cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
8582
Views
5
Helpful
5
Replies

Multicast traffic UDP 239.1.1.1

wilson_1234_2
Level 3
Level 3

I have two call manager servers in the voice VLAN of 10.100.10.0/16

We have our normal servers in data VLAN of 10.10.10.0/24.

I am seeing a huge amount of UDP traffic when sniffing in promiscuous mode on one of the Data servers.

According to the Voice consultants that configured the network, this is normal and is just the MOH traffic.

But, should I be seeing this traffic on my data server is a different VLAN?

5 Replies 5

AJAZ NAWAZ
Level 5
Level 5

Is your network configured to handle multicast traffic?

Ajaz

The server vlan is configured as such in the core switch where the devices are linked:

ip pim dense-mode

ip multicast ttl-threshold 2

ip route-cache flow

ip igmp join-group 230.0.0.1

ip igmp join-group 230.0.0.2

I see the same config in the workstation VLAN, but I do not see that multicast traffic on that VLAN.

also see this:

ip cef load-sharing algorithm original

ip multicast-routing

no ip igmp snooping

ip tcp path-mtu-discovery

no ip domain-lookup

ipv6 mfib hardware-switching replication-mode ingress

mls ip multicast flow-stat-timer 9

no mls flow ip

no mls flow ipv6

mls qos map cos-dscp 0 8 16 24 32 46 48 54

mls qos

no mls acl tcam share-global

mls cef error action freeze

I just talked with the Voice guy and he said multicasts are like broadcasts but can trverse layer 3.

I think as you said the network has to be configured to allow that correct?

I see nothing configured in the Voice vlan and the multicasts are on 239.1.1.1, not 230.0.0.1 or 2

if you configure ip multicast-routing on a switch/router then it will perform multicast.

The ip pim dense-mode command tells the switch to have an interface join multicast using dense mode PIM.

bgibson
Level 1
Level 1

What do you mean by huge amount of traffic. Most MoH streams don't exceed 80Kb/s.

You shouldn't see that stream on your data network unless someone is asking for it.

On the router do a sho ip igmp memb and see if some IP address is asking for 239.1.1.1

What I mean by a huge amount is that using wireshark and doing a packet capture, that is all I see on the interface.

In a matter 30 seconds there are 10,000 pakets all udp sourced from the Call Manager server.

It is non stop.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: