13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping

13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 3.3.d (describe multicast protocols such as RPF check, PIM SM, IGMP v2/v3, SSM, bidir, and MSDP) requires candidates to configure and verify IP multicast operations, including IPv4 multicast addressing, Layer 2 MAC address mapping calculations, Internet Group Management Protocol (IGMP) versions 1, 2, and 3, IGMP Snooping, and IGMP Querier functionality.

In traditional IP networking, data transmission follows one of three fundamental communication paradigms:

1. Unicast (One-to-One): A single source transmits separate, individual streams to each destination host. Transmitting a 10 Mbps video stream to 1,000 users requires 10 Gbps of outbound bandwidth from the server and saturates upstream WAN links with duplicate packets.
2. Broadcast (One-to-All): A single source transmits a single packet to every host on the Layer 2/3 broadcast domain (255.255.255.255). Every host must interrupt its CPU to process the packet, creating massive processing overhead for uninterested receivers.
3. Multicast (One-to-Many / Many-to-Many): A single source transmits a single data stream addressed to a logical group address. Routers replicate packets only at network branching points where downstream receivers have explicitly requested the stream, maximizing bandwidth efficiency and offloading server compute.

+-----------------------------------------------------------------------------------+
|              UNICAST VS. MULTICAST BANDWIDTH REPLICATION MODEL                    |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  UNICAST (1:1) - 3 Streams (3 x 10 Mbps = 30 Mbps on Server Link)                 |
|  [Source] ===== 30 Mbps =====> [Router 1] ===== 20 Mbps =====> [Router 2]         |
|                                     |                               /    \        |
|                                  10 Mbps                         10 Mbps 10 Mbps  |
|                                     v                               v      v      |
|                                 [Host A]                        [Host B] [Host C] |
|                                                                                   |
|  MULTICAST (1:N) - 1 Stream (10 Mbps everywhere until branching points)           |
|  [Source] ===== 10 Mbps =====> [Router 1] ===== 10 Mbps =====> [Router 2]         |
|                                     |                               /    \        |
|                                  10 Mbps                         10 Mbps 10 Mbps  |
|                                     v                               v      v      |
|                                 [Host A]                        [Host B] [Host C] |
+-----------------------------------------------------------------------------------+

1. IPv4 Multicast Addressing Architecture (Class D)

IPv4 addresses are divided into classes based on the high-order bits of the first octet. Class D is exclusively reserved for IP multicast, designated by the prefix 224.0.0.0/4.

In binary notation, every Class D multicast address begins with the fixed 4-bit prefix 1110:

$\text{Binary: } \mathbf{1110}0000.00000000.00000000.00000000 \text{ to } \mathbf{1110}1111.11111111.11111111.11111111$ $\text{Decimal: } 224.0.0.0 \text{ to } 239.255.255.255$

Because multicast addresses represent an arbitrary group of receivers rather than an individual network interface, multicast addresses are destination addresses only. A host or router never uses a Class D address as the source IP address in an IP header.

+-----------------------------------------------------------------------------------+
|                          CLASS D MULTICAST ADDRESS RANGES                         |
+-----------------------------------------------------------------------------------+
|                                                                                   |
| 224.0.0.0        224.0.1.0        232.0.0.0        233.0.0.0       239.0.0.0      |
|     |                |                |                |               |          |
|     v                v                v                v               v          |
| [Link-Local]   [Internetwork]       [SSM]            [GLOP]      [Administratively|
| [Reserved  ]   [Control     ]   [Source-Specific]   [AS-Based]   [Scoped / Private|
| 224.0.0.255    224.0.1.255      232.255.255.255 233.255.255.255 239.255.255.255  |
+-----------------------------------------------------------------------------------+

IANA Multicast Address Allocations

2. Layer 2 Multicast MAC Address Mapping & The 32:1 Overlap Math

Ethernet network interface cards (NICs) filter traffic at Layer 2 based on destination MAC addresses to avoid interrupting the host CPU for unwanted frames. For IP multicast to operate over Ethernet, Layer 3 IPv4 multicast addresses must be dynamically mapped into Layer 2 Ethernet MAC addresses.

The IANA MAC Address Space

The Internet Assigned Numbers Authority (IANA) owns the Organizationally Unique Identifier (OUI) block 00:00:5E. IANA dedicated half of this block for IPv4 multicast by reserving the 24-bit prefix 01:00:5E with the 24th bit set to 0.

This creates the available Ethernet multicast MAC range: $\mathbf{01:00:5E:00:00:00} \text{ to } \mathbf{01:00:5E:7F:FF:FF}$

+-----------------------------------------------------------------------------------+
|                     LAYER 3 TO LAYER 2 MULTICAST MAC MAPPING                      |
+-----------------------------------------------------------------------------------+
|                                                                                   |
| IPv4 Multicast Address (32 bits):                                                 |
| +------+-------------------------+----------------------------------------------+ |
| | 1110 | 5 DISCARDED BITS        |           23 LOW-ORDER BITS (Mapped)         | |
| +------+-------------------------+----------------------------------------------+ |
|  4 bits        5 bits                                23 bits                      |
|                                                         |                         |
|                                                         v (Direct Bit Copy)       |
| Ethernet Multicast MAC Address (48 bits):               |                         |
| +----------------------------+---+----------------------------------------------+ |
| | 00000001:00000000:01011110 | 0 |           23 LOW-ORDER BITS (Copied)         | |
| |        (01:00:5E)          |   |                                              | |
| +----------------------------+---+----------------------------------------------+ |
|            24 bits           1 bit                   23 bits                      |
+-----------------------------------------------------------------------------------+

Step-by-Step Mapping Procedure

1. The first 25 bits of the MAC address are fixed as 01:00:5E with a leading 0-bit (01:00:5E:0x:xx:xx where the high-order bit of the 4th octet is 0).
2. This leaves exactly 23 bits of the Ethernet MAC address available for mapping.
3. An IPv4 Class D address contains 32 bits, of which the first 4 bits (1110) identify Class D, leaving 28 variable bits.
4. The router/host copies the low-order 23 bits of the IPv4 multicast address directly into the low-order 23 bits of the Ethernet MAC address.
5. The remaining 5 high-order bits ($28 - 23 = 5$) of the IP multicast address are discarded.

The 32:1 Overlap Ambiguity Ratio

Because 5 bits of IP address information are lost during the Layer 2 translation, exactly: $2^5 = 32$

32 distinct IPv4 multicast group addresses map to the exact same Layer 2 MAC address.

+-----------------------------------------------------------------------------------+
|                       32:1 MULTICAST MAC OVERLAP EXAMPLE                          |
+-----------------------------------------------------------------------------------+
| Group 1:  224.1.1.1   (1110 0000.0000 0001.0000 0001.0000 0001) -> 01:00:5E:01:01:01|
| Group 2:  224.129.1.1 (1110 0000.1000 0001.0000 0001.0000 0001) -> 01:00:5E:01:01:01|
| Group 3:  225.1.1.1   (1110 0001.0000 0001.0000 0001.0000 0001) -> 01:00:5E:01:01:01|
| Group 4:  225.129.1.1 (1110 0001.1000 0001.0000 0001.0000 0001) -> 01:00:5E:01:01:01|
| ...                                                                               |
| Group 32: 239.129.1.1 (1110 1111.1000 0001.0000 0001.0000 0001) -> 01:00:5E:01:01:01|
+-----------------------------------------------------------------------------------+

[!WARNING] Design Impact: If an enterprise runs two high-bandwidth video channels simultaneously on 224.1.1.1 and 239.1.1.1 in the same VLAN, both streams will be encapsulated into frames with destination MAC 01:00:5E:01:01:01. Access switch hardware ASICs filtering by Layer 2 MAC address will deliver both streams to receivers of either group, forcing host CPUs to discard unwanted traffic at Layer 3.

