CCNA online course

Ethernet Unicast, Multicast, and Broadcast MAC Addresses

Learn how Ethernet destination MAC addresses identify one device, a device group, or every device in a VLAN, and how switches forward each frame type.

An Ethernet frame is a Layer 2 data unit that includes a source MAC address and a destination MAC address. The destination MAC address tells devices on the local Ethernet network which interface or interfaces should receive the frame.

A MAC address is a 48-bit Layer 2 hardware address. Ethernet destination addresses fall into three delivery categories:

  • Unicast: one destination interface.
  • Multicast: a selected group of interfaces.
  • Broadcast: every interface in the same Layer 2 broadcast domain.

The address category and the switch's forwarding action are related, but they are not the same thing. For example, an unknown unicast address is still a unicast address even though a switch may flood that frame through several ports.

For background on Layer 2 and the position of Ethernet in networking models, see the OSI Reference Model.

Reading Ethernet MAC Addresses

MAC addresses contain six octets, with each octet written as two hexadecimal digits. Common notation formats include:

  • Colon-separated: 00:25:96:12:34:56
  • Hyphen-separated: 00-25-96-12-34-56
  • Cisco-style dotted hexadecimal: 0025.9612.3456

The first octet is especially important when identifying a multicast destination. An octet contains eight bits. Its least significant bit, or LSB, is the bit with the lowest value: the rightmost bit.

First octet:  b7 b6 b5 b4 b3 b2 b1 b0
Bit value:     128 64 32 16  8  4  2  1
                                              ^
                                   least significant bit

For an Ethernet destination MAC address, a least significant bit of 1 in the first octet identifies a multicast or group destination. A value of 0 identifies an ordinary unicast destination. This test applies to the destination address; the source address has additional address-assignment rules.

Unicast MAC Addresses

Unicast means one-to-one Ethernet delivery. A unicast MAC address is assigned to one LAN interface, such as the Ethernet interface of a workstation, printer, server, or router.

Suppose a workstation sends a frame to a printer. The destination field contains the printer's unicast MAC address. The frame is intended for that one printer rather than for a group or every device on the LAN.

Known unicast forwarding

A switch learns source MAC addresses by examining received frames. It stores a mapping between a source MAC address, a switch port, and a VLAN in its MAC address table.

If the printer's destination MAC address is already in the table, the switch performs known-unicast forwarding:

  1. The frame arrives on the ingress port.
  2. The switch looks up the destination MAC address in the relevant VLAN.
  3. The switch sends the frame only through the port associated with that destination.

This behavior avoids sending the frame to unrelated ports. The switch still forwards the frame only within the applicable VLAN.

Unknown unicast flooding

An unknown unicast is a unicast frame whose destination MAC address is not currently present in the switch's MAC address table for that VLAN. This can happen when a destination has not transmitted recently, when a table entry has aged out, or while a switch is learning a new topology.

Because the switch does not know which port leads to the destination, it floods the frame through eligible ports in that VLAN, excluding the ingress port. When the destination responds, the switch can learn its location and later use known-unicast forwarding.

Multicast MAC Addresses

Multicast means one-to-many delivery to a selected group of LAN devices. A multicast destination MAC address represents a group rather than one individual interface.

Devices can join, listen to, or otherwise be associated with particular multicast groups. A host's network interface normally accepts multicast frames only for groups that the host is listening to, along with frames addressed to its own MAC address and the Ethernet broadcast address.

Recognizing a multicast MAC address

Inspect the first octet of the destination MAC address and test its least significant bit:

  • LSB is 0: ordinary unicast destination.
  • LSB is 1: multicast or group destination.

For example, the first octet in 01:00:0C:CC:CC:CC is 01. In binary, 01 is 00000001, so its least significant bit is set to 1.

Cisco Discovery Protocol (CDP) uses 01:00:0C:CC:CC:CC as a well-known Ethernet multicast destination address. This is a useful recognizable example of a multicast MAC address.

Multicast forwarding

Multicast forwarding depends on the switch's behavior and configuration. A basic switch may replicate multicast frames to multiple ports in the VLAN. A switch with group-awareness features, such as multicast snooping, can make more selective forwarding decisions and send traffic only toward ports with interested receivers.

Therefore, multicast delivery should not be described as identical to broadcast flooding. Broadcast is inherently addressed to every device in the broadcast domain. Multicast is addressed to a group, and the switch or receiving host may use group membership information to limit delivery or acceptance.

Broadcast MAC Addresses

Broadcast means one-to-all delivery within a Layer 2 broadcast domain. A broadcast domain is the set of interfaces that receive a Layer 2 broadcast. VLANs divide broadcast domains, and routers normally separate them as well.

The Ethernet broadcast MAC address is an all-ones address:

  • Colon notation: FF:FF:FF:FF:FF:FF
  • Hyphen notation: FF-FF-FF-FF-FF-FF
  • Dotted notation: FFFF.FFFF.FFFF

Each hexadecimal F represents four binary 1 bits, so this address contains 48 binary ones.

How a switch handles broadcast

When a switch receives a broadcast frame, it floods the frame through all eligible ports in the same VLAN except the ingress port.

  1. A host transmits a frame addressed to FF:FF:FF:FF:FF:FF.
  2. The switch receives the frame on the ingress port.
  3. The switch sends copies through the other eligible ports in that VLAN.
  4. Devices connected to those ports receive the frame at Layer 2.

The ingress port is excluded because the sending device already transmitted the frame. Sending a copy back to that same port would not deliver useful new information to the sender.

