Loading learning content...
Classes A, B, and C all share a fundamental assumption: each IP address identifies a single network interface on a single host. This unicast model works well for direct communication between two parties—web browsing, email, file transfers—but becomes grotesquely inefficient when one source needs to send identical data to many recipients.
Consider streaming a live video to 10,000 viewers. With unicast, the server transmits 10,000 identical streams—overwhelming bandwidth, server resources, and network infrastructure. This is where Class D multicast addresses provide an elegant solution.
Class D addresses (224.0.0.0 – 239.255.255.255) don't identify hosts. Instead, they identify groups. Any number of hosts can join a multicast group, and a single transmission to that group's address reaches all members efficiently—routers replicate packets only where necessary, minimizing bandwidth consumption.
By completing this page, you will understand: (1) The binary structure defining Class D (leading bits '1110'), (2) How multicast differs fundamentally from unicast and broadcast, (3) Well-known multicast addresses and their purposes, (4) The multicast address range structure and scoping, (5) How hosts join multicast groups (IGMP), and (6) Practical applications from video streaming to routing protocols.
Class D addresses are identified by their leading four bits being '1110'. Unlike Classes A-C, Class D has no network/host division—the entire address identifies a multicast group.
Binary anatomy of a Class D address:
┌───────────────────────────────────────────────────────────────────────┐│ 32-bit IPv4 Address │├───────────────────────────────────────────────────────────────────────┤│ 1 │ 1 │ 1 │ 0 │ G │ G │ G │ G │ G │ G │ G │ G │ G │ G │ G │ G │ ... │├───┴───┴───┴───┼───────────────────────────────────────────────────────┤│ Class D ID │ Multicast Group ID (28 bits) ││ (fixed) │ Identifies the specific multicast group │└───────────────┴───────────────────────────────────────────────────────┘ Binary Breakdown:┌───────────┬───────────┬───────────┬───────────┐│ Octet 1 │ Octet 2 │ Octet 3 │ Octet 4 ││ 1110GGGG │ GGGGGGGG │ GGGGGGGG │ GGGGGGGG ││ Group ID (28 bits) │└───────────────────────────────────────────────┘ First four bits = 1110 (mandatory for Class D)Remaining 28 bits: Group identifier (2^28 = 268,435,456 possible groups) NO network portion - NO host portionThe entire address identifies a GROUP, not an interfaceMathematical derivation of the range:
11100000 = 22411101111 = 239Therefore, any address with first octet between 224 and 239 is definitively Class D (multicast).
Critical distinction from unicast:
| Property | Unicast (A/B/C) | Multicast (D) |
|---|---|---|
| Identifies | Single host interface | Group of hosts |
| Assignment | Permanent per interface | Dynamic group membership |
| Subnet mask | Applicable | Not applicable |
| Routing | To specific destination | Replicated at branch points |
| Layer 2 mapping | ARP to single MAC | Special multicast MAC mapping |
Subnet masks are meaningless for multicast addresses. There's no network/host division to define. A multicast address is purely a group identifier. Attempting to subnet multicast ranges is a conceptual error.
Understanding multicast requires contrasting it with the two other transmission models—unicast and broadcast. Each serves different communication patterns:
| Property | Unicast | Broadcast | Multicast |
|---|---|---|---|
| Recipients | Exactly one | All hosts on network | Group members only |
| Source copies | One per recipient | One total | One total |
| Router replication | None (point-to-point) | Not forwarded | At branch points |
| Bandwidth usage | Linear with recipients | Minimal (one copy) | Optimal (shared paths) |
| Recipient control | None (pushed) | None (forced) | Opt-in groups (IGMP) |
| Scope | Global (any destination) | Local subnet only | Configurable (TTL/scope) |
| Example | Web browsing | DHCP discovery | Video streaming |
The efficiency advantage:
Consider sending 1 Gbps video to 1,000 recipients:
Multicast achieves broadcast's bandwidth efficiency while limiting delivery to interested parties—the best of both worlds.
