Multicast with PIM and IGMP

Configure PIM Sparse-Mode and IGMP Snooping

Alt text

General

Multicast is used when you want to reach a specific group of hosts.

PIM is used to route multicast traffic through the network while IGMP is used to add or remove Hosts to multicast groups.

PIM

stands for Protocol Independant Multicast.

As the name says it is a protocol to route multicast traffic through your network by leveraging the routing protocol that is already configured on the network.


There are two PIM modes:

  • Sparse-Mode = A host has to send a join request to get multicast traffic.
  • Dense-Mode = A host has to send a prune request to NOT get multicast traffic.

There are two network topologies available:

  • Shared Tree = All multicast traffic has to go to the RP.
  • Source Tree = Uses shortest path to the destination. No RP is needed.

In this blog article we will focus on the most famous combination: PIM sparse-mode with shared tree.

Rendevouz Point

A Router used in shared tree topology where the Sender (Source) and Receiver (Host) meet.

We will statically define the RP but you can also use other methods like Phantom-RP that I used in my VXLAN BGP evpn article.

IGMP

stands for Internet Group Management Protocol.

Right now we know that PIM is used to route multicast traffic through the network but what happens when the multicast packet hits our switched Network (SW1). Since Switches flood BUM (Broadcast, Unknown Unicast, Multicast) traffic by default, a multicast packet would be pointless when it reaches the Switch.


With IGMP we can add hosts to Multicast groups and with IGMP snooping we can prevent the flooding of multicast packets by allowing the switch to listen for igmp packets and then forward multicast packets only out of interfaces where there are subscribers to the multicast group. IGMP is enabled by default and the current default version is IGMPv2.

IGMPv3

introduces a new function where you can specify the multicast group and the source (S,G). In IGMPv2 you have a multicast address but you dont define a source so the S is a wildcard mask for any source (*,G).


Example to activate IGMPv3

int g0/0
ip igmp version 3
 ip igmp join-group 239.1.1.1 source 10.1.1.1

In this article we will use IGMPv2.

Packets

there are several multicast packets. Here are the three most important ones:

  • IGMP Query = send to 224.0.0.1 by Querier (R1) to all hosts to check which mulitcast-groups exist and their associated hosts so multicast packets coming from PIM know which host they wants to reach.
  • IGMP Join report = send to 224.0.0.2 (in IGMPv3 to 224.0.0.22) that host want to join a group/channel.
  • IGMP Leave report = send to 224.0.0.2 that host want to leave a group/channel.

Multicast addresses

Multicast uses class D IP addresses: 224.0.0.0 to 239.255.255.255

224.0.0.0 to 224.0.0.255 are reserved for use by routing protocols.


  • 224.0.0.0/24 – Local Multicast Subnet / Control Block
  • 224.0.0.1 – All hosts on local subnet
  • 224.0.0.2 – All Multicast Routers
  • 224.0.0.4 – DMVRP (Distance-Vector Multicast Routing Protocol) Routers
  • 224.0.0.5 – All OSPF Routers
  • 224.0.0.6 – All OSPF Dr Routers
  • 224.0.0.9 – All RIPv2 Routers
  • 224.0.0.10 – All EIGRP Routers
  • 224.0.0.13 – All PIM Routers
  • 224.0.0.22 – IGMPv3 enabled Routers
  • 224.0.1.0/24 – Internetwork Control Block
  • 224.0.1.39 – Rendezvous Point (RP) Announce
  • 224.0.1.40 – Rendezvous Point (RP) Discover
  • 224.0.2.0/24 – Ad Hoc Multicast Block
  • 239.0.0.0/8 – Admin Scoped Address Space
  • 239.192.0.0 – 239.251.255.255 – Org-Local Scope
  • 239.252.0.0 – 239.254.255.255 – Site-Local Scope

Configure PIM and IGMP

We will configure now Pim Sparse-Mode with a static Rendevouz-Point and IGMP Snooping. The Linux server in the topology is just for tcpdump.

