[Xorp-users] Re: Newbie Xorp & m'cast problem

[edrt]

>Pavlin Radoslavov wrote:
>> Later Mark ran tcpdump and I think his src=0.0.0.0 packets also were
>> "IGMP leave" messages. I don't know whether he found by the MAC
>> address where the messages came from.
>
>	Well, I catch one source. It's very interesting.
>
>	All messages come from 0.0.0.0, same MAC 0011.936d.61b2. All are IGMP 
>leave, TTL=1, TOS=0xC0. All have the same destination - 
>ALL-ROUTERS.MCAST.NET
>
>12:44:35.576909 igmp leave 224.2.255.237
>12:44:35.579278 igmp leave 224.2.211.67
>12:44:35.581899 igmp leave 239.116.74.140
>12:44:35.583400 igmp leave 233.10.47.28

<DEL>


>
>	The MAC prefix is allocated to Cisco Systems.
>
>	But we have no Cisco routers. Only 38 Cisco switches.
>
>	Cisco documentation says:
>  ------
>  When a switch with IGMP snooping enabled receives an IP group-specific 
>IGMPv2 leave message, it sends a group-specific query out the interface 
>where the leave message was received to determine if there are any other 
>hosts attached to that interface that are interested in the MAC 
>multicast group. If the switch does not receive an IGMP join message 
>within the query-response-interval and none of the other 31 IP groups 
>corresponding to the MAC group are interested in the multicast traffic 
>for that MAC group and no multicast routers have been learned on the 
>interface, then the interface is removed from the port list of the 
>(mac-group, vlan) entry in the L2 forwarding table.
>  ------
>
>	Othere part of documentation says the IGMP leave packet is forwarded 
>only when there are no other subscribers to group in question on the 
>same switch.
>
>	My theory:
>Imagine there is only port on a switch subscribed to a group. The link 
>on the port is going down with no IGMP LEAVE sent by station connected 
>to it. The switch know that last subscriber of a group disapeared. So, 
>it sends IGMP LEAVE by self. As it have no IP it uses 0.0.0.0 which mean 
>"unknown source".
>
>	It allows the switch to unsunbscribe the unnecesarry multicast traffic 
>as soon as possible to maintain optimal bandwidth management. I can't 
>say it seems to be bug.
>
>>>	There are seems not to be reason to ignore IGMP from this source unless 
>>>we are hesitate about the forged leave messages.
>> 

Interesting, cause I'm working on IGMP snooping related stuff these days,
I take time digging into this problem. Through experiment I find that
if you unplug the wire connected to the multicast receiver, Cisco switch
will send two IGMP leave to multicast routers

 - first IGMP leave message 
    IP src   = multicast host
    IP dst   = 224.0.0.2
    IGMP grp = multicast group

 - second IGMP leave message
    IP src   = 0.0.0.0
    IP dst   = 224.0.0.2
    IGMP grp = 0.0.0.0

The second IGMP leave message is actually originated from the STP ROOT switch
to help the switching network quickly rebuilds the IGMP snooping entry after
spanning tree reconfigures.

ref "Typically, if a topology change occurs, ...", at
 http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_1_11/config/multi.htm#1049520


Eddy