VMware ESXi and vSphere Cluster Management

Ethernet Unicast, Multicast, and Broadcast MAC Addresses

Learn how Ethernet destination MAC addresses identify one device, a group, or every device in a VLAN, and how switches forward each frame type.

Why Ethernet Frames Use Destination MAC Addresses

An Ethernet frame is a Layer 2 data unit sent across a local Ethernet network. Its destination MAC address identifies which interface or interfaces should receive the frame. A MAC address is a Layer 2 Ethernet hardware address carried in the frame's source and destination fields.

The destination address is used by Ethernet switches to decide where to forward a frame. It is separate from IP addressing: an IP address may cause a host to create an Ethernet frame, but the switch examines the Ethernet destination MAC address when forwarding that frame on the local network.

Ethernet destination addresses fall into three main categories:

• Unicast: intended for one LAN interface.
• Multicast: intended for a selected group of interfaces.
• Broadcast: intended for every device in the local Layer 2 broadcast domain.

Unicast MAC Addresses

A unicast MAC address identifies one individual LAN interface. A unicast frame is therefore intended for one specific receiving device, such as a computer, server, printer, or router interface.

For example, suppose Host A sends a frame to Host B's MAC address. If the switch has learned that Host B's address is reachable through port 5, the switch forwards the frame only through port 5.

Switches learn unicast MAC addresses by examining the source MAC address of incoming frames. The resulting MAC address table maps learned MAC addresses to switch ports and, in a VLAN-aware switch, to VLANs.

Known Unicast Forwarding

When the destination unicast address is in the MAC address table, the switch performs targeted forwarding:

1. The frame arrives on the ingress port, meaning the port on which the switch received it.
2. The switch looks up the destination MAC address in its table.
3. The switch sends the frame through the associated egress port.
4. Other ports in the same VLAN do not receive that frame.

Unknown Unicast Flooding

A unicast address can be temporarily absent from the MAC address table. This can happen when the destination device has not transmitted recently, the table entry has expired, or the switch has not yet learned the device's location.

In that situation, the switch generally floods the frame: it sends the frame out all eligible ports in the same VLAN except the ingress port. This behavior does not change the address type. The destination is still a unicast address; the switch simply does not know which port leads to it.

Multicast MAC Addresses

A multicast MAC address represents a group of receiving devices. Hosts that are interested in the corresponding multicast group can accept frames sent to that group address. One sender can therefore deliver one frame to multiple selected receivers without addressing every receiver individually.

Multicast is different from broadcast because the intended recipients are a group rather than every device in the broadcast domain. Whether a particular host accepts a multicast frame depends on its network stack and group participation.

The Individual/Group Bit

The first octet of a destination MAC address contains the individual/group bit. This bit is the least-significant bit, or rightmost bit, of the first octet.

• A value of 0 identifies an individual address, normally called a unicast address.
• A value of 1 identifies a group address, used for multicast and the special broadcast address.

For example, the Cisco Discovery Protocol (CDP) multicast destination MAC address is 01:00:0C:CC:CC:CC. Its first octet is 01, which is binary 00000001. The rightmost bit is 1, so this is a group or multicast address.

How Switches Handle Multicast

Multicast forwarding depends on switch capabilities and configuration. Without multicast-aware controls, a switch may forward multicast traffic broadly to eligible ports within the relevant VLAN. This can cause devices that did not request the traffic to receive it at Layer 2, even if they ultimately discard the frame.

With relevant group-aware forwarding, the switch can limit delivery to ports connected to interested receivers. Features such as multicast group management and IGMP snooping can help a switch make that decision, but the exact behavior depends on the protocol, switch platform, and configuration.

Broadcast MAC Addresses

A broadcast address targets every device in the local Layer 2 broadcast domain. The standard Ethernet broadcast destination MAC address is:

FFFF.FFFF.FFFF

In colon notation, the same address is written as FF:FF:FF:FF:FF:FF. Every bit is binary 1:

11111111 11111111 11111111 11111111 11111111 11111111

When a switch receives a broadcast frame, it floods the frame out every eligible port in the same VLAN except the ingress port. The switch does not send the frame back through the port on which it arrived.

A broadcast is limited to its Layer 2 broadcast domain. A VLAN commonly defines one broadcast domain, so devices in VLAN 10 receive a VLAN 10 broadcast while devices in VLAN 20 on the same physical switch do not. Routers normally do not forward Layer 2 broadcasts between IP networks or VLANs.

