Part XVIII - Multicast Core

21. Multicast Core

Addressing, Ethernet mapping, IGMP versions, IGMP snooping, dense-mode pruning, and PIM-SM shared-to-source tree behavior.

1. 18.1 - Multicast Addressing

Multicast is one-to-group delivery. The sender emits one packet for a group address, hosts explicitly join that group, and routers replicate packets only where the multicast tree branches.

ModelDelivery targetRouter roleBandwidth effect
UnicastOne receiver.Forward toward one destination prefix.Sender repeats N copies for N receivers.
BroadcastEvery host on the L2 domain.Normally blocked at routed boundaries.Always floods, whether hosts care or not.
MulticastOnly joined receivers.Build and maintain distribution trees.One upstream packet, replicated at branch points.

2. 18.2 - Multicast MAC Mapping

IPv4 multicast groups map into the IANA Ethernet block 01:00:5E:00:00:00/25. Only the low 23 bits of the IPv4 group are copied, so 32 different IPv4 multicast groups can alias to the same Ethernet destination MAC.

IPv6 uses 33:33:xx:xx:xx:xx, copying the low 32 bits of the IPv6 group. For example, ff02::1 maps to 33:33:00:00:00:01. L2 switches still need IGMP or MLD snooping to avoid flooding these frames everywhere.

3. 18.3 - IGMP

IGMP is the IPv4 host-to-router control protocol for multicast membership. Routers send queries; hosts send reports. Version 2 adds explicit leave handling, and version 3 adds source filters that make Source-Specific Multicast possible.

VersionLeave mechanismSource filteringSSM support
IGMPv1Silent leave; router waits for timeout.No.No.
IGMPv2Leave Group plus Group-Specific Query.No.No.
IGMPv3State-change reports with compatibility behavior.INCLUDE / EXCLUDE source lists.Yes, with INCLUDE (S,G).

Minimal C Demo - IGMP Join, Leave, and Source Filter

IGMPv2 Leave vs IGMPv3 Source-Specific Join — C Demo
stdin (optional)

4. 18.4 - IGMP Snooping

IGMP snooping lets a switch infer multicast receiver ports by listening to IGMP Reports, Leaves, and Queries. Without it, most switches flood multicast frames like unknown destination traffic.

A snooping querier matters on VLANs without a multicast router. It keeps memberships refreshed by sending periodic queries. Fast-leave can remove a port immediately when the design guarantees one receiver per access port, which is common in IPTV access networks.

Minimal C Demo - Snooping Forwarding Table

IGMP Snooping Flooding vs Selective Forwarding — C Demo
stdin (optional)

5. 18.5 - PIM-DM

PIM Dense Mode assumes receivers are dense. It floods traffic first, then downstream routers with no interested receivers send Prune messages upstream. Prune state times out, so dense mode can periodically reflood unless state refresh is used.

The model is easy to reason about but expensive at scale. It fits small dense domains better than WANs or sparse receiver populations, where the initial flood is usually unacceptable.

6. 18.6 - PIM-SM Core

PIM Sparse Mode starts with no forwarding state. Receivers join a Rendezvous Point using (*,G)state, sources register with the RP, and the RP connects sources to receivers through the shared tree.

Once traffic is flowing, the last-hop router can switch to the shortest path tree with (S,G)state. RPF checks decide whether multicast traffic arrived from the correct upstream direction and prevent loops.

Minimal C Demo - PIM-SM Phases

PIM-SM Shared Tree to SPT Switchover — C Demo
stdin (optional)

7. Quiz / Interview Checks

Review questions
  1. What IPv4 range is multicast, and why is 224.0.0.0/24 special?
  2. Map 239.1.1.1 to an Ethernet multicast MAC and explain the 32-group aliasing problem.
  3. Why does IGMPv2 leave faster than IGMPv1, and what timer bounds the final prune?
  4. What does IGMPv3 add that PIM-SSM depends on?
  5. How does IGMP snooping change switch forwarding for multicast frames?
  6. Compare PIM-DM flood-and-prune with PIM-SM receiver-initiated joins.
  7. Why does PIM-SM use an RP first, and why does an LHR later switch to an SPT?