Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

unusual IGMP v2 traffic

I have captured the following packet on the network using tcpdump tool:

02:22:18.726507 0:3:e3:d9:26:c0 0:0:c:4:b2:33 0800 60: IP > igmp query v2 [gaddr]

4500 001c 0000 0000 2f02 37d8 cfa6 26a7

cfa6 26a7 1164 fb08 f000 0392 0000 0000

0000 0000 0000 0000 0000 0000 0000

I have changed the IP address for security reason. But looking at the packet I know the packet is not a valid IGMP v2 membership query packet. Because the group address is (valid multicast group range is - and the multicast Ethernet address is not correct ( valid multicast Ethernet address starts with 01-00-5E…….).

Also the IP ID is set to zero, which is unusual to me. My understanding about the IP ID is, it’s between the ranges of 1-65535. But someone also told me that Linux machines might send packets with IP ID of zero. In order for me to come to conclusion as to whether this packet has been crafted or a misconfiguration, I need to know when IGMP v2 membership query is initiated by Cisco routers does it have an IP ID of zero????

Thanks for your help in advance.

  • Other Security Subjects

Re: unusual IGMP v2 traffic

I assuming that what you mean by IP ID is protocol number, if I am right then the protocol ID is always 2 irrespective of the type of IGMP message. Protocol number can take a value between 1 - 65535.

New Member

Re: unusual IGMP v2 traffic

No...IP ID is the number assinged to all IP sessions. For example if one IP session includes 6 packets, all six packets should have the same IP ID. This way the host at the other end can re-assemble the packets.

New Member

Re: unusual IGMP v2 traffic

You must be talking about the identification field, which generates a unique value for each session. I don't think its fixed for each type of traffic.