IPv4 multicast MAC Addresses
The MAC addresses used for IPv4 multicast (IPv4 multicast MAC addresses) have 01:00:5e prefix. IPv4 multicast MAC addresses are used as layer 2 (datalink layer) addresses for multicast type of network traffic. In multicast type of network traffic, a packet sent from a source is replicated as needed in the network to reach only to the end-users interested in that traffic. Users who are not interested in that traffic will not receive the copy of the packet. Multicasting is "one-to-many" type of network communication
I strongly suggest you to visit and learn below lessons before reading further about IPv4 multicast MAC Addresses.
- What is Multicast, What is Broadcast
- Binary Decimal and Hexadecimal numbers and conversions
- Five layered TCP/IP model
- Network Layer (Layer 3)
- TCP/IP Data Encapsulation and Decapsulation
- Datalink Layer (Layer 2)
- Ethernet Frame Format
- What is MAC address or Layer 2 address or physical address
- IPv4 Protocol, IPv4 header and fields of IPv4 header
- IPv4 addresses, IPv4 Address Classes, IPv4 Address Classifications
- What is Subnet Mask
- What is network address
- Limited broadcast address
- Directed broadcast address
- What is limited broadcast in IPv4 and how limited broadcast works
- What is directed broadcast in IPv4 and how directed broadcast works
- Class D multicast IP addresses
The Ethernet MAC Address Range used for IPv4 multicast traffic is from 01:00:5e:00:00:00 to 01:00:5e:7f:ff:ff.
Refer following image, which shows the general structure of a multicast MAC address. As you can see from below image, the right-most bit in the first octet (the least-significant bit in the most-significant octet) of a multicast MAC address has been reserved as binary "1".
Please refer below image. As you can see from below image, left-most 24 bits of an IPv4 multicast MAC addresses are reserved as "01:00:5e". The next bit (25th bit) is reserved as "0". The remaining 23 bits (rightmost 23 bits) of IPv4 multicast MAC addresses are mapped to the rightmost 23 bits of a multicast IPv4 addresses (Class D IPv4 addresses).
From above image, you can see that all IPv4 multicast MAC addresses have a prefix of "01:00:5e". Any MAC address starting with "01:00:5e" is IPv4 multicast MAC address.
We have already learned that IP addresses are used in layer 3 (network layer) of TCP/IP protocol stack. MAC addresses are the addresses used in layer 2 (datalink layer) of TCP/IP protocol stack. In Ethernet LAN environments, as the packet moves down the TCP/IP protocol stack from layer 3 (network layer) to layer 2 (datalink layer) at the sending computer, if the destination IPv4 address is a Class D multicast IPv4 address the IPv4 datagram packet will be encapsulated with an Ethernet frame with IPv4 multicast MAC address (with a prefix of 01:00:5e) as the destination MAC address.
Please refer below wireshark packet caputure screenshot. You can see that when the destination IPv4 address is Class D multicast address, destination MAC address starts with "00:01:5e".