UNICAST to 4 recipients: MULTICAST to 4 recipients: Server Server │ │ ├─────────────────────────────┐ (single stream) │ │ │ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ │Copy1│ ──► Recipient A │Copy │ │Copy │ └─────┘ └─────┘ └──┬──┘ │ │ ┌──┴──┐ ┌──┴──┐ │Copy2│ ──► Recipient B │Rtr1 │ (first replication) └─────┘ └──┬──┘ │ ┌──┴──┐ ┌──┴──┐ ┌┴┐ ┌┴┐ │Copy3│ ──► Recipient C │A│ │ │ └─────┘ └─┘ ┌┴┐ │ │Rt2│ (second replication) ┌──┴──┐ └┬──┘ │Copy4│ ──► Recipient D ┌┴┐ ┌┴┐ └─────┘ │B│ │C│ └─┘ └─┘Server bandwidth: 4x stream Server bandwidth: 1x streamNetwork copies: 4 Network copies: 3 (at branch points)Multicast excels when: (1) One source sends to many recipients, (2) Recipients are geographically distributed, (3) Data is identical for all recipients, (4) Real-time delivery matters. Classic examples: live video, stock tickers, software updates, online gaming state sync.
The multicast address space (224.0.0.0 – 239.255.255.255) is subdivided into ranges with different purposes and scopes. Understanding these ranges is essential for proper multicast deployment:
| Range | Name | Scope | Purpose |
|---|---|---|---|
224.0.0.0/24 | Local Network Control | Link-local | Routing protocols, not forwarded by routers |
224.0.1.0 – 224.0.1.255 | Internetwork Control | Global | Internet-wide multicast protocols |
224.0.2.0 – 224.0.255.255 | AD-HOC Block I | Global | General-purpose Internet multicast |
224.1.0.0 – 224.1.255.255 | ST Multicast Groups | Global | Internet Stream Protocol (historical) |
224.2.0.0 – 224.2.255.255 | SDP/SAP | Global | Session Announcement Protocol |
224.3.0.0 – 224.4.255.255 | AD-HOC Block II | Global | Additional general-purpose |
232.0.0.0/8 | Source-Specific Multicast | Global | SSM (modern efficient multicast) |
233.0.0.0/8 | GLOP Addressing | Global | Statically mapped from AS numbers |
234.0.0.0/8 | Unicast-Prefix-based | Global | Derived from unicast addresses |
239.0.0.0/8 | Administratively Scoped | Local/Site | Private multicast (like 10.x.x.x for unicast) |
Scope zones in detail:
Link-local (224.0.0.0/24): Packets with TTL=1 stay on the local network segment. Used by routing protocols like OSPF (224.0.0.5, 224.0.0.6) and RIP (224.0.0.9). Routers never forward these.
Site-local / Administratively Scoped (239.0.0.0/8): Similar to RFC 1918 private addresses for unicast. Organizations can use these internally without IANA coordination. Never forwarded outside the administrative domain.
Global (224.0.1.0 – 238.255.255.255): Internet-wide multicast for applications like IPTV, financial data feeds, or global collaboration tools. Requires multicast routing infrastructure.
Just as 10.x.x.x provides private unicast addressing, 239.x.x.x provides private multicast addressing. Organizations can use any address in 239.0.0.0/8 internally without registration. This is ideal for internal video distribution, building automation, or private application protocols.