3. Internet Group Management Protocol (IGMPv1 vs IGMPv2 vs IGMPv3)

Internet Group Management Protocol (IGMP) operates between end-user receiver hosts and their directly connected First-Hop / Last-Hop Multicast Router (LHR). IGMP allows hosts to dynamically signal group membership (join and leave requests) to local routers.

+-----------------------------------------------------------------------------------+
|                              IGMP OPERATIONAL SCOPE                               |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|   [ Multicast Source ]                                                            |
|            |                                                                      |
|            v (PIM Multicast Routing Backbone)                                     |
|   +-----------------+                                                             |
|   | Last-Hop Router |  <======================+                                   |
|   +-----------------+                         |                                   |
|            |                                  | IGMPv1 / IGMPv2 / IGMPv3          |
|   =========+========= Access VLAN Subnet =====| (Host-to-Router Signaling)        |
|            |                                  |                                   |
|            +-----------------+                |                                   |
|            |                 |                |                                   |
|            v                 v                |                                   |
|       +---------+       +---------+           |                                   |
|       | Host 1  |       | Host 2  | <=========+                                   |
|       | Receiver|       | Receiver|                                               |
|       +---------+       +---------+                                               |
+-----------------------------------------------------------------------------------+

IGMP Version Comparison

Deep Dive: IGMPv2 Mechanics

IGMPv2 is the most widespread baseline multicast signaling protocol in enterprise networks.

1. General Query and Report:
   • The elected Querier periodically sends an IGMP General Query to 224.0.0.1 with a Max Response Time (default 10 seconds).
   • Hosts set a random response timer between 0 and Max Response Time for each group they belong to.
   • When the earliest timer expires on a host, that host transmits an IGMP Membership Report to the group address $G$.
   • Other hosts listening on the shared segment hear this report and suppress their own reports (Report Suppression), reducing control traffic.
2. Querier Election:
   • When multiple routers share a multi-access LAN segment, all routers initially transmit General Queries with their interface IP.
   • The router with the lowest numerical IPv4 address wins the election and becomes the designated IGMP Querier.
   • Non-querier routers reset an Other Querier Present Timer (default: $2 \times \text{Query Interval} + \frac{1}{2} \times \text{Max Response Time} = 125\text{s}$). If the active querier fails, the non-querier takes over.
3. Leave Group & Group-Specific Query:
   • When a host leaves a group, it transmits an IGMP Leave Group message (Type 0x17) to 224.0.0.2 (All Multicast Routers).
   • Upon receiving the Leave, the Querier immediately sends a Group-Specific Query destined to the specific group address $G$ with a reduced Max Response Time (Last Member Query Interval, default: 1 second).
   • The Querier repeats this query based on the Last Member Query Count (default: 2 times).
   • If no host sends a Membership Report within $2 \times 1\text{s} = 2\text{s}$, the router prunes the group from the interface, reducing leave latency from 180 seconds (IGMPv1) to approximately 2 seconds.

+-----------------------------------------------------------------------------------+
|                         IGMPv2 LEAVE GROUP TIMELINE                               |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  Host A                        IGMP Querier (Router)                  Host B      |
|    |                                     |                              |         |
|    |--- 1. IGMP Leave (Group 239.1.1.1)->|                              |         |
|    |    (Sent to 224.0.0.2)              |                              |         |
|    |                                     |--- 2. Group-Specific Query ->|         |
|    |                                     |    (Dest: 239.1.1.1, MRT=1s) |         |
|    |                                     |                              |         |
|    |                                     |<-- 3. Membership Report -----|         |
|    |                                     |    (Host B still wants it)   |         |
|    |                                     |                              |         |
|    |                                     | [Stream Continues to Subnet] |         |
+-----------------------------------------------------------------------------------+

Deep Dive: IGMPv3 and Source Filtering (SSM)

IGMPv3 (RFC 3376) introduces Source Filtering, empowering client applications to request traffic from explicit sender unicast IP addresses. This is the client-side foundation for Source-Specific Multicast (PIM-SSM).

