Multicast
Course Description
Sending traffic from one source to a single destination is called unicast. Sending traffic from one source to everyone in the subnet is called broadcast. Sending traffic from one or more sources to a group of receivers is called multicast. Multicast is efficient: the source sends each packet only once, and the network only delivers it where receivers want it. To make this work, we need several protocols: IGMP between hosts and routers, IGMP snooping on switches, and PIM between routers. In this course, you’ll learn how each of these works and how to configure them on Cisco routers and switches, from the basics up to topics like Auto-RP, BSR, anycast RP, bidirectional PIM, SSM, and IPv6 multicast.
Course Highlights
In this course you will learn:
- What multicast is and why it’s more efficient than unicast and broadcast.
- Which multicast IP addresses we use and how they map to multicast MAC addresses.
- How hosts join multicast groups with IGMP version 1, 2, and 3.
- How switches use IGMP snooping to stop flooding multicast traffic.
- How routers forward multicast traffic with PIM dense, sparse, and sparse-dense mode.
- How the RPF check works, and how to fix RPF failures.
- How to find the RP automatically with Auto-RP and BSR, and how to make it redundant with anycast RP and MSDP.
- How PIM uses the DR, assert, prune override, and register messages behind the scenes.
- How bidirectional PIM, SSM, and IPv6 multicast work.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 36 lessons in 5 units.
- Format: self-paced lessons with Cisco IOS configurations, packet captures, and video.
- Last updated: October 2026.
Requirements
- No multicast knowledge required; we start from the beginning.
- You should be familiar with IP routing and routing protocols like OSPF or EIGRP, since PIM relies on the unicast routing table.
Course Schedule
What is Multicast?
Multicast is a way to send traffic from one or more sources to a group of receivers. The source sends its packets to a multicast group address in the 224.0.0.0 to 239.255.255.255 range. Hosts that want to receive the traffic join the group, and the network makes sure each packet is copied only where there are receivers. Because the source sends each packet only once, it doesn’t matter whether there are 2 or 2000 receivers.
Multicast requires a few protocols working together. Hosts use IGMP (Internet Group Management Protocol) to tell their router which groups they want to receive. Switches use IGMP snooping to forward multicast traffic only on interfaces with receivers, instead of flooding it. Routers use PIM (Protocol Independent Multicast) to build multicast distribution trees. PIM doesn’t have its own routing table: it uses the unicast routing table for the RPF (Reverse Path Forwarding) check, which makes sure multicast packets arrive on the interface that leads back to the source.
Who uses multicast? You’ll find it wherever the same data has to reach many receivers at the same time: video and IPTV streaming, financial market data, video conferencing, and software distribution. Routing protocols like OSPF and EIGRP also use multicast to reach their neighbors. Multicast only supports UDP traffic, so applications have to deal with lost packets themselves.
Multicast Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Multicast Fundamentals
We start with the differences between unicast, broadcast, and multicast. IANA reserved the class D range, 224.0.0.0 to 239.255.255.255, for multicast addresses. Some of it is reserved for protocols, and 239.0.0.0/8 is for use on your own network. On layer 2, multicast uses MAC addresses that start with 01-00-5E, and since only 23 bits are available for MAC address mapping, 32 multicast IP addresses share the same MAC address.
IGMP (Internet Group Management Protocol)
Hosts use IGMP to tell their router which multicast groups they want to receive. IGMP version 1 only has membership reports and queries. IGMP version 2 adds leave group messages, group-specific queries, and a querier election where the router with the lowest IP address wins. IGMP version 3 adds source filtering, so a host can choose which sources it accepts traffic from. We also look at an IGMP filter that decides which groups hosts can join, and IGMP proxy for unidirectional links.
Multicast on Layer 2 Switches
A switch never learns a multicast MAC address as a source address, so by default it floods multicast traffic on all interfaces. IGMP snooping fixes this: the switch listens to IGMP messages between hosts and the router and only forwards traffic where receivers are. IGMP snooping needs a multicast router, or a switch that acts as the querier. CGMP is Cisco’s older alternative, and PIM snooping does the same for ports that connect to multicast routers.
