Traffic Analysis of IGMPv2

Instead of simple Membership Report and Membership Query process of IGMPv1, there are some added new features in IGMPv2. Please go through the Traffic Analysis of IGMPv1 before reading this if you want to know how IGMPv1 worked originally.

Leave Group Messages: When a host stops listening to a multicast feed it reports the router that it is leaving the group. (report suppressed hosts will not send this, you will see it later..)

Group Specific Membership Query: When the router receives a leave group message, it will use a special query to that specific group address to check if there are still any hosts interested in receiving the multicast traffic.

MRT (Maximum Response Time) Field: This is a new field in query messages to specify how much time hosts have to respond to the query.

Querier Election Process: When there are two or more routers in the same subnet then only one of them should send query messages. The election ensures only one router becomes the Active Querier. The router with the lowest IP address wins the election.

To deliver the above features, IGMPv2 has 4 types of packets.

1. Membership Report
2. Membership Query
3. Leave Group Messages
4. Group Specific Membership Query

Here the hosts are also Cisco IOS routers.

Nothing is configured on the switch.

Hosts 1 & 2 will be configured in the same multicast group.

Packets entering and leaving on e0/0 interface of Router-1 will be captured..

debug ip igmp is entered on all devices..

(click on images to view in full size)

Configuration on the Routers..

Router-1(config)#ip multicast-routing

Router-1(config)#int e0/0
Router-1(config-if)#ip pim sparse-mode

1st command will enable the multicast routing globally. It is enabled by default on most routers.
Next a multicast routing protocol is specified for the interface to process the multicast packets. Default version is 2 for IGMP so don't want to specify the version here.

As soon as the interface command entered on Router-1, following debug messages will opt out..

224.0.1.40 group is not related to this lab, it is coming by default. This address is for Cisco RP discovery.

And the multicast routing table will be like the following on R1, show ip mroute

So even without any host in a multicast group, it will show an entry for the 224.0.1.40 making itself a host and processing IGMP packets.

Now let's configure Router-2 with the same commands..

As soon as the interface command entered on Router-2, following debug messages will opt out..

Also on Router-1, following debug output will be shown..

What happens when IGMP hellos are seen by routers is that they chose one querier as the Active Querier for that subnet. For the subnet of 192.168.10.0/24, Router-1 has elected as the querying router because it has the lowest IP.
We can verify that by entering the command, show ip igmp interface

Let's see what is showing on Router-1;

Ok now, you can see that both the routers have agreed that IGMP Querying Router to be 192.168.10.253. The other underlined information will be useful later in this post..

Configuration on Hosts..

Host-1(config)#int e0/0
Host-1(config-if)#ip igmp join-group 226.139.1.2

As soon as the above command entered on Host-1; debug output will give the following..

It is sending 2 reports at the same time.

On Router-1, the debug output will show the following..

Router-1 is taking the new multicast group in to the account..

Router-2, also do the same.. Because the Active Querier is Router-1, from now on we will analyze the behavior of Router-1..

Now the multicast routing table on Router-1 will be like the following with the new group entry..

Now let's see what happens when we configure another host.. I am configuring Host-2 with the same command..

Following output for the debug will be shown on Host-2..

It is also sending 2 reports. On Host-1, following will be the output after receiving the reports.

It looks like Host-1 is doing nothing about it.

On Router-1, following will be the output..

After receiving the new report from the new member, router is updating the exclude timer.. Both the routers will do the same..

Now what happens is that, Router-1 sends a query sequentially (default 1 min) and it sends it with a MRT (Maximum Response Time) which defaults to 10 seconds.

After Hosts see this, they take a random time which is lower than the maxim time given by the router, and sends a report after their chosen time is over. So the Host with the lowest time randomly chosen will be able to send the report 1st. When other hosts also receive the report, they stop sending their report because it is not necessary.

Following was the Host-1's debug when it set's it's time to respond and sends the report. You will notice it is 1.9 seconds and the Host-2 had 4.0 seconds which is larger.

But the Membership Report must send as the reply to the Membership Query of the Router ryt? So how come the other members receive it?

If you analyze a Membership Report packet you will see the destination address is not the router's IP, it is the multicast address of the group. (which also means that the router is listening to all the multicast mac addresses)

Let's see what happens when a Host leaves the group..

It will just delete the group and will not send a leave message as expected. Why??

Because this Host-2 is has suppressed sending reports. Last member to report for this group was Host-1. So leaving of all other hosts doesn't matter..

Now let's remove Host-1 from the group..

Now it is sending a leave message. Let's see what Router-1 will do about it..

After Router-1 sees this it sends the last type of packet, Group Specific Membership Query. This is sent to the 226.139.1.2 group specifically to ask whether there are any other members which needs the feed. If no report comes, the group will be excluded after 3 minutes which is the default IGMP Queryier timeout.

For the record, I will show some show command outputs of the switch while the multicast forwarding is working..

As you can see, the multicast mac addresses are not showing in the mac address table. So IGMP snooping will be the only way the switch knows where to forward the traffic..