Unicast sends to one machine and scales badly when many want the same thing. Broadcast reaches everybody and wastes the time of everybody who does not care.
Multicast is the obvious answer to both, and it is elegant. A sender transmits one copy. Machines that want it join a group. The network duplicates the packet only where the paths to two members diverge, and nowhere else.

Each router copies a packet only when it has members down more than one interface. A link carries at most one copy of the stream, however many members are beyond it.
A machine that has not joined receives nothing at all, which is exactly what separates this from broadcast.

This is arithmetic rather than a benchmark, and the flat line is the whole argument for the protocol.
The difference between multicast and broadcast is not visible on this chart, because it is not about the sender. It is about who else pays.
So multicast gives you the profile of broadcast with the targeting of unicast. It has worked for thirty years. It carries an enormous amount of real traffic today.
And it is essentially absent from the public internet, which is the more interesting half of this lesson.
The whole of 224.0.0.0/4 is multicast, which is one sixteenth of the IPv4 address space set aside for this. A group address does not belong to any device. It names a conversation that devices can join.
Where in that range your group sits changes what happens to your packets.

224.0.0.0/24 is the one worth memorising. Routers must never forward it, whatever the hop limit says, and that is a rule in the router rather than a consequence of .
That is where OSPF, IGMP and mDNS live, because all three are conversations between neighbours on one wire.

Every question in multicast reduces to one: how does each router know whether it has any members down each of its interfaces?

Membership is soft state: it expires unless somebody keeps confirming it.
That is the right design here. If a host crashes it never sends a leave, and hard state would never be cleaned up. Expiring by default means a dead member costs you one query interval and nothing more.

Everything above happens at the IP layer. A network card cannot filter on IP addresses at all, so there is one more step that is rarely taught and produces a genuinely surprising consequence.

The mapping is arithmetic with no lookup: a fixed prefix, then the low 23 bits of the group address. Twenty-eight bits do not fit in twenty-three.
So 32 distinct group addresses arrive at the card as the same hardware address.
Neither the joins nor the arithmetic are theoretical. Both are printable on an ordinary laptop that nobody has configured for multicast.

A protocol this efficient not being used everywhere needs an explanation, and "ISPs found it complex" is only part of it.

The technical requirement is that every router on every path has to cooperate. The business requirement is harder: transit networks carry copies that nobody pays them for.
Without congestion control a multicast stream cannot be a good citizen on a shared link, and a group has no access control, so anybody can inject traffic into somebody else's stream.
Three of those deserve to be seen rather than listed.

Almost every problem above comes from one design decision made in the 1980s: you join a group, and anybody may send to it.

Under any-source multicast the network has to discover who is sending, and that discovery is what rendezvous points and shared trees exist to do. It is most of the complexity in the protocol.
Under source-specific multicast the receiver already names the source, so the tree is built directly to it and unnamed senders are discarded.
If you are designing anything with multicast today, use source-specific. Any-source is the model that made inter-domain multicast intractable, and both the routing complexity and the injection problem disappear the moment the receiver names the sender.

Every approach here replicates in software, at a place that somebody owns and can bill for.
That is the deployability lesson, and it generalises well beyond networking: a protocol that asks independent parties to cooperate for somebody else's benefit is very hard to ship.
The concept survived even though the protocol did not. Send once, deliver to interested parties, is exactly what a message broker's topic is, what a WebRTC forwarding unit does, and what a edge does for a live stream. All of it in software, none of it in routers.

The previous lesson covered IPv6 removing broadcast entirely. The other half of that decision is that multicast stopped being optional.

There is no broadcast address to fall back on, so the basics of joining a network run on groups.
The solicited-node group is the clever one. Because it is derived from the target's own address, an address lookup disturbs roughly one machine instead of all of them.
That is a design pattern worth taking away. Broadcast asks everybody a question meant for one machine. Deriving a narrow group from the question itself gets the same reach at almost none of the cost, and it needed no new mechanism because multicast already existed.

