routing protocol that runs between routers.
Correct
IGMP operates between hosts and the directly connected router (host-to-router). PIM is the routing protocol between routers.
Both are multicast-related, but they operate at different layers.
Mistake
All multicast IP addresses map to a unique MAC address.
Correct
32 IP multicast addresses map to the same MAC address because only 23 bits of the IP are used. This can cause ambiguity.
The mapping is not one-to-one, which is a common trick on the exam.
Mistake
A router forwards multicast packets out all interfaces except the incoming one.
Correct
A router only forwards multicast packets out interfaces that have interested receivers (via IGMP) or are part of the distribution tree (via PIM). It does not flood like a switch.
Candidates confuse multicast forwarding with Ethernet switching or broadcast.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
IGMP (Internet Group Management Protocol) operates between a host and its directly connected router. It allows hosts to join or leave multicast groups. PIM (Protocol Independent Multicast) operates between routers. It builds distribution trees (using RPF) to forward multicast packets from sources to all receivers across the network. In short: IGMP is for host-to-router signaling; PIM is for router-to-router forwarding. For the CCNA exam, know that IGMP is used on the last-hop router to learn about local receivers.
The router uses two mechanisms: (1) IGMP – the router learns which interfaces have receivers that have sent IGMP Membership Reports for a group. (2) PIM – the router receives PIM Join messages from downstream routers that have receivers. The combination populates the outgoing interface list in the mroute table. The router also performs an RPF check to ensure the packet arrived on the correct interface toward the source.
First, convert the IP to binary: 239.192.1.1 = 11101111.11000000.00000001.00000001. The low-order 23 bits are 1000000.00000001.00000001 (since the first 9 bits of the IP are not used). That binary is 0x80.0x01.0x01. The multicast MAC starts with 01-00-5E, then the 25th bit is 0, so the third octet is 0x80 (but the 25th bit is 0, so 0x80 is actually 10000000, but the 25th bit is the second bit of the third octet? Let's be precise: The multicast MAC format is 01-00-5E, then the next 23 bits are the low 23 bits of the IP. So for 239.192.1.1, the low 23 bits are 0x800101 (since 192.1.1 in binary: 11000000.00000001.00000001, but we drop the first bit of the first octet? Actually, the mapping: take the last 23 bits of the IP address. 239.192.1.1: 239 is 11101111, so the first 9 bits are 11101111 1? Wait, easier: The IP address in binary: 11101111 11000000 00000001 00000001. The last 23 bits are 1000000 00000001 00000001 (since the first 9 bits are 11101111 1? Actually, the first 9 bits are the first 9 bits of the IP: 11101111 1 = 239.128? This is messy. The correct mapping: The multicast MAC is 01-00-5E-40-01-01 for 239.192.1.1? Let's compute: The IP 239.192.1.1: 239 = 0xEF, 192=0xC0, 1=0x01, 1=0x01. The low-order 23 bits are the last 23 bits of the 32-bit IP. In hex, the IP is EF C0 01 01. The low 23 bits are the last 23 bits: that is bits 9-31. The first 9 bits are 0xEF and the first bit of 0xC0? Actually, 0xEF in binary is 1110 1111, so the first 9 bits are 1110 1111 1 (the first bit of 0xC0). The remaining 23 bits are 100 0000 0000 0001 0000 0001? This is confusing. The standard: The multicast MAC is 01-00-5E, then the 23-bit mapping: take the IP address, mask the first 9 bits (set to 0), then shift left? The formula: MAC = 01-00-5E + (IP & 0x7FFFFF) where the IP is considered as a 32-bit number? Actually, the low 23 bits of the IP are taken as is. So for 239.192.1.1, the IP in binary: 11101111 11000000 00000001 00000001. The low 23 bits are: 1000000 00000001 00000001 (since the first 9 bits are 11101111 1). That binary is 0x40 0x01 0x01? 1000000 = 0x40, 00000001=0x01, 00000001=0x01. So MAC = 01-00-5E-40-01-01. But wait, the 25th bit (the second bit of the third octet) must be 0. 0x40 has the 25th bit? The third octet is 0x40, which in binary is 01000000, the second most significant bit (bit 25) is 1? Actually, the 25th bit is the second bit of the third octet (since the first 24 bits are 01-00-5E, the 25th bit is the first bit of the fourth octet? This is a common point of confusion. The multicast MAC format: 01-00-5E, then the next 24 bits are the low 24 bits of the IP, but the 24th bit (the first bit of the fourth octet) is always 0? Actually, the I/G bit is already set in the first octet (01). The standard: The 23 low-order bits of the IP are copied into the 23 low-order bits of the MAC, with the high-order bit of the MAC's fourth octet set to 0. So the MAC is 01-00-5E-XX-YY-ZZ, where XX has the high-order bit (bit 24) set to 0. For 239.192.1.1, the low 23 bits are 1000000 00000001 00000001 = 0x40 0x01 0x01. So the MAC is 01-00-5E-40-01-01. However, many sources simplify by saying the MAC is 01-00-5E- followed by the last three octets of the IP with the first octet of that part having the high bit cleared. For 239.192.1.1, the last three octets are 192.1.1, but 192 in binary is 11000000, clear the high bit gives 01000000 = 64 = 0x40. So MAC = 01-00-5E-40-01-01. So the answer is 01-00-5E-40-01-01.
Yes. A host can send IP packets to any multicast group address without having joined that group. The source does not need to be a member. The receiver's router will only forward the packet if there are interested receivers. The source just sends packets with the multicast destination. This is a common exam point: the source does not need to join the group.
The Reverse Path Forwarding (RPF) check ensures that a multicast packet is accepted only if it arrives on the interface that the router would use to send unicast packets back to the source. This prevents loops and ensures the packet is coming from the correct direction. If the packet arrives on a different interface, it is dropped. The router looks up the source IP in its unicast routing table to determine the correct incoming interface.
The default IGMP version on Cisco IOS is IGMPv2. However, some newer IOS versions may default to IGMPv3. You can verify with `show ip igmp interface`. For the CCNA exam, assume IGMPv2 unless specified. IGMPv3 adds source-specific multicast support.
IGMP snooping is a feature on Layer 2 switches that allows the switch to listen to IGMP messages between hosts and routers. The switch builds a table that maps multicast groups to specific ports. When a multicast frame arrives, the switch forwards it only to ports that have interested hosts, rather than flooding to all ports. This reduces unnecessary traffic and improves security.
You've just covered IP Multicast Basics — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?