Understanding unicast, multicast, and broadcast traffic types is fundamental to Network+ N10-009. These transmission types determine how traffic flows through a network, how routers and switches handle it, and where it is or isn't forwarded. Multicast in particular is a key differentiator from unicast and broadcast, with its own addressing scheme and protocols.
Practice this topic
Unicast: one sender to one specific receiver. Source and destination are individual IP and MAC addresses. The most common traffic type — HTTP, SSH, most TCP sessions. Switches forward unicast frames only to the port where the destination MAC is known, or flood if unknown.
Broadcast: one sender to all receivers on a network segment. IPv4 limited broadcast: 255.255.255.255 — never forwarded by routers. Directed broadcast: 192.168.1.255 (all hosts in the 192.168.1.0/24 subnet) — may or may not be forwarded depending on router configuration. Ethernet broadcast MAC: FF:FF:FF:FF:FF:FF. DHCP Discover and ARP requests use broadcasts.
Multicast: one sender to a specific group of receivers who have subscribed to the group. IPv4 multicast addresses: 224.0.0.0–239.255.255.255 (Class D). Common multicast addresses: 224.0.0.1 (all hosts), 224.0.0.2 (all routers), 224.0.0.5 (all OSPF routers), 224.0.0.9 (all RIP routers). MAC address: 01:00:5E:xx:xx:xx where the last 23 bits map from the IP multicast address.
Anycast: one sender to the nearest (topologically closest) receiver among a group that shares the same IP address. Used heavily in IPv6 and CDN/DNS infrastructure. When a client sends to an anycast address, routing delivers the packet to whichever anycast server is closest by routing metric.
IGMP (Internet Group Management Protocol): allows hosts to join and leave multicast groups. Switches use IGMP snooping to track which ports have hosts that are members of each multicast group — forwards multicast traffic only to those ports instead of flooding all ports. Without IGMP snooping, multicast is treated like broadcast at Layer 2.
PIM (Protocol Independent Multicast): routing protocol that builds the multicast distribution tree in routed networks. PIM Dense Mode (PIM-DM): assumes all routers want traffic, then prunes. PIM Sparse Mode (PIM-SM): uses a Rendezvous Point (RP) that manages group membership — preferred for large networks.
Multicast addresses reserved for link-local use (224.0.0.0/24): routers do not forward these beyond the local segment. OSPF (224.0.0.5/6), RIP (224.0.0.9), EIGRP (224.0.0.10), and VRRP (224.0.0.18) all use link-local multicast.
Broadcast domain: the set of devices that receive a given broadcast. Routers separate broadcast domains — broadcasts are not forwarded across router interfaces. Switches and hubs do NOT separate broadcast domains (all ports in the same VLAN share a broadcast domain). VLANs create separate broadcast domains within a switch.
Broadcast storms: excessive broadcast traffic can consume all available bandwidth and overwhelm devices. Caused by: switching loops (without STP), malfunctioning network cards, poorly designed DHCP implementations. STP prevents loops; storm control limits broadcast rates on switch ports.
| Type | IPv4 Address Range | MAC Address | Routed? | Use Case |
|---|---|---|---|---|
| Unicast | Any unicast address | Specific MAC | Yes | Standard TCP sessions |
| Broadcast (limited) | 255.255.255.255 | FF:FF:FF:FF:FF:FF | No | DHCP Discover, ARP |
| Multicast | 224.0.0.0–239.255.255.255 | 01:00:5E:xx:xx:xx | Yes (with PIM) | Streaming, routing protocols |
| Anycast | Same IP on multiple hosts | Specific MAC | Yes | DNS, CDN, IPv6 |
Multicast traffic is forwarded like broadcast traffic
Multicast is forwarded only to subscribed group members — it is far more efficient than broadcast. Switches with IGMP snooping forward multicast only to ports with group members, not all ports. Routers only forward multicast traffic when PIM is configured and there are downstream group members
These questions are representative of what you will see on Network+ exams. The correct answer and explanation are shown immediately below each question.
A network contains 500 devices on a flat network (no VLANs, no routing). All devices receive all DHCP broadcast traffic. A network engineer creates 5 VLANs to segment the network. What is the immediate benefit regarding broadcast traffic?
Explanation: VLANs create separate broadcast domains on a switch. Broadcast traffic (DHCP, ARP) sent by a device in VLAN 10 is only seen by other devices in VLAN 10 — the other 4 VLANs don't receive it. This reduces broadcast overhead per segment from 500 devices to roughly 100 devices per VLAN. Broadcasts are not eliminated, not encrypted, and not forwarded by routers between VLANs (inter-VLAN routing requires a separate mechanism like a router-on-a-stick or Layer 3 switch).
IGMP snooping is a Layer 2 feature on managed switches that inspects IGMP join/leave messages to track which switch ports have multicast group members. Without it, multicast traffic is flooded to all ports in a VLAN — functionally the same as broadcast. With IGMP snooping enabled, the switch builds a multicast MAC address table and forwards traffic only to ports where hosts have joined the group. This is critical for networks with video streaming or routing protocols — without it, multicast bandwidth can overwhelm non-interested hosts.
Try free Multicast & Broadcast practice questions with explanations, topic links and progress tracking.