Multicast
Course Description
Sending traffic from one source to a single destination is called unicast. Sending traffic from one source to everyone in the subnet is called broadcast. Sending traffic from one or more sources to a group of receivers is called multicast. Multicast is efficient: the source sends each packet only once, and the network only delivers it where receivers want it. To make this work, we need several protocols: IGMP between hosts and routers, IGMP snooping on switches, and PIM between routers. In this course, you’ll learn how each of these works and how to configure them on Cisco routers and switches, from the basics up to topics like Auto-RP, BSR, anycast RP, bidirectional PIM, SSM, and IPv6 multicast.
Course Highlights
In this course you will learn:
- What multicast is and why it’s more efficient than unicast and broadcast.
- Which multicast IP addresses we use and how they map to multicast MAC addresses.
- How hosts join multicast groups with IGMP version 1, 2, and 3.
- How switches use IGMP snooping to stop flooding multicast traffic.
- How routers forward multicast traffic with PIM dense, sparse, and sparse-dense mode.
- How the RPF check works, and how to fix RPF failures.
- How to find the RP automatically with Auto-RP and BSR, and how to make it redundant with anycast RP and MSDP.
- How PIM uses the DR, assert, prune override, and register messages behind the scenes.
- How bidirectional PIM, SSM, and IPv6 multicast work.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 36 lessons in 5 units.
- Exams: covers the multicast topics of CCNP ENCOR 350-401 and CCIE Enterprise Infrastructure.
- Format: self-paced lessons with Cisco IOS configurations, packet captures, and video.
- Last updated: October 2026.
Requirements
- No multicast knowledge required; we start from the beginning.
- You should be familiar with IP routing and routing protocols like OSPF or EIGRP, since PIM relies on the unicast routing table.
Course Schedule
What is Multicast?
Multicast is a way to send traffic from one or more sources to a group of receivers. The source sends its packets to a multicast group address in the 224.0.0.0 to 239.255.255.255 range. Hosts that want to receive the traffic join the group, and the network makes sure each packet is copied only where there are receivers. Because the source sends each packet only once, it doesn’t matter whether there are 2 or 2000 receivers.
Multicast requires a few protocols working together. Hosts use IGMP (Internet Group Management Protocol) to tell their router which groups they want to receive. Switches use IGMP snooping to forward multicast traffic only on interfaces with receivers, instead of flooding it. Routers use PIM (Protocol Independent Multicast) to build multicast distribution trees. PIM doesn’t have its own routing table: it uses the unicast routing table for the RPF (Reverse Path Forwarding) check, which makes sure multicast packets arrive on the interface that leads back to the source.
Who uses multicast? You’ll find it wherever the same data has to reach many receivers at the same time: video and IPTV streaming, financial market data, video conferencing, and software distribution. Routing protocols like OSPF and EIGRP also use multicast to reach their neighbors. Multicast only supports UDP traffic, so applications have to deal with lost packets themselves.
Multicast Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Multicast Fundamentals
We start with the differences between unicast, broadcast, and multicast. IANA reserved the class D range, 224.0.0.0 to 239.255.255.255, for multicast. Some of it is reserved for protocols, and 239.0.0.0/8 is for use on your own network. On layer 2, multicast uses MAC addresses that start with 01-00-5E, and since only 23 bits are available for mapping, 32 multicast IP addresses share the same MAC address.
Lessons: Introduction to multicast, Multicast IP addresses, IP to MAC address mapping
IGMP (Internet Group Management Protocol)
Hosts use IGMP to tell their router which multicast groups they want to receive. IGMP version 1 only has membership reports and queries. IGMP version 2 adds leave group messages, group-specific queries, and a querier election where the router with the lowest IP address wins. IGMP version 3 adds source filtering, so a host can choose which sources it accepts traffic from. We also look at filtering groups and IGMP proxy for unidirectional links.
Lessons: IGMP version 1, IGMP version 2, IGMP version 3, IGMP filter, IGMP proxy
Multicast on Layer 2 Switches
A switch never learns a multicast MAC address as a source address, so by default it floods multicast traffic on all interfaces. IGMP snooping fixes this: the switch listens to IGMP messages between hosts and the router and only forwards traffic where receivers are. IGMP snooping needs a multicast router, or a switch that acts as the querier. CGMP is Cisco’s older alternative, and PIM snooping does the same for ports that connect to multicast routers.
Lessons: IGMP snooping, IGMP snooping without router, CGMP, PIM snooping
Multicast Routing with PIM
Routers need a multicast routing protocol, and on Cisco IOS that’s PIM. Dense mode floods multicast traffic everywhere and prunes it where nobody wants it. Sparse mode only forwards traffic when a receiver requests it, and uses an RP (Rendezvous Point) as a meeting point between sources and receivers. Sparse-dense mode lets you choose per group. Whatever mode you use, PIM only accepts multicast packets that pass the RPF check, and RPF failures are the most common reason multicast doesn’t work.
