Unicast

Unicast is one-to-one delivery: a packet carries a single destination address and is meant for one interface. Loading a web page or opening an SSH session is unicast. Both IPv4 and IPv6 use it, and at layer 2 the destination is a single MAC address. It is one of four delivery methods named in the ISC2 exam outline: broadcast sends to every host in a broadcast domain (IPv6 has no broadcast), multicast sends to the hosts that have joined a group, and anycast sends to the nearest of several hosts that share one address.

Unicast has a security consequence on switched networks. A network switch learns which port leads to each MAC address and sends a unicast frame out of that port only, so other hosts do not see it, which limits packet sniffing. A hub repeats every frame to every port, and a switch floods frames for addresses it has not yet learned. That is why MAC flooding, which fills the switch’s address table, can force unicast traffic onto every port, where an attacker can capture it.

Exam relevance: questions in this area tend to describe a delivery pattern and ask for its name. Candidates are expected to tell the four methods apart by how many receivers a single packet is meant to reach.