Unicast sends one copy per receiver; broadcast sends to everyone whether they asked or not. Multicast is the engineered middle: the source sends one copy to a group address, and the network replicates the packet only at the points where paths to interested receivers diverge. A market-data feed serving 500 desks, an IPTV channel with a million viewers and OSPF's own hellos are all the same mechanism at different scales.
Group addresses come from the old Class D space, 224.0.0.0/4. Three sub-ranges matter: 224.0.0.0/24 is link-local and never forwarded (224.0.0.5 is OSPF, 224.0.0.10 EIGRP), 232.0.0.0/8 is reserved for source-specific multicast, and 239.0.0.0/8 is the administratively scoped, RFC-1918-like range where enterprise applications should live. The mapping to Ethernet is lossy: the low 23 bits of the group address are placed into MAC 01:00:5e:00:00:00, so 32 IP groups share each MAC — one more reason filtering happens above layer 2.
IGMP: how receivers raise their hands
Multicast is receiver-driven — the network delivers a group only where someone asked. On each LAN, hosts signal interest with IGMP: unsolicited membership reports when an application joins, responses to the periodic general queries sent by the segment's elected querier, and leave messages on departure. IGMPv2 added leave/group-specific-query for fast pruning; IGMPv3 added source filtering — 'group G, but only from source S' — which is the enabler for SSM. Without help, a switch would flood multicast like unknown unicast; IGMP snooping fixes this by listening to reports and constraining each group to the ports that joined it, with the router port learned from queries.
SW# show ip igmp snooping groupsVlan Group Type Version Port List10 239.1.1.10 igmp v2 Gi1/0/7, Gi1/0/12R1# show ip igmp interface gi0/0 | include Querier IGMP querying router is 10.1.10.1 (this system)
Distribution trees and the RPF check
Between the routers, traffic flows down a distribution tree. A source tree (notated (S,G)) is rooted at the source and gives shortest paths at the cost of per-source state; a shared tree ((*,G)) is rooted at a rendezvous point and carries any source's traffic for the group with far less state. Multicast forwarding state is therefore not a routing table but a tree table — show ip mroute lists each (S,G) and (*,G) with one incoming interface and a list of outgoing interfaces.
The safety mechanism underneath everything is Reverse Path Forwarding: a router accepts a multicast packet only if it arrived on the interface the unicast routing table would use to reach the packet's source. Anything else is a potential loop or spoof and is dropped. RPF failures — visible in show ip mroute counters — are the single most common multicast fault, and they are always, ultimately, a unicast routing question: 'why does my path back to the source not match the tree?'.
The moving parts, assembled
- Hosts ↔ first-hop LAN: IGMP membership, constrained by IGMP snooping.
- Routers ↔ routers: a multicast routing protocol — in practice PIM, the subject of the next chapter — builds the trees.
- Every hop: RPF check against the unicast table, so multicast health always rests on unicast health.
- Addressing: applications in 239.0.0.0/8, planned to avoid the 32:1 MAC overlap within one VLAN.
Multicast rewards methodical labs: one source, two receivers, three routers, and show ip mroute open on every hop while you join and leave groups. Once tree state and RPF are intuitive, PIM sparse mode — where trees come from and how they are grafted and pruned — is the natural next chapter.