Special MAC Address Generator

MAC broadcast address: FF:FF:FF:FF:FF:FF

The Ethernet broadcast address is a special MAC with every bit set to 1 — 48 ones, written in hex as FF:FF:FF:FF:FF:FF. When a frame is sent to this address, every device in the same Layer-2 broadcast domain is required to process it. Broadcast is how a host talks to "everyone" before it knows who is on the wire — and it is the engine behind several protocols that the rest of the stack quietly depends on.

Protocols that rely on broadcast

• ARP (Address Resolution Protocol) — "Who has IP X? Tell me." The request is sent to FF:FF:FF:FF:FF:FF; only the owner of X replies (unicast).
• DHCP Discover / Request — a host without an IP cannot send unicast, so it broadcasts to find a DHCP server.
• NetBIOS Name Service — Windows name resolution before DNS, still common in SMB networks.
• WoL (Wake-on-LAN) — the magic packet (FFFFFFFFFFFF followed by the target MAC repeated 16×) is delivered via broadcast.

Broadcast vs multicast vs unicast

Unicast targets one MAC; multicast targets a selected group (any MAC where the least-significant bit of the first byte is 1, e.g. 01:00:5E:xx:xx:xx for IPv4 multicast or 33:33:xx:xx:xx:xx for IPv6); broadcast targets everyone. IPv6 has no broadcast at all — the all-nodes multicast group FF02::1 replaces it, which is more efficient because NICs not subscribed to the group can drop the frame in hardware.

Broadcast domains, storms, and STP

A broadcast domain is the segment of a network where a broadcast frame travels. Switches forward broadcasts to every port in the same VLAN; routers do not forward them, which is why VLANs (and routers between them) are the standard tool to cut a broadcast domain in pieces. A broadcast storm happens when a physical loop without Spanning Tree Protocol (STP, IEEE 802.1D) propagates broadcast frames endlessly — link utilisation hits 100% and the whole segment dies. STP, RSTP and MSTP exist specifically to detect and block redundant paths before this can happen.

L2 broadcast vs L3 broadcast

At Layer 3 there are two flavours of IP broadcast: limited broadcast 255.255.255.255 (does not cross routers, used by DHCP Discover) and directed broadcast like 192.168.1.255 (could cross routers if explicitly enabled — usually disabled because of the historical Smurf amplification attack). Both eventually map to the L2 FF:FF:FF:FF:FF:FF when they hit the local segment.

FAQ

Why can broadcast "blow up" a network? Physical loops without STP cause broadcast storms — a single broadcast frame keeps multiplying around the loop until link utilisation hits 100%. Enable STP/RSTP on every managed switch.

Which everyday protocols still use broadcast? ARP, DHCP, NetBIOS, mDNS (link-local multicast, technically), Wake-on-LAN and many discovery protocols. Even though IPv6 removed broadcast, most networks still rely on IPv4 and therefore on FF:FF:FF:FF:FF:FF.

Why did IPv6 replace broadcast with multicast? Efficiency. With broadcast every NIC interrupts the CPU to inspect the frame; with multicast only subscribed NICs do. Selective filtering is done in hardware via the MAC multicast filter.

Can an attacker abuse broadcast in a switched network? Yes. MAC flooding fills the switch CAM table with bogus addresses until the switch fails open and starts behaving like a hub — broadcasting every frame. Mitigations: port-security (MAC filtering per port), DHCP snooping, dynamic ARP inspection.