Mutlicast
Address range : 224.0.0.0 to 239.255.255.255
Link-Local Multicast Addresses
IANA has reserved the range of 224.0.0.0 through 224.0.0.255 for use by network
protocols on a local network segment. Packets with an address in this range are local in
scope, are not forwarded by IP routers (regardless of their time-to-live [TTL] values),
Address Usage Reference
224.0.0.1 All Hosts
224.0.0.2 All Multicast Routers
224.0.0.3 Unassigned
224.0.0.4 DVMRP Routers
224.0.0.5 OSPF Routers
224.0.0.6 OSPF Designated Routers
224.0.0.7 ST Routers
224.0.0.8 ST Hosts
224.0.0.9 RIP2 Routers
224.0.0.10 IGRP Routers
224.0.0.11 Mobile-Agents
224.0.0.12 DHCP Server/Relay Agent
224.0.0.13 All PIM Routers
224.0.0.14 RSVP-Encapsulation
224.0.0.15 All CBT Routers
224.0.0.16 Designated-SBM
224.0.0.17 All SBMS
224.0.0.18 VRRP
Permanent multicast groups, in the range 224.0.0.0–224.0.1.255
Addresses used with Source-Specific Multicast (SSM), in the range 232.0.0.0–
232.255.255.255
GLOP addressing, in the range 233.0.0.0–233.255.255.255
Private multicast addresses, in the range 239.0.0.0–239.255.255.255
Mac layer uses the first bit of the first octet in the destination field to show that it is a
multicast/broadcast message.
Ethernet Multicast MAC Address Mapping
The ip multicast address needs to be mapped into the MAC address so hosts can tell at
layer 2 if this is a multicast frame.
IP multicast frames all use MAC layer addresses beginning with the 24-bit prefix
of 0x0100.5Exx.xxxx
This leaves 23 bits to fit in the 32 bit ip address, because all multicast address have the
same first 4 bits (224 11110000) its now down to 28bits.
For this to work the 5 most significant bits are dropped off, this means the one multicast
mac frame addresses 32 ( 224-239.1.2.1) multicast ip addresses.
Multicast Addresses for Source-Specific Multicast Applications and Protocols
IANA has allocated the range 232.0.0.0 through 232.255.255.255 for SSM applications
and protocols. The purpose of these applications is to allow a host to select a source for
the multicast group. SSM makes multicast routing efficient, allows a host to select a
better-quality source, and helps network administrators minimize multicast denial-ofservice (DoS) attacks. SSM requires IGMP V3
Multicast Addresses for GLOP Addressing
reserved the range 233.0.0.0 through 233.255.255.255 and can be used by anyone who
has a ASN.
By using a value of 233 for the first octet, and by using the ASN for the second and third
octets, a single autonomous system can create globally unique multicast addresses as
defined in the GLOP addressing
Multicast Addresses for Transient Groups
These a multicast addresses that are globally routable but are dynamic assigned to
applications that need them at the time. Transient Group make up all other Multicast
addresses that aren’t defined above.
Multicast Distribution Trees
The tree is the path that traffic must flow form the source to reach all destinations without
flooding the entire network/internetworks. there are two types, source tree and shared
tree.
Source tree,
Also known as shortest path tree (SPT)
Built from the source takes shortest path to destinations.
separate SPT exists for every individual source sending to each group
Notation for a source tree is 192.1.1.1, 224.1.1.1 where 192.1.1.1 is the source host and
224.1.1.1 is the destination multicast group.
Shared Tree.
shared trees use a single common root placed at some chosen point in the network
(rendezvous point (RP). The router builds a a path to all multicast server/clients. This
allows for multiple sources to send to one group. Notation is ( * , 224.1.1.1)
two types of shared tree’s bidirectional, unidirectional
bidirectional traffic can flow in both directions up and down the tree
unidirectional, traffic cant flow backup towards the root. Must use something else (
unicast etc)
Reverse Path Forwarding
For traffic flowing down a source tree, the RPF check mechanism works as follows:
1. The router examines the source address of the arriving multicast packet to determine
whether the packet arrived via an interface that is on the reverse path back to the source.
2. If the packet arrives on the interface leading back to the source, the RPF check is
successful and the packet is forwarded.
