A multicast MAC address is a special type of Ethernet address that lets a single network frame reach multiple devices at once, rather than just one. You can identify any multicast MAC address by checking the least significant bit of the first byte: if that bit is set to 1, the address is multicast. In practice, most multicast MAC addresses you’ll encounter start with 01:00:5E (for IPv4 multicast) or 33:33 (for IPv6 multicast).
How Multicast Differs From Unicast
Every Ethernet MAC address is 48 bits (6 bytes) long. The very first bit transmitted on the wire tells network hardware whether the frame is meant for one device or many. When that bit is 0, the frame is unicast, destined for a single network interface. When it’s 1, the frame is multicast, meaning any device that has joined the relevant group should accept and process it.
Because this multicast indicator lives in the least significant bit of the first byte, any MAC address whose first byte is an odd number is a multicast address. A MAC starting with 01 is multicast. So is one starting with 03, 05, or any other odd hex value in that first byte. A broadcast address (FF:FF:FF:FF:FF:FF) is technically a special case of multicast where every bit is set to 1.
The IPv4 Multicast MAC Range
Internet multicast applications that use IPv4 rely on a specific block of MAC addresses: 01:00:5E:00:00:00 through 01:00:5E:7F:FF:FF. That range is reserved by the IEEE for mapping IPv4 multicast group addresses to the link layer. If you capture traffic from a video stream, routing protocol, or any other IPv4 multicast application, the destination MAC will fall within this range.
The prefix 01:00:5E occupies the first 24 bits. The 25th bit is always 0 (indicating an Internet multicast address specifically). That leaves 23 bits at the end of the MAC address that are variable, giving you the space to encode which multicast group the frame belongs to.
How an IPv4 Address Maps to a MAC Address
The mapping process is straightforward but has an important limitation. An IPv4 multicast address (anything in the 224.0.0.0 to 239.255.255.255 range) has 28 bits that vary. A multicast MAC address only has 23 variable bits. So the system simply takes the last 23 bits of the IP address and places them directly into the last 23 bits of the MAC address, dropping the 5 bits in between.
Here’s a concrete example. Take the multicast IP address 239.5.5.5. In binary, that’s 11101111.00000101.00000101.00000101. You grab the last 23 bits (the portion after the first 9 bits of the last three bytes) and paste them into the MAC template 01:00:5E:0X:XX:XX. The result is 01:00:5E:05:05:05.
The 5 lost bits create an unavoidable overlap: 32 different IPv4 multicast addresses map to the same MAC address. In most networks this rarely causes problems because devices filter at the IP layer after accepting the frame. But it does mean a host might occasionally receive multicast frames it didn’t ask for and has to discard them in software.
IPv6 Multicast Uses a Different Prefix
IPv6 multicast takes a separate approach. Instead of the 01:00:5E prefix, IPv6 multicast MAC addresses use the range 33:33:00:00:00:00 through 33:33:FF:FF:FF:FF, as defined by the IANA. The first two bytes (33:33) are fixed, and the remaining four bytes (32 bits) are filled with the last 32 bits of the IPv6 multicast group address.
This gives IPv6 a larger mapping space than IPv4. With 32 variable bits instead of 23, the chance of two different multicast groups colliding on the same MAC address is much lower.
Why This Matters on Your Network
Network switches use MAC addresses to decide where to send frames. When a switch sees a unicast MAC it recognizes, it forwards the frame out a single port. When it sees a multicast MAC, it needs a different strategy. Without any multicast-aware features enabled, a switch will flood the frame out every port, which wastes bandwidth. Protocols like IGMP snooping let switches learn which ports have devices that actually want specific multicast groups, so they can forward more selectively.
If you’re troubleshooting multicast traffic with a packet capture tool, knowing the MAC prefix tells you immediately what kind of multicast you’re looking at. A destination starting with 01:00:5E points to IPv4 multicast. One starting with 33:33 points to IPv6 multicast. And other multicast MACs outside both ranges (like 01:80:C2, used by spanning tree and other bridge protocols) belong to reserved link-layer control protocols that networking equipment uses internally.
Common Multicast MAC Addresses
- 01:00:5E:00:00:01 maps to 224.0.0.1, the “all hosts” group that every IPv4 multicast-capable device listens to.
- 01:00:5E:00:00:02 maps to 224.0.0.2, used by multicast-capable routers.
- 33:33:00:00:00:01 is the IPv6 equivalent for all link-local nodes.
- 33:33:FF:XX:XX:XX addresses are solicited-node multicast addresses, used heavily in IPv6 neighbor discovery (the IPv6 replacement for ARP).
- 01:80:C2:00:00:00 is used by the spanning tree protocol and is not related to IP multicast at all.
Recognizing these on sight makes reading packet captures and switch MAC tables significantly faster, especially when diagnosing why certain devices are or aren’t receiving multicast traffic.