Alt text

First we will configure the Routers with OSPF as IGP protocol and PIM sparse-mode as multicast.


R1

ip multicast-routing #enable multicast.
ip pim rp-address 22.22.22.22 #we will configure lo0 on R2 as RP.

router ospf 1
router-id 1.1.1.1
network 10.0.0.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0

int g0/0
ip add 192.168.1.254 255.255.255.0
ip ospf network point-to-point
ip pim sparse-mode
no shut
int g0/1
ip add 10.0.0.1 255.255.255.252
ip ospf network point-to-point
ip pim sparse-mode
no shut

R2

ip multicast-routing
ip pim rp-address 22.22.22.22

router ospf 1
router-id 2.2.2.2
network 10.0.0.0 0.0.0.3 area 0
network 10.0.1.0 0.0.0.3 area 0
network 22.22.22.22 0.0.0.0 area 0

int l0
ip add 22.22.22.22 255.255.255.255
ip pim sparse-mode

int g0/0
ip add 10.0.0.2 255.255.255.252
ip ospf network point-to-point
ip pim sparse-mode
no shut

int g0/1
ip add 10.0.1.2 255.255.255.252
ip ospf network point-to-point
ip pim sparse-mode
no shut

R3

ip multicast-routing
ip pim rp-address 22.22.22.22

router ospf 1
router-id 3.3.3.3
network 10.0.1.1 0.0.0.3 area 0

int g0/0
ip add 10.0.1.1 255.255.255.0
ip ospf network point-to-point
ip pim sparse-mode
no shut

Now we configure the hosts that will join the multicast group 239.1.1.1. We will use a router to simulate the host.


Host1

int g0/0
mac-address 0000.0c11.1111 #manual mac on the interface for troubleshooting purposes.
ip add 192.168.1.1 255.255.255.0
ip igmp join-group 239.1.1.1
no shut

Host2

int g0/0
mac-address 0000.0c22.2222
ip add 192.168.1.2 255.255.255.0
ip igmp join-group 239.1.1.1
no shut

The Switch will act as layer2 switch so no configuration is needed except the SPAN config so I can mirror the traffic for tcpdump. IGMPv2 is enabled by default.

SW1

monitor session 1 source int g0/2
monitor session 1 destination int g0/3

show monitor session 1

Linux

sudo tcpdump -v -i eth0 icmp

Now if we issue a ping from the Source R3 to the multicast address 239.1.1.1 we will get the following output.

R3#ping 239.1.1.1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 239.1.1.1, timeout is 2 seconds:

Reply to request 0 from 192.168.1.1, 77 ms
Reply to request 0 from 192.168.1.2, 77 ms

Both Hosts replied and in the tcpdump on linux the icmp traffic appears.

Debug Commands

IGMP debug commands are very much the same on a router and a switch. On the switch you just add the word snooping after igmp.

show ip pim neighbors
ping 192.168.1.255 #ping broadcast IP from host to check all active members in broadcast domain.
show ip multicast #check if multicast is enabled.
show ip igmp snooping #check if igmp is enabled and which version runs.
debug ip igmp snooping router #on SW to see packets from the querier.
show ip igmp snooping querier #shows the querier for igmp
show ip igmp snooping groups #multicast groups on switch.
show ip igmp groups detail #multicast groups on router.
show ip traffic #shows hit counters for all protocols
show ip igmp interface gigabitEthernet 0/0 #shows dr/querier
show ip pim rp mapping #check which multicast grps are connected with the RP.
mtrace 192.168.0.2 #check path for multicast
show ip mroute 239.1.1.1
show ip mroute count #check if traffic is there for your multicast group.

Here are two videos that helped me understand multicast:

Multicast, PIM-SM, and IGMP Snooping

IGMP Snooping Configuration


Thanks for reading my article. If you have any questions or recommendations you can message me via arvednetblog@gmail.com.