Layer 2 multicast is about how switches forward multicast frames based on MAC addresses, and how flooding is limited with IGMP snooping.
Facts / key topics
- Standard: IEEE 802.3 (Ethernet) · OSI: Layer 2 (Data Link)
- MAC range (IPv4 multicast):
0100.5E00.0000 – 0100.5E7F.FFFF - MAC range (IPv6 multicast):
33:33:xx:xx:xx:xx - Default switch behaviour: flooding (like broadcast) · control mechanism: IGMP snooping
- CCNA: concept + basic understanding · CCNP: design, edge cases, snooping tuning
Why does it exist?
Multicast is one-to-many. The switch does not understand IP multicast – only MAC. Without control, multicast floods to all ports: unnecessary load on hosts, wasted bandwidth, “broadcast-like” behaviour. Typical scenarios: IPTV, video streams, financial feeds, routing protocols (OSPF, EIGRP use multicast).
How is it solved?
- Multicast IP addresses are mapped to multicast MAC addresses
- The switch can flood (baseline) or listen to IGMP (snooping) and learn which ports want the traffic
- Result: only interested ports receive multicast
Step by step
- Multicast frame arrives: Ethernet frame with a multicast MAC; the switch doesn’t know the group yet → flooding
- IGMP snooping (if enabled): the switch sniffs IGMP joins/leaves and builds an L2 multicast table (MAC → ports)
- Normal operation: multicast frames are forwarded only to member ports
- Leave/timeout: host sends IGMP Leave → port removed from the group (CCNP: querier failover, robustness)
Key terminology
| Term | Explanation |
|---|---|
| Multicast MAC | MAC representing a multicast group |
| Flooding | Frame sent out all ports in the VLAN |
| IGMP snooping | Switch “listens” to IGMP to control forwarding |
| Querier | Device that sends IGMP queries |
| Multicast group | Logical group of receivers |
Elements
| Element | Description | CCNA | CCNP |
|---|---|---|---|
| Multicast flooding | Default switch behaviour | ✔ | ✔ |
| MAC mapping | IP → multicast MAC | ✔ | ✔ |
| IGMP snooping | Intelligent forwarding | ✔ | ✔ |
| IGMP querier | L2 querier on the switch | ✖ | ✔ |
| Fast leave | Fast port removal | ✖ | ✔ |
Dependencies & special considerations
- Requires IGMP (Layer 3 control); IPv6 uses MLD (same concept)
- VLAN-specific behaviour
- Snooping without a querier = ⚠️ risk (groups time out)
Configuration (Cisco IOS / IOS-XE)
! Basic (CCNA)
ip igmp snooping
! Advanced (CCNP)
ip igmp snooping vlan 10
ip igmp snooping querier
! Verification
show ip igmp snooping
show ip igmp snooping groupsTroubleshooting
- Multicast still floods → snooping disabled
- No traffic → no querier
- Wrong VLAN
show mac address-table multicast
show ip igmp snooping groupsDesign & best practices
- Enable IGMP snooping on access switches · ensure one querier per VLAN · use fast leave on access ports · avoid blind flooding in the campus
Exam tips ⚠️
- A switch doesn’t understand IP – only MAC
- Multicast without IGMP snooping = flooding
- See
0100.5E→ think IPv4 multicast - See
33:33→ think IPv6 multicast
Quick summary
- L2 multicast is controlled via MAC addresses · default = flooding · IGMP snooping is the key · the switch learns groups by listening · CCNA: understand → CCNP: control & design