Unicast, Broadcast and Multicast

What “traffic type” means

Every frame and packet has a destination address. That address does not only say where the data goes; it also says how many devices should receive it. There are three main types, plus a fourth special case:

Why it matters

A unicast frame is cheap: only the device it is addressed to spends any effort on it, and other network cards discard it straight away. A broadcast must be read and processed by every device in the network, even those that do not need it. Choosing the right traffic type keeps networks efficient:

• Unicast for normal conversations, when the sender knows exactly which device it wants.
• Broadcast only when the sender does not yet know who to ask (“who has this IP address?”, “is there a DHCP server?”).
• Multicast when the same data is wanted by several devices at once.

Quick comparison

Where it happens: Layer 2 and Layer 3

The traffic type is marked twice in every IP packet sent over Ethernet: once in the destination MAC of the Ethernet frame (Layer 2), and once in the destination IP of the packet inside (Layer 3). The two usually agree: an IPv4 broadcast travels in a frame sent to ff:ff:ff:ff:ff:ff.

• Switches act on the MAC address type: they forward unicast to one port, flood broadcasts, and flood multicast or deliver it only to group members.
• Network cards use the MAC type to decide whether to accept a frame.
• Routers act on the IP address type: they route unicast, do not forward broadcasts, and route multicast only if they are configured to.

ARP is a special case: its messages have no IP header at all, and an ARP request is a pure Layer 2 broadcast. With no IP address to route on, a router never forwards ARP, so it never leaves the local network.

Unicast: one to one

Unicast is the normal case: one sender, one receiver. The destination MAC address is the receiver's own address (or the router's, if the receiver is on another network), and the destination IP address is the receiver's.

Real examples: loading a web page, sending an email, an SSH session, a video call and a DNS query to your resolver. When you open https://routelearn.net, every packet of that connection is unicast. One small exception: if a switch has not yet learned where the receiver is, it floods that unicast frame out of every other port (this is called an “unknown unicast”).

Learn more: How a Switch Learns MAC Addresses

Broadcast: one to all

A broadcast is delivered to every device in the local network (the broadcast domain). It is used when the sender does not yet know which device to talk to. There are broadcast addresses at both Layer 2 and Layer 3:

Real broadcast example 1: ARP

A PC knows the IP address it wants to reach but not the matching MAC address. ARP sends a request to ff:ff:ff:ff:ff:ff. Every device reads it, but only the device that owns that IP address replies.

Real broadcast example 2: DHCP Discover

A laptop that has just joined a network has no IP address and does not know where the DHCP server is. So it broadcasts at both layers:

Because broadcasts stop at routers, a DHCP server on another subnet cannot hear these requests on its own. The router needs a DHCP relay, which forwards them to the server as unicast.

Learn more: DHCP

Why routers stop broadcasts

If routers forwarded broadcasts, every ARP request from every PC in the world would reach every other device on the internet, and nothing else would fit on the links. So routers draw a line: a broadcast stays inside its own network. The area a broadcast can reach is called a broadcast domain. Each router interface (and each VLAN) is a separate broadcast domain. The next lesson explains this in detail.

Learn more: Broadcast Domains

Multicast: one to a group

Multicast sends one stream to a group. Devices that want the stream join the group; other devices ignore it. The sender sends each packet once, no matter how many receivers there are.

Multicast addresses

From multicast IP to multicast MAC

A multicast frame needs a destination MAC address too. There is no ARP for groups, so the MAC address is calculated from the IP address:

1. Start with the fixed prefix 01:00:5e (the I/G bit is set, marking a group).
2. Copy the last 23 bits of the IPv4 group address into the remaining bits.

Going deeper
IPv4 multicast addresses have 28 variable bits, but only 23 of them fit in the MAC address. So 32 different group addresses share each MAC address: for example, 239.1.1.1 and 239.129.1.1 both map to 01:00:5e:01:01:01. A host may therefore receive a frame for a group it did not join; its IP software then discards it.

Real multicast examples

• Video and IPTV: a hotel or company sends TV channels as multicast groups, and each TV joins the group for the channel being watched.
• OSPF hellos: on Ethernet, routers running OSPF send “hello” messages every 10 seconds by default to 224.0.0.5, so all OSPF routers on the link hear them without needing to know each other's addresses.
• mDNS / Bonjour: your phone finds a printer or a smart speaker by asking the 224.0.0.251 group.
• IPv6 basics: Neighbor Discovery messages, including router advertisements, use multicast instead of broadcast.

Joining groups: IGMP and IGMP snooping

Hosts tell the network which groups they want with IGMP (Internet Group Management Protocol; MLD in IPv6). A switch without snooping treats multicast like broadcast and floods it out of every port in the VLAN. A switch with IGMP snooping listens to those join messages and sends each group only to the ports that asked for it. On networks with heavy multicast, such as IPTV or security cameras, snooping is what stops the streams from overloading every PC.

A note on anycast

Anycast is not a special address range. It is a routing technique: the same unicast IP address is given to servers in many places, and every location advertises it to the internet. Normal routing then delivers each user's packets to the nearest server, measured by routing (usually, but not always, the closest one geographically).

Large public DNS resolvers, the DNS root servers and content delivery networks (CDNs) all use anycast. To the user, and on the local LAN, it looks exactly like unicast.

How a switch treats each type

Seeing each type in a capture

$ sudo tcpdump -e -n -i eth0
09:30:11.402118 02:00:00:00:00:aa > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.1 tell 192.168.1.10, length 28
09:30:11.402650 02:00:00:00:00:01 > 02:00:00:00:00:aa, ethertype ARP (0x0806), length 60: Reply 192.168.1.1 is-at 02:00:00:00:00:01, length 46
09:30:11.402711 02:00:00:00:00:aa > 02:00:00:00:00:01, ethertype IPv4 (0x0800), length 74: 192.168.1.10.40112 > 203.0.113.10.443: Flags [S], seq 2085160123, win 64240, options [mss 1460,sackOK,TS val 401922 ecr 0,nop,wscale 7], length 0
09:30:12.118044 02:00:00:00:00:cc > 01:00:5e:00:00:fb, ethertype IPv4 (0x0800), length 87: 192.168.1.30.5353 > 224.0.0.251.5353: 0 PTR (QM)? _ipp._tcp.local. (45)

Useful filters to see only one type:

When traffic types cause trouble

💡 Quick health check: run a capture with the broadcast filter for one minute. A few ARP and DHCP messages per second is normal. Hundreds or thousands per second point to a loop or a faulty device.

Common mistakes

• Thinking switches stop broadcasts. Switches flood broadcasts out of every port in the VLAN. Only routers (and VLAN boundaries) stop them.
• Calling multicast “a kind of broadcast”. Multicast is meant only for devices that joined the group. With IGMP snooping, switches deliver it only to those devices.
• Looking for broadcasts in IPv6. IPv6 has no broadcast; it uses multicast groups such as ff02::1 instead.
• Assuming an ARP reply is a broadcast. Only the request is a broadcast. The reply goes straight back to the asker as unicast.
• Thinking anycast needs special addresses. It uses ordinary unicast addresses; routing decides which server each user reaches.

Check yourself

Where to go next

Continue with Broadcast domains to see exactly where broadcasts stop. To review how broadcasts are used, see ARP fundamentals and DHCP. To review how addresses are built, see MAC addresses.