Comparing Ethernet Address Types

Reading the First Octet in Hexadecimal and Binary

Each hexadecimal digit represents four binary bits. The first hexadecimal octet of a MAC address contains eight bits. To inspect the individual/group bit, convert or interpret the last bit of that octet.

A quick rule is useful: an even first hexadecimal octet ends in binary 0, so it indicates an individual address. An odd first hexadecimal octet ends in binary 1, so it indicates a group address.

• 00:... begins with an even value and is individual/unicast.
• 01:... begins with an odd value and is group/multicast.
• FF:FF:FF:FF:FF:FF has the group bit set, but its all-ones value gives it the special broadcast meaning.

Switch Forwarding Comparison

Switch forwarding depends on both the destination address type and the switch's knowledge or configuration.

Ingress Port and Flooding

The ingress port is the interface where a switch receives a frame. During flooding, the switch sends copies through other eligible ports but does not send a copy back through the ingress port. Sending the frame back where it arrived would be unnecessary and could contribute to loops or duplicate traffic.

“All ports” always means all eligible ports in the relevant VLAN, not necessarily every physical port on the switch. VLAN membership defines which ports participate in that Layer 2 domain.

Practical Forwarding Examples

Known Unicast Delivery

Host A sends a frame to Host B's learned MAC address. The switch finds Host B's address on port 5 and forwards the frame only through port 5. Hosts on other ports do not receive that frame.

Unknown Unicast Forwarding

Host A sends a frame with a unicast destination that is not currently in the switch's table. The switch floods the frame within the VLAN, except through Host A's ingress port. Once the switch learns where the destination address is located, later frames can be forwarded as known unicasts.

Broadcast Delivery

A frame arrives with destination FFFF.FFFF.FFFF. The switch recognizes the all-ones destination and floods the frame to all other eligible active ports in the same VLAN. Every station in that broadcast domain can receive it.

Identifying Multicast from the First Octet

The destination 01:00:0C:CC:CC:CC begins with 01. Since 01 is binary 00000001, its least-significant bit is 1. The address is therefore a group address and is used here as a multicast destination.

VLAN Broadcast Boundary

Suppose a physical switch has hosts in VLAN 10 and VLAN 20. A broadcast originating in VLAN 10 is flooded only to eligible VLAN 10 ports. Hosts assigned to VLAN 20 do not receive it, even though they use the same physical switch. A router or Layer 3 boundary also prevents the broadcast from normally crossing into another IP network.

Troubleshooting Address-Type Problems

Unexpected Traffic After a MAC Lookup Miss

If a host receives more traffic than expected after a switch cannot find a destination MAC entry, suspect unknown unicast flooding. Verify that the destination MAC address has been learned on the expected port and VLAN. Do not classify the frame as broadcast merely because several devices saw it.

All Devices in a VLAN Receive a Frame

Inspect the destination MAC address. If it is FFFF.FFFF.FFFF, all devices in the same broadcast domain receiving the frame is normal switch behavior.

An Address Does Not Look Like Broadcast

An address does not need to be all ones to be a group address. Check the least-significant bit of its first octet. A first octet such as 01 has that bit set and indicates multicast/group addressing.

Multicast Reaches Uninterested Ports

If multicast traffic reaches devices that did not request it, multicast-aware forwarding may be absent, disabled, or unable to identify receiver membership. The switch may consequently forward the traffic broadly within the VLAN.

A Broadcast Does Not Reach Another VLAN

This is normally expected. Confirm the VLAN assignment and the Layer 2 broadcast-domain boundary. Ethernet broadcasts are local to their broadcast domain and are not normally forwarded by routers between VLANs or IP networks.

Key Points to Remember

• The Ethernet destination MAC address tells the local network which interface or group should receive a frame.
• Unicast means one addressed interface; known unicasts are forwarded to one switch port.
• Unknown unicast frames may be flooded, but their destination address remains unicast.
• Multicast uses a group destination address. A first-octet least-significant bit of 1 identifies a group address.
• CDP uses the multicast destination 01:00:0C:CC:CC:CC.
• Broadcast uses FFFF.FFFF.FFFF, whose 48 bits are all binary ones.
• Broadcast flooding stays within the relevant VLAN and excludes the ingress port.
• VLANs define separate Layer 2 broadcast domains, even when VLANs share one physical switch.

For a related review of these address categories, see Unicast, Multicast, and Broadcast Addresses.