Networking 101: Understanding Multicast Routing

by Charlie Schluting

Whether you're watching a celebrity childbirth streaming live from Africa or just trying to help your enterprise network run more efficiently, understanding mulitcast routing is key.

Multicast has become a buzzword more than once in history. IP multicast means that one sender is sending data to multiple recipients, but only sending a single copy. It's very useful for streaming media, so let's explore how this works.

Much like broadcast, there are special addresses designated for multicast data. The difference is that some of these can be routed, and used on the Internet. The multicast space reserved by IANA is We do not say, "Class D" anymore. The addresses spanned by 224/4 are through

Multicast is more efficient than broadcast, because broadcast packets have to be received by everyone on the local link. Each OS takes an interrupt, and passes the packet on for inspection, which normally involves some data copies. In multicast, the network card doesn't listen to these multicast packets unless it has been told to do so.

By default, with multicast-enabled network cards, the NIC will listen to only at boot. This is the address assigned to "all systems on this subnet." Yes, that's very similar to broadcast. In fact, many people say that broadcast is a special case of multicast.

Multicast is selective in who it sends to, simply by nature of how network cards can ignore uninteresting things. This is how the local link works, but how about the Internet? If someone wants to stream the birth of a celebrity's baby in Africa via multicast, we don't want every router on the Internet consume the bandwidth required to deliver it to each computer. Aside from the NIC being able to make decisions locally, there are multicast routing mechanisms that serve to "prune" certain subnets. If nobody wants to see it within your network, there's no reason to let it travel into the network.

People who are interested in seeing such a spectacle will run a special program, which in turn tells the NIC to join a multicast group. The NIC uses the Internet Group Management Protocol (IGMP) to alert local multicast routers that it'd like to join a specific group. This only works one-way, though. If someone wants to send and receive multicast, the IP layer will need to be fancier. For sending, IP will map an IP address to an Ethernet address, and tell the NIC driver so that it can configure the card with another MAC address.

IGMP itself is very simple. It's very similar to ICMP, because it uses the IP layer, only with a different protocol number. The header consists of only four things: a version; a type; a checksum; and the group, i.e. multicast address, to be joined. When that packet is sent, a multicast router now knows that at least one host is interested in receiving packets for a specific multicast address. Now that router must somehow do multicast routing with other routers to get the data.

Here it gets interesting. There are a few multicast routing mechanisms that we'll talk about today: DVMRP and PIM. Pausing for just a moment, it's important to realize that even today multicast isn't widely supported. Back in the day there was a mbone, or multicast backbone, that people connected to via IPIP (IP encapsulated in IP) tunnels. The Unix application mrouted understood DVMRP and IGMP when the Internet routers did not. Most people who wish to use multicast nowadays still find themselves asking their ISPs why certain protocols aren't working.

DVMRP is the Distance Vector Multicast Routing Protocol. It uses IGMP sub-code 13, and does what's called Dense Flooding. Dense flooding is very effective, but very inefficient. A router will flood to everyone in the beginning, and then prune back uninterested subnets. PIM, or Protocol-Independent Multicast, is independent of unicast routing mechanisms. In dense mode operation, it is very much like DVMRP. PIM dense mode is essentially the same as DVMRP, except PIM uses IP protocol 103. PIM implements joins, prunes, and grafts. A graft is the opposite of a prune: it grafts a branch back onto the tree.

Dense mode multicast routing, regardless of protocol, works by sending data to everyone and then pruning back parts of the tree. A tree, as always, is used to represent a set of routers. When a bunch of branches get pruned, routers can eventually eliminate bigger and bigger chunks. If no branches are interested within an AS, the border router can send a prune message to the upstream router, hence it stops wasting bandwidth.

Sparse mode multicast routing utilizes a Rendezvous Point, or RP. All join messages are sent to the RP's unicast address, so this clearly requires a bit of prior knowledge. PIM sparse mode also operates a bit more intelligently. It uses shared trees, but if a router notices that it's closer to the source it can send a join upstream to ensure traffic starts flowing through the best point. The newly designated router then becomes the source distribution point for the network.

This is all fine and dandy, except for one little detail: the Internet isn't a vertical tree. Enterprises want to connect redundantly, so naturally giant loops will form. Reverse Path Forwarding (RPF) is used in multicast too, to make sure that loops don't happen. The basic idea is verify that the interface a multicast packet arrives on is the shortest unicast path back to the sender. If not, then it probably didn't come from the sender, so the packet is dropped. If the RPF check is successful, the packet is duplicated and sent to everyone in the group.

Quite a few other multicast routing protocols exist in the wild. OSPF has MOSPF, but that can really only be used within one domain. BGP has BGMP, but it's never been seen outside of captivity. Most are not really used, but people are always coming up with new and interesting ideas to make widespread use of multicast a reality. It's such a shame to watch the same video streamed separately from a Web site, when it would save tremendous bandwidth to use multicast and let the router duplicate when it needs to.

In a Nutshell

  • Multicast uses special addresses to send data from a single sender to multiple recipients, even though the recipient only sends one copy.
  • Hosts or routers can join multicast groups via IGMP to tell other routers that they are interested.
  • Dense protocols flood and prune, sparse modes will utilize an RP to avoid flooding unnecessarily.
This article was originally published on Friday Jul 28th 2006