• Filter Modes:
  • INCLUDE <Source-List>: The host requests multicast packets sent to group $G$ only if they originate from the specific source IPs in the list ((S, G) state).
  • EXCLUDE <Source-List>: The host requests multicast packets sent to group $G$ from all sources except the specific source IPs in the list. An empty exclude list (EXCLUDE {}) represents standard (*, G) any-source join.
• Report Destination (224.0.0.22): All IGMPv3 reports are sent directly to the reserved multicast address 224.0.0.22 (IGMPv3-capable routers). Hosts do not listen to 224.0.0.22; therefore, report suppression is disabled in IGMPv3, allowing routers to maintain full per-host source visibility.

4. Layer 2 IGMP Snooping & IGMP Snooping Querier

The Layer 2 Multicast Flooding Dilemma

By default, a standard Layer 2 Ethernet switch learns source MAC addresses to populate its CAM (MAC address) table. Because multicast MAC addresses (01:00:5E:xx:xx:xx) are strictly destination addresses and never appear as source MACs, the switch never learns them.

Consequently, without optimization, a Layer 2 switch treats all multicast frames as Unknown Multicast / Broadcast frames and floods them out every single port in the VLAN, saturating client access links and degrading Wi-Fi access points.

+-----------------------------------------------------------------------------------+
|              WITHOUT IGMP SNOOPING VS. WITH IGMP SNOOPING                         |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  WITHOUT IGMP SNOOPING: Multicast flooded to ALL ports in VLAN                     |
|  [Router / Source] === Multicast Stream ===> [ Access Switch ]                    |
|                                              /       |       \                    |
|                                          (Flood)  (Flood)  (Flood)                |
|                                            v         v         v                  |
|                                         [Host 1]  [Host 2]  [Host 3]              |
|                                         (Wants)   (Unwanted)(Unwanted)            |
|                                                                                   |
|  WITH IGMP SNOOPING: Switch snoops IGMP and forwards ONLY to interested ports     |
|  [Router / Source] === Multicast Stream ===> [ Access Switch ]                    |
|                                              /       |       \                    |
|                                         (Forward) (Blocked) (Blocked)             |
|                                            v         v         v                  |
|                                         [Host 1]  [Host 2]  [Host 3]              |
|                                         (Wants)   (Clean)   (Clean)               |
+-----------------------------------------------------------------------------------+

How IGMP Snooping Operates

When IGMP Snooping is enabled globally and on the VLAN (enabled by default on Cisco Catalyst switches):

1. The switch ASIC intercepts and inspects Layer 3 IGMP control packets exchanged between hosts and routers.
2. Router Port (mrouter port) Detection: The switch identifies ports connected to Layer 3 multicast routers by listening for IGMP General Queries, PIM Hellos, or Cisco Group Management Protocol (CGMP) packets. These ports are added to the multicast router port list for the VLAN.
3. Host Port Tracking: When a host on Port Gi1/0/1 transmits an IGMP Membership Report for group 239.1.1.1, the switch parses the report and creates an entry in its Layer 2 Multicast Forwarding Database (MFDB) binding MAC 01:00:5E:01:01:01 to port Gi1/0/1.
4. Data Forwarding: When incoming multicast data frames arrive on the switch, hardware ASICs look up the destination MAC in the MFDB and forward frames only to ports with registered receivers and to upstream mrouter ports.
5. Fast-Leave / Immediate-Leave (ip igmp snooping vlan <id> immediate-leave): In topologies where only a single host is connected per physical switch port, enabling immediate leave allows the switch to immediately prune the port upon receiving an IGMP Leave without waiting for Group-Specific Queries.

The IGMP Snooping Querier

IGMP Snooping relies entirely on periodic IGMP General Queries to refresh its MFDB table timers. If a VLAN is completely isolated at Layer 2 (e.g., an isolated storage, video surveillance, or backup VLAN with no Layer 3 default gateway router running PIM/IGMP):

• Hosts send initial IGMP Membership Reports upon boot, establishing initial multicast flows.
• Because no router exists to send periodic General Queries, host report suppression timers never trigger, and hosts remain silent.
• The switch's IGMP snooping group membership timer (default: 300 seconds) expires.
• The switch purges the group entries from the MFDB, causing multicast traffic to either be dropped or flooded as unknown broadcast.