IANA maintains a registry of well-known multicast addresses for standard protocols. Network engineers should recognize these addresses when analyzing traffic or configuring multicast routing:
| Address | Name | Protocol/Purpose |
|---|---|---|
224.0.0.0 | Base Address | Reserved, never used for traffic |
224.0.0.1 | All Hosts | All multicast-capable hosts on link |
224.0.0.2 | All Routers | All multicast routers on link |
224.0.0.4 | DVMRP Routers | Distance Vector Multicast Routing |
224.0.0.5 | OSPF All Routers | OSPF Hello/routing updates |
224.0.0.6 | OSPF DR Routers | OSPF Designated Router communication |
224.0.0.9 | RIPv2 Routers | RIP version 2 routing updates |
224.0.0.10 | EIGRP Routers | Cisco EIGRP routing protocol |
224.0.0.13 | PIM Routers | Protocol Independent Multicast |
224.0.0.18 | VRRP | Virtual Router Redundancy Protocol |
224.0.0.22 | IGMPv3 | IGMP membership reports |
224.0.0.102 | HSRPv2 | Cisco Hot Standby Router Protocol v2 |
224.0.0.251 | mDNS | Multicast DNS (Bonjour, Avahi) |
224.0.0.252 | LLMNR | Link-Local Multicast Name Resolution |
224.0.1.1 | NTP | Network Time Protocol multicast |
Why these matter in practice:
224.0.0.1 (All Hosts): Sending to this address reaches every multicast-capable host on the link. Used for general announcements.
224.0.0.5/224.0.0.6 (OSPF): If you see traffic to these addresses, OSPF routing is active. Firewall rules on internal interfaces must permit this.
224.0.0.251 (mDNS): Apple Bonjour and Linux Avahi use this for zero-configuration networking. AirPrint, AirPlay, and service discovery depend on it.
224.0.0.22 (IGMPv3): Modern multicast group management. If you see this, hosts are actively joining/leaving multicast groups.
When troubleshooting network issues: No traffic to 224.0.0.5 on a router interface? OSPF isn't running. Traffic to 224.0.0.251 blocked? Apple/Bonjour services won't work. Understanding well-known addresses makes protocol-level debugging intuitive.
How do hosts join multicast groups? How do routers know which segments have interested receivers? IGMP (Internet Group Management Protocol) provides the signaling mechanism that connects hosts to multicast distribution trees.
IGMP versions and evolution:
| Version | RFC | Key Features |
|---|---|---|
| IGMPv1 | RFC 1112 | Basic join/leave; query-response mechanism |
| IGMPv2 | RFC 2236 | Explicit leave messages; group-specific queries |
| IGMPv3 | RFC 3376 | Source filtering (include/exclude sources); SSM support |
IGMP operation overview:
Host wants to receive multicast group 239.1.1.1: 1. APPLICATION INTEREST ┌────────────────────────────────────────┐ │ Application calls: socket.join(239.1.1.1) │ └────────────────────────────────────────┘ │ ▼2. IGMP MEMBERSHIP REPORT ┌────────────────────────────────────────┐ │ Host sends IGMP Report to 239.1.1.1 │ │ "I want traffic for group 239.1.1.1" │ └────────────────────────────────────────┘ │ ▼3. ROUTER RECEIVES REPORT ┌────────────────────────────────────────┐ │ Router notes: segment X has members │ │ for group 239.1.1.1 │ │ Adds interface to multicast tree │ └────────────────────────────────────────┘ │ ▼4. TRAFFIC DELIVERY ┌────────────────────────────────────────┐ │ Router forwards 239.1.1.1 traffic │ │ to segment X │ └────────────────────────────────────────┘ Periodic Maintenance:- Router sends General Query (to 224.0.0.1) every ~125 seconds- Hosts respond with Membership Reports for active groups- If no reports received, router removes segment from tree Leave Process (IGMPv2+):- Host sends Leave Group message- Router sends Group-Specific Query- If no other members respond, remove segment from treeLayer 2 switches can 'snoop' on IGMP messages to learn which ports have multicast group members. Instead of flooding multicast to all ports (like broadcast), IGMP-snooping switches forward multicast only to ports with interested hosts—layer 2 multicast efficiency.
When a multicast packet reaches a local network, it must be encapsulated in an Ethernet frame. Unlike unicast (which uses ARP to resolve IP to MAC), multicast uses a direct mathematical mapping from IP multicast address to a special MAC address range.
