Network Stories 22 · Intermediate · IGMP Snooping

1. The Story

Press "Next" to go through it step by step. At each step, a character appears and explains what they are doing.

Prologue: a quick review

Step 1 of 11

One live stream comes in

In the last story, I was sent to the group 233.252.0.1 using Multicast, so only one copy had to travel from the Internet to Rue. Tonight the TV wants to watch Channel 1.

Animation text version (all steps)

Prologue: a quick review
One live stream comes in · Pip: In the last story, I was sent to the group 233.252.0.1 using Multicast, so only one copy had to travel from the Internet to Rue. Tonight the TV wants to watch Channel 1.
Act 1: Traffic jam all over the house
Octo has to send it everywhere · Octo: My notebook only records "which device is on which Port". The group 01:00:5E:7C:00:01 never sends me anything, so I can never learn it, and I have to send it out of every Port.
Wi-Fi as slow as a snail · Mac: I'm using my phone in the study, and it's suddenly really slow! The Access Point has to send the live stream out into the air, and Wi-Fi usually sends Multicast at the slowest, safest speed, so all the wireless airtime gets used up.
Act 2: Signing up with IGMP
The TV hands in its sign-up form · Rue: Actually, devices that want the live stream have to sign up with me first. The TV sends an IGMP (Internet Group Management Protocol) Membership Report, commonly called a Join: "I want to join 233.252.0.1."
Rue only knows "someone" wants it · Rue: When I get the sign-up, I know someone in this LAN wants Channel 1, so I fetch the live stream from the Internet. But I only need to know that "someone" wants it, not which Port. Sharing it out is Octo's job.
Act 3: Octo learns to listen in
A quick peek at the sign-up form · Octo: With IGMP Snooping turned on, when a sign-up form passes by me, I take a look: "P3 wants 233.252.0.1!" I note it down, then pass it on to Rue as usual.
- From the Queries Rue sends, Octo also knows that Rue is on P5. That is the Router Port.
Sent only to P3 · Octo: Now Channel 1 is sent only to the TV on P3. Mac, the desktop computer and the Access Point no longer receive it, and the Wi-Fi is back to normal!
The desktop wants to watch too · Mac: Dad opens the same channel on the desktop computer. It also sends a Join, and Octo adds P2 to the record. Rue still sends only one copy of the live stream, and Octo copies it to P2 and P3 according to his record.
Act 4: Roll call and leaving
Roll call every 125 seconds · Rue: I'm this LAN's IGMP Querier. About every 125 seconds I send a General Query: "Who's still watching?" Devices that are still watching sign up again, so Octo's records don't expire.
The TV says goodbye · Pip: Before switching off, the TV sends a Leave: "I've stopped watching." Rue asks once more whether anyone is still watching Channel 1. The desktop computer answers that it still is, but the TV doesn't reply.
Only for those who want it · Octo: P3 didn't reply, so I delete it from my record. Now Channel 1 is sent only to P2. That's IGMP Snooping: only for those who want it!

2. Where Is the Problem

In the last story, the live stream came into the house using Multicast, so only one copy had to travel from the Internet to Rue. But when it reaches Octo, the Switch, a problem appears again:

Octo's MAC Address Table only records "which device is on which Port". The Multicast receiver 01:00:5E:7C:00:01 is a group, and it never appears in the "sender" column, so Octo can never learn it. As a result, Octo has to treat the live stream like a Broadcast and send it out of every Port in the same VLAN (Virtual LAN):

Mac's cable and the desktop computer's cable all carry a copy of the live stream for nothing.
The Access Point gets a copy too, and has to send it out into the air. When Wi-Fi sends Multicast, it usually uses the slowest, safest speed, and nobody replies to confirm it arrived. A single HD channel can take up a lot of wireless airtime, so phones become slow online.
If several channels are playing at once, it gets even worse.

3. How the Network Solves It

Imagine signing up for a club at a community centre. Members hand their sign-up form to the staff, and the forms pass by the reception desk in the lobby. The receptionist is very clever: she glances at each form as it goes by and notes down "Someone in Room 302 signed up for the football club". From then on, she only sends football club notices to Room 302.

IGMP (Internet Group Management Protocol) is the protocol devices use to sign up with a Router to join a Multicast group. IGMP Snooping is the Switch's clever receptionist: it "peeks" at the sign-up messages as they pass by, notes down which Port has someone who wants which group, and from then on sends that group's data only to those Ports.

4. A Closer Look

The three main IGMP messages

Message	Who sends it?	Where is it sent?	Meaning
Membership Report, commonly called a Join	A device that wants to watch	That group, for example `233.252.0.1` (with IGMPv3, to `224.0.0.22`)	"I want to join this group."
General Query	The Router, acting as the IGMP Querier	`224.0.0.1` (all hosts)	"Who still wants to watch what?" Once every 125 seconds by default
Leave Group	A device that no longer wants to watch (IGMPv2)	`224.0.0.2` (all Routers)	"I've stopped watching."

