In Ethernet networks, every transmitted frame must specify its intended recipient through the destination MAC address. But not all communication is point-to-point. Network protocols frequently need to reach multiple devices simultaneously—whether discovering services, announcing presence, or distributing real-time data.

Ethernet supports three fundamental addressing modes, each serving distinct communication patterns:

1. Unicast: One sender to exactly one recipient
2. Broadcast: One sender to all devices on the LAN segment
3. Multicast: One sender to a selected group of recipients

Understanding these modes is essential because they behave fundamentally differently at the switch level, have distinct performance implications, and require different handling in protocol design.

Unicast is the most common addressing mode in Ethernet networks. A unicast frame targets exactly one network interface—identified by its unique MAC address—and is delivered only to that specific device.

Characteristics of unicast addressing:

• Destination MAC address has the I/G bit (Bit 0 of Byte 1) set to 0
• The first hexadecimal digit of the MAC address is even (0, 2, 4, 6, 8, A, C, E)
• Exactly one recipient receives the frame
• Switches forward based on MAC address table lookup
• Consumes network resources only along the path to the destination

Switch handling of unicast frames:

When a switch receives a unicast frame, it follows a precise algorithm:

1. Extract destination MAC from the frame header
2. Search MAC address table for an entry matching the destination
3. If found: Forward frame only to the port where that MAC was learned
4. If not found: Flood frame to all ports (except source)—this is 'unknown unicast flooding'
5. Learn the source MAC by associating it with the ingress port

Unknown unicast flooding:

When a switch doesn't know where a destination MAC is located (the MAC isn't in its forwarding table), it must flood the frame to all ports. This is a fallback mechanism that ensures delivery even when the table is incomplete. However, excessive unknown unicast flooding indicates:

• MAC table overflow (too many devices for table capacity)
• Asymmetric routes causing incomplete learning
• Network issues preventing the destination from responding (and being learned)

Common unicast communication patterns:

• Web browsing (HTTP/HTTPS requests and responses)
• File transfers (FTP, SMB, NFS)
• Email sending/receiving (SMTP, IMAP, POP3)
• Remote shell sessions (SSH, Telnet)
• Database queries between application and database server
• Most point-to-point application traffic

Broadcast addressing targets all devices on a LAN segment simultaneously. The broadcast address is a special, well-known value that all Ethernet interfaces are programmed to receive and process.

The Ethernet broadcast address:

Characteristics of broadcast addressing:

• Destination MAC is exactly FF:FF:FF:FF:FF:FF
• All 48 bits are set to 1 (255.255.255.255.255.255 in decimal)
• Every device on the broadcast domain receives the frame
• Switches flood broadcasts to all ports (except source)
• Cannot be filtered or blocked by Layer 2 switches
• Stopped at router boundaries (routers don't forward Layer 2 broadcasts)

Switch handling of broadcast frames:

Broadcast handling is unconditional:

1. Receive broadcast frame on any port
2. Flood to ALL other ports in the same VLAN/broadcast domain
3. No table lookup required — flooding is always performed
4. Learn source MAC normally from the frame's source address

This unconditional flooding is why broadcast traffic is a significant concern for network performance and scalability.

The broadcast domain:

A broadcast domain is the set of all devices that receive each other's broadcast frames. In a flat (non-VLAN) switched network, all devices on all switch ports form a single broadcast domain. Key points:

• Switches extend broadcast domains (broadcasts pass through switches)
• Routers terminate broadcast domains (broadcasts don't cross routers by default)
• VLANs segment broadcast domains (each VLAN is a separate broadcast domain)
• Large broadcast domains = more broadcast traffic seen by every device

Broadcast domain size implications:

Multicast is a middle ground between unicast (one recipient) and broadcast (all recipients). It enables communication with a specific group of interested devices without burdening the entire network.

Characteristics of multicast addressing:

• Destination MAC has the I/G bit (Bit 0 of Byte 1) set to 1
• The first hexadecimal digit is odd (1, 3, 5, 7, 9, B, D, F)
• Only devices 'subscribed' to the group address process the frame
• Ethernet NICs can be programmed to accept specific multicast addresses
• Switches may flood multicasts (like broadcasts) unless IGMP/MLD snooping is enabled

Reserved multicast ranges:

IPv4 Multicast: Addresses in the range 01:00:5E:00:00:00 to 01:00:5E:7F:FF:FF are reserved for IPv4 multicast. Key relationships:

• IPv4 multicast IPs are 224.0.0.0/4 (224.0.0.0 – 239.255.255.255)
• The lower 23 bits of the IP address map directly to the lower 23 bits of the MAC
• Note: The upper 5 bits of the IP address are not encoded in the MAC, creating 32-to-1 IP-to-MAC mappings (ambiguity exists)