Multicast Routing with PIM
Routers need a multicast routing protocol, and on Cisco IOS that’s PIM. Dense mode floods multicast traffic everywhere and prunes it where nobody wants it. Sparse mode only forwards traffic when a receiver requests it, and uses an RP (Rendezvous Point) as a meeting point between sources and receivers. Sparse-dense mode lets you choose per group. Whatever mode you use, PIM only accepts multicast packets that pass the RPF check, and RPF failures are the most common reason multicast doesn’t work; a tunnel RPF failure is a classic example.
Rendezvous Points: Auto-RP, BSR, and Anycast RP
Configuring the RP statically on every router doesn’t scale and offers no redundancy. Auto-RP is Cisco proprietary: candidate RPs announce themselves to 224.0.1.39, and the mapping agent tells the network which RP to use on 224.0.1.40. BSR is the standard PIMv2 alternative and floods its messages hop by hop. With anycast RP, multiple routers share the same RP address, and MSDP lets them exchange information about their sources, which you can limit with SA filtering. In hub and spoke networks, you’ll see what it takes to run Auto-RP with the mapping agent behind a spoke, and why the hub needs PIM NBMA mode.
PIM Under the Hood
Several PIM mechanisms make sure multicast is forwarded once, and only where it’s needed. The PIM DR forwards joins to the RP and registers sources with the RP using register messages. When two routers forward the same traffic onto a segment, the assert mechanism elects a single forwarder. On multi-access links, prune override makes sure a router doesn’t stop forwarding while another downstream router still wants the traffic. For remote sites behind slow WAN links, multicast stub routing lets the remote router forward IGMP messages to the main site with an IGMP helper address.
Bidirectional PIM, SSM, and Multicast Security
Bidirectional PIM is made for applications with many sources and receivers, like video conferencing: routers only keep (*,G) entries and traffic flows up and down the shared tree. SSM (Source Specific Multicast) goes the other way: receivers join a group from a specific source with IGMPv3, so there are no shared trees and no RP. We also protect the multicast domain with accept RP, accept register, and multicast boundary filtering.
IPv6 Multicast
IPv6 relies on multicast even more than IPv4, since it has no broadcast. IPv6 multicast uses PIM as well, and you can find the RP with a static configuration, BSR, or embedded RP. Embedded RP is a neat trick where the RP address is encoded in the multicast group address itself, so you only configure it on the RP.
Frequently Asked Questions
Not really. Most ISPs don’t route multicast between each other, so services like Netflix and YouTube use unicast, with content delivery networks close to their users. Multicast is used within networks under a single control, like an ISP’s own IPTV service, an enterprise, or a trading network. Learn about multicast routing.
The CCNA 200-301 only touches multicast addresses at a basic level. Multicast becomes a real topic at the CCNP level, where you need to know IGMP, PIM, and how the RP works, and it goes much deeper at the CCIE level. Many people study it as a separate topic because it works so differently from unicast routing. Learn about IGMP version 2.
Multicast has a reputation for being difficult, mostly because it turns unicast routing around: routers care about where traffic comes from, not where it goes. Take it one protocol at a time, IGMP first, then IGMP snooping, then PIM, and lab each step. Most multicast problems come down to the RPF check. Learn about RPF.
Multicast is a way to send traffic from one or more sources to a group of receivers. The source sends each packet once to a multicast group address, and the network copies it only to where receivers have joined the group. This saves bandwidth and load on the source compared to unicast. Read our introduction to multicast.
Multicast is used wherever the same data has to reach many receivers at the same time: IPTV and video streaming inside a provider or company network, financial market data, video conferencing, and software distribution. Routing protocols like OSPF and EIGRP also use multicast to reach their neighbors. Read our introduction to multicast.
Unicast is traffic from one source to one destination. Broadcast is traffic from one source to everyone in the broadcast domain, whether they want it or not. Multicast is traffic from one or more sources to a group of receivers that have asked for it. Learn the differences.
IPv4 multicast uses the class D range: 224.0.0.0 to 239.255.255.255. The 224.0.0.0/24 range is reserved for protocols on the local link, like OSPF and EIGRP, and is never routed. The 239.0.0.0/8 range is meant for use within your own network, similar to private unicast addresses. Learn about multicast addresses.
If you have multicast traffic like IPTV or video streams, yes. Hosts use IGMP to tell the network which multicast groups they want to receive, and IGMP snooping lets your switch listen in so it only forwards a stream to ports with receivers instead of flooding it everywhere. It needs a multicast router or an IGMP querier on the VLAN, otherwise the switch can stop forwarding the traffic. Learn how IGMP snooping works.