Solution: IGMP Snooping Querier (ip igmp snooping querier) Configuring the switch as an IGMP Snooping Querier allows the Layer 2 switch to generate periodic IGMPv2 General Queries (using a configured source IP or 0.0.0.0) to keep the IGMP snooping table active without requiring a Layer 3 multicast routing license or physical router.

5. Cisco IOS-XE Configuration & Verification CLI

1. Enabling Multicast Routing and IGMP Snooping

! Globally enable multicast routing on Layer 3 switches / routers
ip multicast-routing

! Global IGMP Snooping configuration (enabled by default on Catalyst switches)
ip igmp snooping
ip igmp snooping vlan 10

! Enable Immediate-Leave on point-to-point host access ports
ip igmp snooping vlan 10 immediate-leave

! Configure IGMP Snooping Querier for Layer 2 only VLAN
ip igmp snooping querier
ip igmp snooping querier version 2
ip igmp snooping querier address 192.168.10.254

2. Interface IGMP Tuning & Static Joins

interface GigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 ip pim sparse-mode
 
 ! Configure IGMP Version 3 on interface (defaults to v2)
 ip igmp version 3
 
 ! Tune IGMP query interval and max response time
 ip igmp query-interval 30
 ip igmp query-max-response-time 5
 
 ! Join group statically on router for testing (punts to CPU)
 ip igmp join-group 239.1.1.1
 
 ! Statically forward group out interface without CPU punt
 ip igmp static-group 239.2.2.2

[!NOTE] Exam Distinction (join-group vs static-group): ip igmp join-group causes the router's local Route Processor to join the group, process multicast packets in software, and respond to ICMP pings. ip igmp static-group programs hardware ASICs to forward packets out the interface without sending copies to the local CPU.

3. Verification Commands & Diagnostics

Switch# show ip igmp snooping
Global IGMP Snooping configuration:
-------------------------------------------
IGMP snooping                : Enabled
IGMPv3 snooping              : Enabled
Report suppression           : Enabled
TCN solicit query            : Disabled
Applied subnet-based entries : Disabled

Vlan 10:
--------
IGMP snooping                       : Enabled
IGMPv2 immediate leave              : Enabled
Explicit host tracking              : Enabled
Multicast router learning mode      : pim-dvmrp
IGMP snooping querier               : Enabled
IGMP snooping querier address       : 192.168.10.254
IGMP snooping querier state         : Acting Querier

Switch# show ip igmp snooping groups vlan 10
Vlan      Group          Type        Version     Port List
-----------------------------------------------------------------------
10        239.1.1.1      dynamic     v2          Gi1/0/1, Gi1/0/2
10        239.10.10.100  dynamic     v3          Gi1/0/3

Router# show ip igmp interface GigabitEthernet0/0/1.10
GigabitEthernet0/0/1.10 is up, line protocol is up
  Internet address is 192.168.10.1/24
  IGMP is enabled on interface
  Current IGMP host version is 3
  Current IGMP router version is 3
  IGMP query interval is 30 seconds
  IGMP querier timeout is 60 seconds
  IGMP max query response time is 5 seconds
  Last member query count is 2
  Last member query response interval is 1000 ms
  Inbound IGMP access group is not set
  IGMP activity: 5 joins, 2 leaves
  Multicast routing is enabled on interface
  Multicast TTL threshold is 0
  Multicast designated router (DR) is 192.168.10.1 (this system)
  IGMP querying router is 192.168.10.1 (this system)
  Multicast groups joined by this system (number of users):
      239.1.1.1(1)

Router# show ip igmp groups
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter   Group Accounted
239.1.1.1        Gi0/0/1.10               00:14:22  00:00:25  192.168.10.50
239.10.10.100    Gi0/0/1.10               00:05:10  00:00:28  192.168.10.55
224.0.1.40       Gi0/0/1.10               01:02:11  00:00:21  192.168.10.1