Lessons: Multicast routing, PIM dense mode, PIM sparse mode, PIM sparse-dense mode, RPF (Reverse Path Forwarding), Tunnel RPF failure
Rendezvous Points: Auto-RP, BSR, and Anycast RP
Configuring the RP statically on every router doesn’t scale and offers no redundancy. Auto-RP is Cisco proprietary: candidate RPs announce themselves to 224.0.1.39, and the mapping agent tells the network which RP to use on 224.0.1.40. BSR is the standard PIMv2 alternative and floods its messages hop by hop. With anycast RP, multiple routers share the same RP address, and MSDP lets them exchange information about their sources.
Lessons: Auto-RP, Bootstrap Router (BSR), Anycast RP, MSDP SA filtering, Auto-RP mapping agent behind spoke, PIM NBMA mode
PIM Under the Hood
Several PIM mechanisms make sure multicast is forwarded once, and only where it’s needed. The PIM DR forwards joins to the RP and registers sources with the RP using register messages. When two routers forward the same traffic onto a segment, the assert mechanism elects a single forwarder. On multi-access links, prune override makes sure a router doesn’t stop forwarding while another downstream router still wants the traffic. For remote sites behind slow WAN links, multicast stub routing lets the remote router forward IGMP messages to the main site with an IGMP helper address.
Lessons: PIM designated router, PIM register message, PIM assert, PIM prune override, Stub routing and IGMP helper
Bidirectional PIM, SSM, and Multicast Security
Bidirectional PIM is made for applications with many sources and receivers, like video conferencing: routers only keep (*,G) entries and traffic flows up and down the shared tree. SSM (Source Specific Multicast) goes the other way: receivers join a group from a specific source with IGMPv3, so there are no shared trees and no RP. We also protect the multicast domain with accept RP, accept register, and multicast boundary filtering.
Lessons: Bidirectional PIM, Source Specific Multicast (SSM), PIM accept RP, PIM accept register, Multicast boundary filtering
IPv6 Multicast
IPv6 relies on multicast even more than IPv4, since it has no broadcast. IPv6 multicast uses PIM as well, and you can find the RP with a static configuration, BSR, or embedded RP. Embedded RP is a neat trick where the RP address is encoded in the multicast group address itself, so you only configure it on the RP.
Lessons: IPv6 multicast BSR and RP, Embedded RP
Frequently Asked Questions
Multicast is a way to send traffic from one or more sources to a group of receivers. The source sends each packet once to a multicast group address, and the network copies it only to where receivers have joined the group. This saves bandwidth and load on the source compared to unicast. Read our introduction to multicast.
Unicast is traffic from one source to one destination. Broadcast is traffic from one source to everyone in the broadcast domain, whether they want it or not. Multicast is traffic from one or more sources to a group of receivers that have asked for it. Learn the differences.
IPv4 multicast uses the class D range: 224.0.0.0 to 239.255.255.255. The 224.0.0.0/24 range is reserved for protocols on the local link, like OSPF and EIGRP, and is never routed. The 239.0.0.0/8 range is meant for use within your own network, similar to private unicast addresses. Learn about multicast addresses.
IGMP (Internet Group Management Protocol) is the protocol hosts use to tell their router which multicast groups they want to receive. The router sends queries to check if there are still receivers. IGMPv2 adds leave messages, and IGMPv3 lets hosts choose the sources they want to receive traffic from. Learn how IGMP version 2 works.
IGMP snooping is a switch feature that listens to IGMP messages between hosts and the multicast router. The switch learns which interfaces have receivers for a group and only forwards multicast traffic on those interfaces. Without it, a switch floods multicast traffic out of all interfaces in the VLAN. Learn how IGMP snooping works.
PIM dense mode is a push model: it floods multicast traffic on all interfaces and prunes it where there are no receivers. PIM sparse mode is a pull model: it only forwards traffic when a receiver requests it, and it uses an RP as a meeting point between sources and receivers. Sparse mode is more efficient and the most common choice. Learn how PIM sparse mode works.
RPF (Reverse Path Forwarding) is a check that PIM does on every multicast packet. The router looks up the source address in the unicast routing table, and only accepts the packet if it arrives on the interface it uses to reach the source. This prevents loops; packets that fail the check are dropped. Learn about RPF.
In PIM sparse mode, the RP is a router that acts as a central meeting point. Sources register with the RP, and receivers join a shared tree toward the RP, so routers don’t have to know where every source is. You can configure the RP statically or find it automatically with Auto-RP or BSR. Learn how Auto-RP works.
Ready to master Multicast?
Get access to all 36 multicast lessons and every other course on NetworkLessons.com.