Broadcasts remain within the local Layer 2 broadcast domain and normally do not cross a router. A broadcast in one VLAN is not flooded into another VLAN merely because both VLANs use the same physical switch.

Do not confuse an Ethernet broadcast MAC address with an IPv4 broadcast address. The Ethernet address is a Layer 2 destination in the frame. An IPv4 broadcast address is a Layer 3 address carried inside the frame. This lesson focuses on the Ethernet address.

Comparing Ethernet Delivery Types

Delivery type | Intended recipients | Destination MAC characteristic | Typical switch behavior | Example

Known unicast | One specific interface | Ordinary unicast MAC; destination is in the MAC address table | Forward through only the associated port in the VLAN | Workstation sends to a learned printer MAC

Unknown unicast | One specific interface, although its location is not known yet | Ordinary unicast MAC; destination is absent from the MAC address table | Flood through eligible ports in the VLAN except the ingress port | Frame sent before the switch learns the destination location

Multicast | Members of a selected group | LSB of the first destination octet is set to 1 | Replicate according to switch behavior and group-awareness configuration | 01:00:0C:CC:CC:CC for CDP

Broadcast | Every device in the same broadcast domain | FF:FF:FF:FF:FF:FF | Flood through all eligible ports in the VLAN except the ingress port | Ethernet broadcast frame

Switch forwarding decisions are made within a VLAN or broadcast domain. Physical proximity to the same switch does not make devices in different VLANs part of the same Layer 2 broadcast domain.

Important Ethernet Address Examples

Address | Address category | How it is recognized | Use or meaning

FF:FF:FF:FF:FF:FF | Broadcast | All 48 bits are binary 1 | Every device in the local Layer 2 broadcast domain

01:00:0C:CC:CC:CC | Multicast | First octet 01 has its least significant bit set | Well-known CDP multicast destination

00:25:96:12:34:56 | Ordinary unicast | First octet 00 has its least significant bit cleared | One specific LAN interface

What the Receiving NIC Accepts

The network interface controller, or NIC, examines the destination MAC address of each received Ethernet frame. Under normal operation, it accepts frames addressed to:

  • Its own unicast MAC address.
  • The Ethernet broadcast address.
  • Multicast groups that the host is configured or designed to receive.

A switch may physically forward a multicast frame toward several ports, but that does not mean every host will pass the frame to its operating system or application. Physical delivery, NIC acceptance, and application processing are separate steps.

Practical Forwarding Scenarios

Known unicast communication

A workstation sends a frame to a printer whose MAC address has already been learned. The switch finds the printer's MAC-to-port mapping in the relevant VLAN and sends the frame only to the printer's port.

Unknown unicast before MAC learning

A host sends to a destination MAC that is not in the switch table. The switch cannot select one destination port, so it floods the frame to eligible ports in that VLAN except the ingress port. The destination address remains unicast; only the temporary forwarding behavior resembles broadcast flooding.

Broadcast delivery

A host sends a frame to FF:FF:FF:FF:FF:FF. The switch floods it to all other eligible ports in the same VLAN, and connected devices receive it at Layer 2. Devices in other VLANs do not receive it unless a Layer 3 service creates a separate transmission.

Multicast group traffic

A device sends a frame to 01:00:0C:CC:CC:CC. The first octet's least significant bit identifies the destination as multicast. The switch's multicast handling and the receiving NIC's group membership determine which devices ultimately accept the frame.

Troubleshooting Common Misunderstandings

“Every flooded frame is a broadcast.”

Check the destination MAC address and the reason for flooding. A broadcast has the all-ones destination address. An unknown unicast has an ordinary unicast destination whose switch-table location is unknown.

“A device in another VLAN should receive this broadcast.”

Verify the VLAN and broadcast-domain boundaries. A Layer 2 switch normally floods a broadcast only within the VLAN where it arrived. Inter-VLAN communication requires Layer 3 forwarding, and routers do not normally forward Layer 2 broadcasts.

“This multicast MAC address is unicast because it is not all ones.”

Inspect the least significant bit of the first destination octet. For 01:00:0C:CC:CC:CC, the first octet is 01, whose least significant bit is 1; therefore it is a multicast destination.

“The sender should receive its own broadcast back from the switch.”

A switch floods a broadcast to other eligible ports, not to the ingress port. The sender already has the frame it transmitted, so returning it through the same port is unnecessary.

“Every host must process every multicast frame.”

Separate forwarding from acceptance. A switch may forward multicast traffic to several ports, but a host NIC normally accepts multicast traffic only for groups it is listening to, in addition to its own unicast and broadcast traffic.

Exam-Relevant Summary

  • Unicast is one-to-one; multicast is one-to-many; broadcast is one-to-all within a Layer 2 broadcast domain.
  • A known unicast is sent only through the learned destination port in the correct VLAN.
  • An unknown unicast may be flooded, but its destination MAC is still unicast.
  • The least significant bit of the first destination MAC octet set to 1 indicates multicast.
  • 01:00:0C:CC:CC:CC is a recognizable CDP multicast MAC address.
  • FF:FF:FF:FF:FF:FF is the Ethernet broadcast MAC address.
  • A broadcast is flooded to eligible ports except the ingress port.
  • Broadcast flooding stays within the originating VLAN or broadcast domain and normally does not cross a router.
  • Multicast forwarding can use group-awareness features and is not automatically identical to broadcast flooding.

Understanding both the destination address and the switch's forwarding decision is essential for analyzing Ethernet traffic, VLAN behavior, and MAC address-table learning. For VLAN separation and inter-VLAN forwarding context, review Configure Trunk Ports and Configure Router On A Stick.