Identifying Ethernet Multicast

Just like there are 3 different Ethernet header types, there are also 3 different types of Ethernet addresses:

  • Unicast
  • Broadcast
  • Multicast

A unicast frame contains the unique MAC address of the destination receiver. A broadcast frame contains all binary 1’s as the destination address (FFFF.FFFF.FFFF). A multicast frame contains the unique multicast MAC address of an application, protocol, or datastream.

Why is it important to be able to distinguish between the 3 types of Ethernet address type? In an Ethernet switch, each of the three are treated differently.

A unicast addressed frame is only sent out the specific port leading to the receiver. A broadcast frame is flooded out all ports. A multicast addressed frame is either flooded out all ports (if no multicast optimization is configured) or sent out only the ports interested in receiving the traffic.

It’s easy for the ethernet switch to identify a broadcast frame because there is only one universally known broadcast address, FFFF.FFFF.FFFF (all binary ones). Therefore it is easy for the switch to know these frames need to be flooded out all ports.

However, given there is such a wide variety of possible unicast and multicast Ethernet addresses, how does the switch distinguish between the two? It is important to properly make the distinction because the the two are handled so differently within the switch (a unicast frames goes to only one port, a multicast frame goes to some or all ports).

Does the switch have a database of all possible multicast MAC addresses it references for each frame? No, that would be inefficient.

How this is done efficiently is there is one specific bit in a Ethernet MAC address that signifies if the frame is unicast or multicast. The switch need only look at this one bit to make the distinction.

The IEEE has specified that the most significant bit of the most significant byte be used for this purpose. If its a 1, that means multicast, 0 means unicast. The most significant byte is the left most byte in the address, and the most significant bit is the right most bit of the byte (this is counter intuitive to most binary implementations where the left most bit usually labeled most significant).


Some quick examples of mulicast MAC addresses:

  • 0100.CCCC.DDDD
  • 0900.AAAA.BBBB

Some quick examples of unicast MAC addresses:

  • 0001.4455.6677
  • 0800.2233.4455

Each of the bolded numbers represents a 1 or 0 present in the most significant bit of the most significant byte.

This bit is also referred to as the Individual/Group bit.

From the perspective of an Ethernet hub device, none of this matters, as all frames are flooded out all ports regardless of their address being unicast, broadcast, or multicast. It makes no sense for an Ethernet hub to distinguish between the three.



References:CCIE Routing & Switching Exam Guide Vol 3




  1. Terryn says

    Hi Brad,

    Would it be safe to say, reading a MAC address in HEX, that if the 2nd char in from the left is even (or 0) its a Unicast address and if its odd it is a multicast address? Or have I got it horribly wrong?

    Thanks learning, much needed.

  2. Rubén says

    Hi Brad,

    I have a Cisco 3560 with IGMP snooping configured to control the multicast traffic. However, the switch is filtering frames addressed to a 0180.XXXX.XXXX multicast MAC address within a VLAN.

    I mean, the frames to this multicast address arrive to the switch from a port, and they are not forwarded to other port in the same VLAN.

    As far as I know, the switch must forward these multicast frames (no IP multicast packet, but multicast frame). Is it true? Should the switch forward them by default? Is there any way to force it forward these multicast frames within the same VLAN?

    Thanks. Rubén.

  3. amar says

    Just wondering…..
    Even the broadcast address will have 1 in most significant bytes most significant bit.
    So how does switch differentiates between broadcast and multicast address?
    Looks like its not only based on most significant bit alone.

    • Mike says

      In order for the address to be a broadcast address all the characters have to be Fs, not just the second character.

      /Super old post, but I felt like clarifying for anyone else that may find this article.

  4. jenia says

    I want to clarify Brad’s bit ordering mistake:

    The byte order in Ethernet is Big-Endian, while the bit order (transmission) is Little-Endian.
    Big-Endian byte order means that for 0xABCD, byte#0 will contain 0xAB and byte#1 will contain 0xCD
    The more relevant, bit order is Little-Endian, which means that for 0xF1 (=0b11110001) , ‘1’ will be the 1st transmitted bit, then ‘0’ , ‘0’, ‘0’, ‘1’, ‘1’, ‘1’, ‘1’.

    In Multicast address, the 1st received (and transmitted) bit is ‘1’, but this is the LEAST SIGNIFICANT bit in the leftmost byte. That’s why the odd/even technique works.

    • Avinash says


      I also think the same. is_mulicast_addr from include/linux/etherdevice.h check is as follows:

      return 0x01 & addr[0].

      If it were, Most significant bit of MSB, it would have been 0x80 & addr[0].

  5. Wojtek says

    Jenia hast the point:
    The sentenc
    “The IEEE has specified that the most significant bit of the most significant byte be used for this purpose. ”
    Should be “the least significant bit of the most significant byte”.

  6. Amandeep Singh says

    Wikipedia says, that least significant bit of most significant byte tells whether an address is a multicast address or not. Please correct.

  7. Rubén says

    Me ha servido de mucho, gracias.
    Ahora quiero saber y entender cómo se configura un switch de manera óptima para un switch.

    It was very helpful to me. Txs
    Now I want to know and understand how to do a well configuration in a switch.

  8. Rghv says

    Minor errata.

    The multicast Ethernet address is identified by the least significant BIT of the most significant BYTE.

    That apart helpful, thanks.

  9. jpp says

    yeah i remember having disagreed when reading this page (a colleague showed to me)
    confusion comes from the fact ethernet transmission is little indian (lsb first) as opposed to big indian (msb first) for TR and IBM. perhaps nice to correct since majority of readers may stop before reading the comments :-)


Leave a Reply

Your email address will not be published. Required fields are marked *