Ownership of the path is the gate, and everything else is detail.
If loss is unacceptable you need a repair mechanism, and that is real engineering rather than a configuration flag.
In an interview, the second box is the answer worth giving. "Multicast, if this is all inside our own network, otherwise a or a fan-out service" shows that you know why the technically better option is usually unavailable, which is a more useful thing to know than the protocol itself.
One last piece of pedantry that is worth being pedantic about. People say "we multicast the events to all the consumers" when they mean a broker delivers a topic to several subscribers. That is application-level fan-out over unicast connections. It is a fine design and it is not multicast, and confusing the two leads to expecting properties you are not going to get.
6 questions - Score 80% to pass
A server streams live video to 5,000 viewers on a corporate network. Which uses the least server bandwidth?
Your multicast video stream is working, but the network team reports that it is reaching every port on one particular switch, including machines that never joined. What is the most likely cause?
Why do 32 different multicast group addresses arrive at a network card as the same hardware address?
Why is multicast essentially absent from the public internet?
You are designing a market data feed inside a data centre you own. Which model should you choose and why?
A colleague says 'Kafka multicasts events to all the consumers in the group.' What is wrong with that sentence?
This is genuinely different from unicast, where any address can in principle be reached from anywhere and the boundaries are policy. Here the scope is carried in the address itself.
Putting a neighbour-to-neighbour protocol in a range that physically cannot leave the wire is stronger than any firewall rule.
If you are choosing a group address for something inside your own network, use 239.0.0.0/8. Picking something in the globally assigned range because it looked unused is the multicast equivalent of squatting on somebody else's public IP block.
A switch works on hardware addresses and has no concept of a group. A multicast frame's destination MAC is not one it has ever learned a port for, so the default behaviour for an unknown destination applies: flood it everywhere.
Snooping means the switch reads the join and leave messages passing through it and builds its own table.
This is the single commonest reason a multicast deployment behaves like broadcast and nobody can work out why. The routing is right, the joins are right, and one switch in the middle has snooping turned off and is flooding a video stream to every port on it.

PIM stands for protocol-independent multicast, and the name is the explanation: it does not compute routes of its own. It looks the source up in the ordinary unicast table and sends its join in that direction.
The tree is therefore built branch by branch from every leaf, and pruned the same way.

Reverse path forwarding is the entire loop-prevention mechanism and it is one lookup. A multicast packet can arrive from more than one direction, and the router discards it unless it came in on the interface it would use to reach that source.
That single check makes a forwarding loop structurally impossible.
It also means multicast depends on the unicast routing being symmetric enough. On a path where the route to the source differs from the route the traffic takes, RPF discards perfectly good packets, and that is one of the classic reasons a deployment fails mysteriously.
Nobody configured this. The operating system's discovery services joined those groups on their own, which is worth knowing before you conclude that multicast is something other people run.
The last block is the collision, and it is measurable rather than theoretical: the card accepts traffic for all four of those groups, and the kernel discards the three you never joined, in software, on every packet.
Choosing group addresses that differ only in those five discarded bits is therefore a real way to make a host slower for no benefit.
A unicast forwarding entry covers a whole block of addresses and is shared by everybody using it. A multicast entry exists for one group and disappears when the last member leaves.
So the table's size tracks how many streams are running, not how big the internet is.
That is fine on a network where you know how many streams there are and impossible on one where you do not. A transit provider cannot bound the state, cannot predict it, and gains nothing from carrying it.

works because there are exactly two ends. Multicast has one sender and an unknown number of receivers, and every reliability mechanism you might add breaks something.
Acknowledge everything and the sender drowns. Retransmit to the group and everybody pays for one member's loss. Retransmit by unicast and the fan-out you were avoiding has returned.

TCP reads loss as congestion, halves its rate and climbs again. That sawtooth is what lets many flows share a link without any of them collapsing.
A multicast stream has no feedback loop, so it cannot know the link is full. It keeps sending at its configured rate and the TCP flows around it back off instead.
So an uncontrolled multicast stream does not merely fail to share, it takes from every well-behaved flow beside it. That is why carriers admit multicast only onto capacity they have planned for, and a large part of why nobody wants it arriving from outside.
Read the middle column of every row and the pattern is identical: one organisation controls every router on the path.
The common property is ownership rather than scale. Inside that boundary multicast is excellent and it is not going anywhere.

The two rows marked "not" are deliberate. Assuming a system uses multicast because it delivers to many consumers is a common and occasionally expensive mistake.
Multicast means the network duplicates the packet. If a server is looping over a list of recipients, that is fan-out, it is unicast, and it has none of multicast's properties or problems.