The mapping algorithm:
IEEE/IANA Reserved Multicast MAC Range: 01:00:5E:00:00:00 – 01:00:5E:7F:FF:FF Mapping Rule: Multicast MAC = 01:00:5E:0 + lowest 23 bits of IP address Example: IP 239.255.1.100 Step 1: Convert IP to binary 239.255.1.100 = 11101111.11111111.00000001.01100100 Step 2: Extract lowest 23 bits 11111111.00000001.01100100 = 7F:01:64 (in hex) Step 3: Prepend multicast OUI with high bit clear 01:00:5E:7F:01:64 Result: 239.255.1.100 → 01:00:5E:7F:01:64 Verification:┌─────────────────┬────────────────────────┐│ Multicast MAC │ 01:00:5E:7F:01:64 ││ Octets │ 01 : 00 : 5E : 7F : 01 : 64 ││ First octet │ 01 = LSB set = multicast │└─────────────────┴────────────────────────┘The 23-bit overlap problem:
IP multicast addresses have 28 bits of group identification, but only 23 bits map to the MAC address. This means:
2^28 / 2^23 = 2^5 = 32 IP multicast addresses map to each MAC address
For example, these 32 addresses all map to the same MAC:
Implication: If a host joins 224.0.1.1, its NIC will receive packets for all 32 overlapping addresses. The IP layer must filter unwanted groups. This rarely causes problems in practice, but explains occasional 'extra' multicast traffic.
When designing multicast applications, be aware of MAC overlap. If two applications on the same network use IPs that map to the same MAC (e.g., 224.1.1.1 and 225.1.1.1), both will receive each other's traffic at layer 2, increasing CPU load for filtering.
Multicast enables applications that would be impractical or impossible with unicast. Here are the most significant real-world uses:
Live streaming, real-time data feeds, routing protocols, service discovery, OS deployment, time synchronization.
Internet-wide (lack of infrastructure), interactive bidirectional apps, guaranteed delivery scenarios, mobile networks.
The Internet multicast gap:
Despite its efficiency, Internet-wide multicast never achieved widespread deployment. Most ISPs don't enable multicast routing, and NAT devices complicate group membership. As a result, Internet video streaming (YouTube, Netflix) uses unicast with CDN caching rather than true multicast. Multicast thrives in controlled enterprise networks where administrators can enable and manage it end-to-end.
Traditional multicast (called Any-Source Multicast or ASM) allows any host to send to a group. This creates security and engineering challenges: who can send? How do you prevent unauthorized sources?
Source-Specific Multicast (SSM) addresses these issues by letting receivers specify both the group AND the source:
SSM channel format: (Source, Group) = (S, G)
| Aspect | ASM (Traditional) | SSM (Modern) |
|---|---|---|
| Address range | 224.0.0.0 – 239.255.255.255 | 232.0.0.0/8 (SSM-designated) |
| Group join | Join group G | Join (source S, group G) |
| Sources allowed | Any host can send | Only specified source(s) |
| Rendezvous point | Required (PIM-SM) | Not required |
| Security | Vulnerable to spoofing | Source validation inherent |
| Scalability | RP can be bottleneck | More scalable (no RP) |
| Protocol | IGMPv1/v2, PIM-SM | IGMPv3, PIM-SSM |
SSM operation:
Benefits:
For new multicast applications, prefer SSM (232.0.0.0/8) over ASM. The simplified architecture, better security, and eliminated RP complexity make SSM easier to deploy and maintain. Most modern multicast-enabled networks support SSM via IGMPv3 and PIM-SSM.
Class D represents a fundamentally different addressing paradigm—not host identification, but group communication. This one-to-many model enables applications impossible with unicast efficiency. Let's consolidate the key concepts:
What's next:
With Class D (Multicast) complete, we'll explore the final category: Class E (Reserved/Experimental) addresses in the 240-255 range. You'll understand why this large block remains unusable, the historical reasons for its reservation, and ongoing debates about reclaiming it for the exhausted IPv4 pool.
You now have comprehensive understanding of Class D multicast addressing: its unique binary structure, group communication model, address ranges and scoping, IGMP operations, MAC mapping, and practical applications. This knowledge enables you to design, troubleshoot, and optimize multicast-enabled networks.