IGMP messages are placed directly inside an IP Packet with protocol number 2, and their TTL (Time to Live) is set to 1, so they never leave this LAN (Local Area Network).

Note: the Router only needs to know "whether anyone in this LAN wants to watch", not which device. So IGMP on its own cannot help a Switch decide which Port to send to. That is exactly the job of IGMP Snooping.

How does IGMP Snooping work?

Find out where the Router is. Octo sees a General Query coming in on P5, so he marks P5 as the Multicast Router Port. All sign-ups must be sent there.
Listen in on sign-ups. The TV sends a Membership Report from P3. Octo notes down "P3 wants 233.252.0.1", then passes the sign-up on to Rue as usual.
Send only to Ports with members. From then on, the 233.252.0.1 live stream is sent only to P3 (and to P5, for any other Routers that might need it).
Check regularly. Every 125 seconds, Rue sends a General Query. Devices that are still watching sign up again, so Octo knows the record is still valid.
Leaving. When the TV sends a Leave, Rue asks once or twice more about that group (a Group-Specific Query). If nobody answers, Octo deletes P3 from the record.

Octo's Multicast notebook

VLAN	Group	Ports with members	Router Port
10	`233.252.0.1` (Channel 1)	P2, P3	P5
10	`233.252.0.2` (Channel 2)	None	P5

This table and the MAC Address Table are two separate records.

Easy-to-miss details

There must be a Querier. After joining, devices usually only sign up again when they receive a Query. If no Router in the LAN sends Queries, Octo's records expire after about 260 seconds (2 × 125 seconds + 10 seconds), and the live stream may cut out. That's why many Switches have an IGMP Snooping Querier feature, so the Switch can ask the question when there is no Router.
224.0.0.x is not restricted. This block is for control messages within the LAN, such as OSPF (Open Shortest Path First) Hellos, and IGMP Snooping always sends them out of every Port as usual.
What about groups nobody signed up for? Different brands behave differently by default: some still send them out of every Port, while others send them only to the Router Port.
Fast Leave. If a Port connects to just one device, you can turn on Fast Leave: as soon as a Leave arrives, sending stops immediately, without waiting for the Router to ask again.
The IPv6 version. IPv6 uses MLD (Multicast Listener Discovery) instead of IGMP, and the matching Switch feature is called MLD Snooping.
A fix for Wi-Fi. Many Access Points can turn Multicast into Unicast for each phone before sending it, which makes the wireless network more efficient.

5. Try It Yourself

Task: take a look at your home Router

Log in to your home Router's settings page (usually by typing the Default Gateway address into the browser, for example 192.168.1.1). On a page such as "LAN", "Multicast" or "IPTV", look for these options:

IGMP Snooping
IGMP Proxy
Multicast to Unicast

If you're not sure, just look and don't change anything. A wrong setting could stop the internet TV from playing.

Mini game

IGMP or IGMP Snooping?

Sort each card into the side that does that job.

1The TV sends a Membership Report to sign up for 233.252.0.1
2The Router sends a General Query about every 125 seconds
3Note down "P3 wants 233.252.0.1"
4The TV sends a Leave before switching off
5Channel 1 is sent only to Ports with members
6Find out which Port the Query came in on and mark it as the Router Port

6. Where the Analogy Breaks

The receptionist only "glances", but Octo actually reads very carefully. A Switch normally only looks at a Frame's MAC Address, but IGMP Snooping has to open the Packet and read the IGMP content at Layer 3, so it isn't a pure Layer 2 feature.
"Peeking" is not a security hole. IGMP messages are meant to be read by network devices in the first place, and it's normal for a Switch to listen in on them.
A sign-up form doesn't last forever. Real networks rely on regular Queries to confirm, and expired records are deleted. The analogy leaves this step out.
The timing in the animation is sped up. A real General Query comes about every 125 seconds, and confirming a Leave also takes a second or two.

7. Quiz

8. Key Notes

A Switch can never learn a Multicast MAC Address. Without IGMP Snooping, it sends Multicast out of every Port, wasting cables and Wi-Fi.
IGMP is the sign-up protocol between devices and the Router: Membership Report (Join), General Query and Leave.
IGMP Snooping is a Switch feature: it listens in on IGMP, notes down which Ports have members, and sends group data only to those Ports and the Router Port.
The network needs an IGMP Querier (usually the Router); otherwise records expire.
The IPv6 equivalents are MLD and MLD Snooping.

IGMP Snooping

S1. The Story

?2. Where Is the Problem

i3. How the Network Solves It

+4. A Closer Look