Multicast and Ghost

[rcoote5902_2]

Hello,

We are attempting to use multicast with Symantec Ghost, and we're seeing extremely slow speeds, and in some cases, clients losing the session altogether.

I've read some posts about IGMP snooping perhaps being the culprit of this, but I am skeptical about turning it off - for obvious reasons.

We only have 2 vlans - one for voice and one for data - all the imaging is being done on the data vlan only so multicast routing is not enabled on our router.

All igmp settings on the switches are default:

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping : Enabled

IGMPv3 snooping (minimal) : Enabled

Report suppression : Enabled

TCN solicit query : Disabled

TCN flood query count : 2

Last member query interval : 1000

Vlan 101:

--------

IGMP snooping : Enabled

Immediate leave : Disabled

Multicast router learning mode : pim-dvmrp

Source only learning age timer : 10

Last member query interval : 1000

CGMP interoperability mode : IGMP_ONLY

Vlan 102:

--------

IGMP snooping : Enabled

Immediate leave : Disabled

Multicast router learning mode : pim-dvmrp

Source only learning age timer : 10

Last member query interval : 1000

CGMP interoperability mode : IGMP_ONLY

What if any, changes need to be made to the IGMP configuration to allow Ghost multicasting to work properly?

Regards,

Rob

[Jon Marshall]

Rob

Which model of switches are you using ?

There may be available on your switch seomthing called the IGMP snooping querier function.

Jon

[rcoote5902_2]

The switches are all 2950T-24's.

I've read other comments about the querier function but am not clear on how to configure this.

The ghost and clients are all running on the data vlan - the ghost server is not on the same switch, it is 3 switches removed.

We're going to try having the server local to the client switch.

However, if Ghost doesn't actually send out the IGMP Join request, I suppose this might all be moot. :/

Thanks for all the responses.

[jbrenesj]

Cisco will only send traffic on ports which receives IGMP join (from PC to the multicast group of the Ghost application), if we don't receive join we don't send traffic out of that port .

Flood could happen if the IGMP snooping is disabled so better don't do it.

Is the Symantec Ghost on the data vlan? If not I've seen some issues with the way the application sets its TTL

Are you seeing performance issues on a client connected to the same switch as the server? how about one switch beyond?

[Peter Paluch]

Hi Rob,

There are indeed problems with the multicasting under Symantec Ghost. The cause of the problem itself is trivial: the Ghost (or perhaps the NDIS drivers themselves) do not use the IGMP at all. Correct me if I am wrong here but this has been my observation. The stations being restored do not send any IGMP Join messages so a switch running IGMP Snooping can not build a list of outgoing interfaces.

I have been trying to cope with this problem myself but frankly, there are no good alternatives. Basically, if a switch is running IGMP Snooping but the clients do not send IGMP at all there's little to solve here.

Turning off the IGMP Snooping entirely is obviously not an option. Right now, I am thinking of a dirty workaround: using such multicast group IP addresses that will map to the MAC address of a link-local multicast. These multicasts are not subject to IGMP Snooping and are always forwarded out all ports on a switch (except the incoming port). Such IP addresses are:

224.0.0.0 - 224.0.0.255

224.128.0.0 - 224.128.0.255

225.0.0.0 - 225.0.0.255

225.128.0.0 - 225.128.0.255

and so on, up to

239.0.0.0 - 239.0.0.255

239.128.0.0 - 239.128.0.255

i.e. the address is of the form

X.Y.0.Z

where X is in range from 224 to 239, Y can be only 0 or 128, the third byte must always be 0 and Z is an arbitrary value from 0 to 255.

Best regards,

Peter

[scrye]

Hi;

I know this thread is old, old. But we too struggle with GHOST. In fact, it was so bad we actually turned off all PIM (used to run sparse-dense mode), no more RPs, disabled IGMP snooping querier on all VLANs owned by the 6500s at our 100 or so sites.  Our goal was to give up routing all multicast and just get the Ghosting to work on local switches - we would bring a laptop to act as the GhostCast server and just keep everything local. (FYI I am in the process of a complete redesign of our enterprise-wide Multicast, leaning toward PIM sparse mode and also leaning toward CGMP)

But until then we just want it to work locally.

