Multicast Error Message

jwright · ‎10-26-2007

I am getting the following error message on my catalyst 6506 switches:

2007 Oct 26 13:41:21 EST -04:00 %MCAST-5-RX_IGMPREPORT: IGMP: Rcvd IGMP Report 01-00-5e-00-00-02 on 3/11

I receive the message on numerous trunk ports and the multicast MAC will vary.

The only info I've found online is that the message is informational only. I am seeing tons of these messages and would like to know if it's normal and what should be done about it.... if anything.

szahid · ‎10-26-2007

This may be a cause of concern . Typically the address range 224.0.x will map to the multicast mac of 01-00-5e-00-00-xx. What the switch is complaining about is that some one is sending an IGMP join for a group that should be used by only control protocols like OSPF , PIM , EIGRP etc. The key is to always use a multicast ip with a non-zero second and 3rd octet so that it never maps to the mac address that falls into a range of control protocols. This problem is due to 32:1 mapping of Multicast ip to mac addresses. What that means is potentially 32 multicast ip addresses could have the same mac address. For example 224.0.0.1 , 225.0.0.1 , 239.0.0.1 will all map to 0100.5e00.0001 . Now even though 225.0.0.1 and 239.0.0.1 have nothing to do with control protocols and should be perfectly fine to be used by users , the mac addres however ends up mapping to a well-known mac address and hence the syslog message that you are seeing . using a multicast ip with non-zero second and 3rd octet will result in multicast ip never mapping to a well known mac address.

Hope this helps.

Thanks

Salman.

jwright · ‎10-26-2007

Thanks for the input. Are you saying that the join message could possibly be originating from one source? As I said I am seeing this on just about every trunk link I have configured on the 6506. It is used as a distribution layer switch and has no end users connected to it only access layer switches. Would I get these messages if it were legitimate control traffic?

szahid · ‎10-26-2007

Legitimate control traffic would not send the join message on this address , so the answer to that would be No.

As to why you are getting this message , that just means you have some clients connected to access switches that are sending join messages on lets say 239.0.0.2 0100.5e00.0002 ( I am using 239.0.0.2 just as an example ) which is relayed by your access switches upto the dist. switch.

Keep inmind that there could be upt 32 multicast ips that map to 0100.5e00.0002.And out of those 32 IPs , only one is a control address 224.0.0.2 .

So any time , the users use any of the other 31 IPs that map to this mac address , you will get this message.

All it is as I said are some clients wanting to join some grp ( for example 225.0.0.2 , 226.0.0.2 etc ) that end up mapping to a well known multicast mac and system complains about it.

Thanks

Salman.