Example mapping:

IPv4 Multicast: 224.1.2.3
Binary (lower 23 bits): 0.0000001.00000010.00000011
MAC Address: 01:00:5E:01:02:03

IPv6 Multicast: Addresses starting with 33:33: are reserved for IPv6 multicast:

• Format: 33:33:XX:XX:XX:XX where the last 4 bytes come from the IPv6 multicast address
• Example: IPv6 multicast ff02::1 (all nodes) maps to 33:33:00:00:00:01

Understanding when to use each addressing mode is crucial for protocol design and network planning. Each mode has fundamentally different characteristics:

Network Interface Cards perform address filtering in hardware to protect the CPU from processing every frame on the network. Understanding this filtering is essential for network analysis and troubleshooting.

Standard NIC filtering behavior:

A NIC in its default operational mode accepts frames matching these criteria:

1. Destination MAC matches the NIC's own unicast address
2. Destination MAC is the broadcast address (FF:FF:FF:FF:FF:FF)
3. Destination MAC is a multicast address the NIC has been programmed to receive

Frames not matching these criteria are silently discarded by the NIC hardware without consuming CPU cycles.

Promiscuous mode deep dive:

Promiscuous mode instructs the NIC to pass ALL received frames to the operating system, not just those addressed to the NIC. This is essential for:

• Packet capture tools (Wireshark, tcpdump)
• Network intrusion detection systems (Snort, Suricata)
• Network monitoring and debugging
• Bridging and switching in software
• Virtual machine networking

Important limitation: On modern switched networks, promiscuous mode only sees traffic that reaches your switch port. This includes:

• Traffic TO or FROM your device
• Broadcast frames
• Multicast frames (if flooding)
• Unknown unicast floods

To see other hosts' unicast traffic, you need to configure port mirroring (SPAN) on the switch, or use a network tap.

The size and structure of broadcast domains significantly impact network performance, scalability, and security. Thoughtful broadcast domain design is a key skill for network architects.

The broadcast domain problem:

Every device in a broadcast domain:

• Receives every broadcast frame
• Processes (at minimum, discards at NIC or OS level) each broadcast
• Consumes bandwidth proportional to total broadcast traffic

As broadcast domains grow, these costs accumulate, eventually degrading performance.

Segmentation strategies:

1. VLANs (Virtual LANs)

The primary tool for broadcast domain segmentation. VLANs create logically separate networks on shared physical infrastructure:

• Each VLAN is a distinct broadcast domain
• Broadcasts in VLAN 10 never reach VLAN 20
• Inter-VLAN traffic requires routing (Layer 3)
• Can be based on port, MAC address, or protocol

2. Physical Segmentation

Using separate switches or router-separated networks:

• Cleaner separation but less flexible
• Higher infrastructure cost
• May be required for regulatory compliance

3. Subnet-based Segmentation

Aligning Layer 2 (broadcast domain) with Layer 3 (subnet) boundaries:

• One subnet per VLAN is common practice
• Simplifies troubleshooting and documentation
• Router serves as broadcast boundary

When designing network protocols or applications, the choice of addressing mode has significant implications. Understanding these tradeoffs leads to more efficient, scalable protocol designs.

Decision framework:

Case study: ARP — Broadcast for Discovery, Unicast for Response

The Address Resolution Protocol (ARP) elegantly combines both modes:

1. ARP Request (Broadcast): 'Who has 192.168.1.1? Tell 192.168.1.50'

   • Destination MAC: FF:FF:FF:FF:FF:FF
   • All devices receive and inspect the request
   • Only the target IP owner responds

2. ARP Reply (Unicast): '192.168.1.1 is at 00:1A:2B:3C:4D:5E'

   • Destination MAC: Requestor's MAC address
   • Only the original requestor receives the reply
   • Efficient—reply doesn't burden entire network

This pattern—broadcast for discovery, unicast for response—is common in well-designed protocols.

Case study: DHCP — Broadcast When Necessary

DHCP demonstrates judicious broadcast use:

• DISCOVER: Broadcast (client has no address, doesn't know server)
• OFFER: Broadcast or unicast (client may not have IP yet)
• REQUEST: Broadcast (inform all DHCP servers of selection)
• ACK: Broadcast or unicast (client may not have finalized IP)

Once the client has a valid IP address, subsequent lease renewals can use unicast.

This page has explored the three fundamental addressing modes in Ethernet networks. Let's consolidate the essential points:

Looking ahead:

With addressing modes understood, the next page examines MAC address assignment—how addresses are allocated at the hardware and software levels, the role of IEEE registration, and modern practices like MAC address randomization for privacy.