Multicast Hell

[michael.ball]

I have a switch stack of 2950's and a 3750 with the SMI version of IOS. I am trying to get Ghost multicasting working. Every time I start a multicast session it seems that the multicast packets to port 7777 show up on every port on every switch (I've plugged my laptop with Ethereal into several switches and found this) I thought that by default the 2950's are supposed to have IGMP snooping on and that should prevent flooding. What am I missing?

thanks for your help on this,

Michael

[glen.grant]

Check to make sure your program is not setup in broadcast mode .

[michael.ball]

I don't think that's it though because Ghost has 3 data transfer options, multicast, directed broadcast, and unicast. Multicast is the option that has been selected for the task.

Michael

[Bobby Thekkekandam]

Hi Michael, What Multicast IP address are you transmitting to?

As you may know, a multicast IP address and multicast MAC address are not 1-to-1 mapped, and only use 23 out of the 64 bits in a MAC address to map to a given IP address. As the result the group 230.0.0.1 (for example) and 224.0.0.1 will be mapped to the same mac address 0100.5e00.0001. This is a known reserved group, and any traffic for that group will be flooded out all ports, regardless of IGMP snooping. Since the switch uses the mac address table to forward traffic, any packet going to mac address 0100.5e00.0001 will be flooded.

So due to the 23 bit mapping, you need to avoid using the ip address range 224-239.0.0.x, and 224-239.128.0.x, otherwise it may cause flooding or other problems. If this is what you're running into, try using an address such as 2xx.1.1.1 instead.

HTH,

Bobby

*Please rate helpful posts.

[Bobby Thekkekandam]

Hi Michael, What Multicast IP address are you transmitting to?

As you may know, a multicast IP address and multicast MAC address are not 1-to-1 mapped, and only use 23 out of the 64 bits in a MAC address to map to a given IP address. As the result the group 230.0.0.1 (for example) and 224.0.0.1 will be mapped to the same mac address 0100.5e00.0001. This is a known reserved group, and any traffic for that group will be flooded out all ports, regardless of IGMP snooping. Since the switch uses the mac address table to forward traffic, any packet going to mac address 0100.5e00.0001 will be flooded.

So due to the 23 bit mapping, you need to avoid using the ip address range 224-239.0.0.x, and 224-239.128.0.x, otherwise it may cause flooding or other problems. If this is what you're running into, try using an address such as 2xx.1.1.1 instead.

HTH,

Bobby

*Please rate helpful posts.

[andrew.butterworth]

The SMI version of IOS for the 3750 (or 3550, 3560) doesn't support inter-vlan routing for Multicast traffic so it will flood to all ports in the VLAN by default since the 2950 will not see a multicast router and therefore IGMP snooping won't work.

HTH

Andy

[michael.ball]

Thanks Andy, this makes a lot of sense now. Well I just received my new "ipservices" image this morning. I'll put it on in the next couple of days and let you guys know.

Michael

[eward15]

Check out this link:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008059a9df.shtml

This should explain the cause and possible remedies.

Eugene

[michael.ball]

Thanks for the link, an interesting read - I have filed it away for future reference. But Andy has hit the nail on the head; I upgraded my switch last night with the enhanced image and successfully did a multicast to all of my vlans without flooding any unnessary ports.

Wish I could enter a 'solved my problem' but I think because I already rated his response I no longer have that option.

thanks guys,

Michael

[naive.naive]

I've some problem on my network, where i can see lots og multicast packets, to 224.0.0.2 but the source is not found.

Anyway for me to disable this traffic??

[michael.ball]

You should be able to use a packet sniffer like Ethereal to determine the IP address sending the packets. You may want to mirror a switch port of a device you know is receiving the packets.

[eward15]

224.0.0.2 is the all routers multicast address. You should probably investigate what that traffic is, because it might be important.

Eugene

"Don't forget to rate"

[naive.naive]

i've use ethereal to sniff, and the source ip is untracable/unreachable.

I can't even ping to the source ip, but from the mac address, it show is a cisco switch mac address, but i've search thru the entire network but can't find the switch holding the mac address which generating the multicast packet.

i've tried rebooted all the switches, but the traffic still exist..

i need to track down this source but i cant find it anywhere..

[lrian]

> i need to track down this source

On an IOS based switch:

  show mac-address-table address

will show you which port the traffic is coming from.

[naive.naive]

i've done that, but the source is not connected to that port shown..