3. If the RPF check fails, the packet is discarded.
How a multicast router determines which interface is on the reverse path back to the
source depends on the routing protocol in use
Multicast Forwarding Cache
Is used to build a cache for the RPF and also SPT (shortest path tree) it I used to reduce
work load on the router cpu. If the routing protocol that the cache is using changes then
the cache must be recalculated.
TTL Thresholds
Can be used to control if packets get forwarded out an interface based on the value in the
TTL field.
TTL thresholds provide a simple method to prevent the forwarding of multicast traffic
beyond the boundary of a site.
Administratively Scoped Boundaries
Define a range of multicast destination addresses that aren’t allowed to be forward by a
router. If it sees one then it doesn’t allow traffic to the “outside” interface.
Dense Mode Protocols
deliver (S, G) multicast traffic using a push principle.
The push principle assumes that every subnet in the network has at least one receiver of
the (S, G) multicast traffic.
Flood and Prune Behavior
routers send Prune messages back up the source distribution tree to shut off unwanted
multicast traffic. The result is that branches without receivers are pruned off the
distribution tree, leaving only branches that contain receivers.
Prunes have a timeout value associated with them such that, when they time out, they
cause the router to put the interface back into forward state and to start flooding multicast
traffic out this interface again.
Rejoining a pruned link is called grafting.
Sparse Mode Protocols
sparse mode protocols make use of a pull model in which multicast traffic is pulled down
to the receivers in the network.
Shared Tree Join Messages
To pull the multicast traffic down to a receiver in a sparse mode network, a shared tree
branch must be constructed from the root node (the RP) to the receiver.
This Join Multicast Basics message travels router by router toward the root, constructing
a branch of the shared tree as it goes.
SPT Join messages may also be sent in the direction of the source to construct an SPT
from an individual multicast source to receivers in the network. SPTs allow routers that
have directly connected receivers to cut through the network and bypass the root node so
that multicast traffic from a source can be received via a more direct path.
if the branches of distribution trees in a sparse mode network (either shared
trees or SPTs) are not refreshed, they will time out and be deleted.
Prune Messages
Prune messages are sent up the distribution tree when multicast group traffic is no long
desired. This action permits branches of the shared tree or SPT that were created via
explicit Joins messages to be torn down when they are no longer needed.
Internet Group Management Protocol
IGMPv1, was defined in RFC 1112
IGMPv2, was ratified in November 1997, RFC 2236
IGMP messages are used primarily by multicast hosts to signal their local multicast
router when they wish to join a specific multicast group.
Hosts may also (with IGMPv2) signal to the local multicast router that they wish to leave
an IP multicast group.
Using the information obtained via IGMP, routers maintain a list of multicast group
memberships on a per interface basis.
IGMP V1
IGMP messages are transmitted inside IP datagrams and denoted by an IP protocol
number of 2.
IGMP messages are transmitted with the IP (TTL) field set to 1
Type Field
Membership Query
Membership Report
Group Address Field
The Group Address field contains the multicast group address when a Membership
Report is being sent. This field is zero when used in the Membership Query and should
be ignored by hosts.
The IGMPv1 Query-Response Process ( enrollment)
1. Router A sends a multicast on 224.0.0.1 ( all hosts) every 60 seconds, this packet
is a Membership query.
2. the hosts interest in a multicast group return a membership report which states
which multicast groups they are interested in.
3. if any other host want to listen to the same multicast stream they wont send a
membership report(suppression) to reduce traffic on the lan ( see host1 above).
Because of the Report Suppression mechanism, routers cannot keep track of the
individual hosts joined to a multicast group on a subnet. Therefore, they only keep track
of the multicast groups that are active on a subnet.
The IGMPv1 Join Process
A host doesn’t have to wait for the membership query to join a group, it can send a
membership report straight away. membership query only need to be send to receive
multicast not send.
Report Suppression Mechanism
When a host get a membership query it waits a random amount of time ( max being
maximum response interval default 10 secs) before sending the membership report. If it
hasn’t seen a query with that timer for a multicast stream its interested in it sends the
membership report.