This is from a 2960 layer two switch:

sh ip igmp snooping

Global IGMP Snooping configuration:

-------------------------------------------

IGMP snooping                : Enabled

IGMPv3 snooping (minimal)    : Enabled

Report suppression           : Enabled

TCN solicit query            : Disabled

TCN flood query count        : 2

Robustness variable          : 2

Last member query count      : 2

Last member query interval   : 1000

Vlan 1:

--------

IGMP snooping                       : Enabled

IGMPv2 immediate leave              : Disabled

Multicast router learning mode      : pim-dvmrp

CGMP interoperability mode          : IGMP_ONLY

Robustness variable                 : 2

Last member query count             : 2

Last member query interval          : 1000

Vlan 2:

--------

IGMP snooping                       : Enabled

IGMPv2 immediate leave              : Disabled

Multicast router learning mode      : pim-dvmrp

CGMP interoperability mode          : IGMP_ONLY

Robustness variable                 : 2

Last member query count             : 2

Last member query interval          : 1000

... etc.

Question: with IGMP snooping enabled on the switch as above, would you expect that multicast would not flood to all ports on the switch when a Ghost Cast server is running on the switch? (We actually WANT the flooding, crazy though that seems ....) I need to go wireshark it and see if, in fact, the Ghost computers are or are not sending the IGMP join packets.

Thanks,

Steve

[Peter Paluch]

Hello Steve,

With the current configuration of the 2960 switch, yes, it is my belief that the multicast stream sent by a GhostCast server will not be flooded to stations because they do not send IGMP Membership Reports. That was my experience at the time I have experimented with Ghost but it was quite a number of years ago. Wiresharking the stations and verifying if there is indeed no IGMP traffic generated by the Ghost computers would be  most interesting.

One comment to your configuration, though: you have indicated you have deactivated the IGMP Snooping Querier on your switches along with deactivating the PIM altogether. That would prevent Ghostcasting from working properly even if the stations did send IGMP Membership Reports because after initial joining of a multicast group, subsequent queries are sent only as a response to IGMP Membership Queries - and with no PIM routers and no Snooping Queriers, there would be no Queries sent.

In any case, deactivating the IGMP Snooping on your 2960 would certainly allow the Ghostcasting to work correctly but at the same time, it would effectively reduce it to broadcasting (even though stations not subscribed to that group would ignore the multicast at the NIC level and not processing it in the operating system).

Best regards,

Peter

[scrye]

Hi Peter;

I wanted to get on the forum and thank you for a quick reply, and give the group some of my preliminary findings. We are still doing more sharking.

One thing that is messing with my head is that even though I thought I had the span aka Monitor  session setup to exclude all traffic other than what is coming from a workstation that was booted with a USB with Ghost 11 "DOS" client, we see other mysterious traffic when sharking - for example IPV6 stuff that even though I imagine is coming from Win7 computers on that subnet, really ought not be sent via the span session to my wireshark laptop! After I get more data I plan to post the traces.

Here is the interesting part. Yes, we have no PIM and IGMP snooping querier is disabled on the VLANs that are owned by the 6500. IGMP snooping on the edge switch is enabled as per my above post. We have no access layer, just a core and the edge switch.  We setup for Multicast, give the GhostCast server a name, type that name into the client's little Ghost interface, and then .... it works.

I think that what is happening is the system falls back to NetBIOS/WINS, as per this doc:

http://service1.symantec.com/SUPPORT/ghost.nsf/ppfdocs/2002101612025325

" ... If Multicasting is not available on the network, then this discovery  step will fail and the client will attempt to issue a WINS query after 2  failures to locate the server via multicast (see Console Discovery  below)."

What is puzzling is that I can see the NetBIOS broadcast packet with the name of the GhostCast server, but I never see the initial IGMP packet ... WTF?!?

I'll admit I'm not a Multicast guru, although now that we are working on IPv6 I've been forced to re-learn stuff, what with the heavy use of Multi in V6 neighbor discovery and other stuff.

Here's what really confuses me about the Ghost deal. I always thought that if there was not IGMP, no CGMP, no PIM, no nothing, then a multicast packet just floods to all interfaces like a broadcast - would that not always work, regardless of what you wrote about  IGMP Membership reports/queries?

help ...

Steve