If multiple multicast routers are on a subnet, having more than one of them send IGMPv1
Queries is a waste of bandwidth. IGMPv1 relies on the Layer 3 IP Multicast Routing
protocol (PIM, DVMRP) to resolve this conflict by electing a Designated Router for the
subnet.
RFC 1112 assumed that this Designated Router would also perform the tasks of sending
IGMP Query messages.
The IGMPv1 Leave Process
There is no leave process, traffic is stopped forwarding if a 3 Membership queries aren’t
replied to in a row for a multicast address.
IGMP Version 2
The Query and Membership Report messages in IGMPv2 are identical to the IGMPv1
except:
General Queries, which perform the same function as the IGMPv1 Queries
Group-Specific Queries, which are queries directed to a single group
IGMPv1 & IGMPv2 Membership Reports have different IGMP Type codes
IGMPv2 Message Format
Type and version field have been merged
The IGMPv2 Type code for a version 1 Membership Report was carefully chosen to
provide compatibility between IGMPv1 and IGMPv2.
Type Field
Membership Query (Type code = 0x11 0001001)
General Query Used to determine which multicast groups are active in the same
as IGMPv1 does. A General Query is denoted by an all-zeros Group Address
field.
Group-Specific Query Used to determine whether a specific multicast group has
any remaining members. A Group-Specific Query contains the address of the
group being queried.
Version 1 Membership Report (Type code = 0x12 0001010)
Version 2 Membership Report (Type code = 0x16 00010110)
Leave Group (Type code = 0x17 00010111)
Maximum Response Time Field
This field was unused in IGMPv1. The Maximum Response field is used in Membership
Query and specifies the maximum time in units of 1/10 sec that a random response time
is. default is 100 (10 seconds).
Hosts use the Maximum Response Time value in this field as the upper limit for setting
of their group report-timers, which are used by the Report Suppression .
IGMPv2 Leave Group Messages
RFC says, "When a host leaves a multicast group, if it was the last host to respond to a
query with a Internet Group Management Protocol Membership Report for that group, it
should send a Leave Group message to the all-routers multicast group (224.0.0.2)."
It also says "a host may always send a Leave Group message when it leaves a group."
If a host doesn’t always send a leave group message when it leaves things like IGMP
snooping breakdown and stop working.
IGMPv2 Group-Specific Query Messages
In a Group-Specific Query, the Group Address field contains the target group being
queried. IGMPv2 hosts that receive this message respond in the same manner as they do
to a General Query. the Maximum Response Time. The default is 1 second (10 units)
For host 2 to leave:
Host H2 multicasts an IGMPv2 Leave Group message to the All-Routers (224.0.0.2)
multicast group to inform all routers on the subnet that it is leaving the group.
Router A sends a Group-Specific Query to determine whether any hosts remain for group
224.1.1.1 ( respond timer set to 10 ( 1 second) ( 3 intervals need to pass without hearing a
membership report to kill the flow)
Host H3 is still a member of group 224.1.1.1 and, therefore, hears the Group-Specific
Query and responds to the query with an IGMPv2 Membership Report
Querier Election Process
1. When IGMPv2 routers start, they each multicast an IGMPv2 General Query message
to (224.0.0.1) with their interface address in the Source IP Address field.
2. When an IGMPv2 router receives a General Query message, the router compares the
source IP address in the message with its own interface address. The router with the
lowest IP address on the subnet is elected the IGMP Querier.
3. All non-querier routers start a querier timer that is reset whenever a General Query
message is received from the IGMP Querier. The default duration of this timer is two
times the Query Interval, or 250 seconds. If the querier timer expires, it is assumed that
the IGMP Querier has gone down, and the election process is run again to elect a new
IGMP Querier.
IGMPv1---IGMPv2 Interoperability
V2 Host/V1 Routers Interoperability
V1 routers see a V2 membership report as invalid and ignore it. SO a ver 2 host send ver
1 reports when there is a V1 router in operation. Hosts can tell the difference by
examining the Maximium response time filed in the Membership query. If its zeroed then
it’s a V1 router if it has a value set it is V2.
V2 host will set a timer ( to 400 seconds) if it hears a ver 1 query the timer resets to 400.
if the timer expires then the host starts sending V2 membership reports again.
V1 Host / V2 Routers
V1 hosts see a V2 Query as Valid, and send membership reports. V1 hosts don’t
understand V2 membership reports so they will send a response to a query as well.
While there is a V1 host in the group leave messages must be ignored because V1 hosts
don’t understand V2 membership reports (leave request) and wont respond.
IGMP Snooping
When the switch hears an IGMP Report from a host for a particular multicast group, the
switch adds the host's port number to the associated multicast CAM table entry. When the
switch hears an IGMP Leave Group message from a host, it removes the host's port from
the CAM table entry.
Works on the layer 2 multicast address. If it sees a membership report it adds the
multicast MAC address(upto 32 layer 3 multicast addresses) to the CAM table and maps
to the interfaces that the traffic should be sent out on.
If IGMP snooping isn’t done in hardware then performance is degraded as all multicast
frames would have to be inspected by the switch CPU.
With layer 3 awareness in the ASIC/CAM table. The following is done.
All mac multicasts that are IGMP for 0100.5exx.xxxx are sent to the CPU.
All mac multicast that are not IGMP that match 0100.5e01.02.03 (224-239.01.02.03) are
sent out interfaces 1 2 and 5. all IGMP packets that match 0100.5e01.02.03 are sent to the
CPU.
Leave request
The CPU in the switch responds to the Leave Group message by sending an IGMP
General Query back out the port to see whether there are any other hosts that are
members of this group on the port.
If another IGMP Report is received from a host connected to Port 2, then the CPU quietly
discards the original Leave Group message from the Host. A switch will only forward a
leave request to the router if there are no host on the switch in question interested in the
flow.
Switches don’t forward host membership reports out all interfaces ( this over rides the
report suppression ) So all hosts send membership reports. This way a switch can tell if a
host that doesn’t send a leave request has left the multicast group ( 3 query intervals
without hearing a membership report). The switch still has to forward a membership
report to the router to stop it from removing the port.
IGMP Snooping and Send-Only Sources
switches have very little they can do to constrain send only sources because they don’t
require any IGMP to start sending to a destination multicast address.
Detecting Routers with IGMP Snooping
IGMP Snooping switch detect routers based off packets such as OSPF PIMv1 and PIMv2
Hellos, DVMRP Probes, IGMP Queries, CGMP self-joins, and Hot Standby Router
Protocol (HSRP) messages that are sent by routers periodically.
Cisco Group Management Protocol
CGMP messages are composed of a type code field followed by a list of Group
Destination Address (GDA) and Unicast Source Address (USA) tuples that each identify
a host and the group that the host just joined or left.
All CGMP messages are MAC layer multicast to the well-known CGMP multicast MAC
address 0x0100.0cdd.dddd.
CGMP works by the router creating a CGMP join message based off IGMP join request
reports and send it back to the switch.
Router-Port Group Management Protocol
RGMP is a Layer 2 protocol that enables a router to communicate to a switch which
multicast group traffic the router does and does not want to receive from the switch.
RGMP was designed to help routers reduce overhead when they are attached to highspeed LAN backbones.
When RGMP is enabled on a router or a switch, CGMP is silently disabled; if CGMP is
enabled on a router or a switch, RGMP is silently disabled.
IGMP snooping helps switches control distribution of multicast traffic on ports where
multicast hosts are connected, but it does not help switches control distribution of
multicast traffic on ports where multicast routers are connected.
When RGMP is enabled on a router, the router sends RGMP Hello messages by default
every 30 seconds. When the switch receives an RGMP Hello message, it stops
forwarding all multicast traffic on the port on which it received the Hello message.
When the router wants to receive traffic for a specific multicast group, the router sends an
RGMP Join G message, where G is the multicast group address, to the switch. When the
switch receives an RGMP Join message, it starts forwarding the requested group traffic
on the port on which it received the Hello message.
When the router does not want to receive traffic for a formerly RGMP-joined specific
multicast group, the router sends an RGMP Leave G message, where G is the multicast
group address, to the switch. When the switch receives an RGMP Leave message, it stops
forwarding the group traffic on the port on which it received the Hello message.
When RGMP is disabled on the router, the router sends an RGMP Bye message to the
switch. When the switch receives an RGMP Bye message, it starts forwarding all IP
multicast traffic on the port on which it received the Hello message.