Troubleshoot IGMP Snooping on Cisco Switches

Introduction

This document describes how the Internet Group Management Protocol (IGMP) feature on Catalyst 9K series switches works with debugs.

Prerequisites

Cisco recommends that you have knowledge of these topics:

• Basic understanding of L2 protocols and Switching
• Basic of PIM and IGMP Multicast understanding

Components Used

The information in this document is based on these software and hardware versions:

• Catalyst 9300 Version 17.9.4a
• Catalyst 9500x Version 17.13.1
• Windows 10 PC with VLC player

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Without IGMP capabilities, a layer 2 switch will forward a multicast frame to all ports (except the incoming port), which is a waste of switch resources.

IGMP snooping allows the switch to send multicast data frames only to those receivers that join a particular group by listening for reports/leave messages from the hosts. By default, this feature is enabled on a Cisco layer 2 switch. If you want to enable for only on a particular VLAN you can disable it globally and configure  ip igmp snooping vlan vlan-id  with required VLAN-id.

When the client connected to the L2 switch requests multicast traffic, the switch snoops this information and builds the multicast table so that the switch can forward the traffic to the intended recipient ports rather than flooding all ports of the switch.

Topology

Multicast Topology

Explanation

In order to gain a comprehensive understanding of IGMP signalling and traffic flow in multicast communication, it's crucial to examine it from both the receiver and source perspectives.

Receiver Side Forwarding

In order to understand the IGMP process, you need to understand the concept of mrouter port and IGMP querier.
Generally, when PIM is enabled on a router interface or the SVI of the switch, it starts sending IGMP queries periodically in the respective VLAN broadcast domain. The router interface sending the queries is nothing but the IGMP querier and the Switch interface that receives the queries is the mrouter port of the switch for that VLAN.
Any device in a specific broadcast domain only has one mrouter port. The switch starts building the IGMP snooping group table under the respective mrouter port.

Note: In case of multiple queries in the same broadcast domain, the election process takes place.

SW1 and SW2 are pure Layer 2 switches without routing.

Debugs enable us to understand the process of IGMP snooping.

#debug ip igmp snooping

PC21 connected to Gi 1/0/17 of SW2, needs 239.1.2.3 multicast stream. So PC21 sent out the join report to the switch.

SW2 received the joint report on Gi on 1/0/17.

*Apr 2 15:49:54.353: IGMPSN: Received IGMPv2 Report for group 239.1.2.3 received on Vlan 2717, port Gi1/0/17
*Apr 2 15:49:54.353: IGMPSN: NEW report: Call process_report port:Gi1/0/17 Querier is IGMPv1, Vlan 2717, quer_ver numeric 0.
*Apr 2 15:49:54.353: IGMPSN: Group: Received IGMPv2 report for mcast group 239.1.2.3 from Client 172.16.1.1. Received on Vlan 2717, port Gi1/0/17.
*Apr 2 15:49:54.353: IGMPSN: group: Adding client ip 172.16.1.1, port_id Gi1/0/17, on vlan 2717

In this case, as there is no querier in the broadcast domain, there is no mrouter port on the switch for the VLAN.
So, the switch has no choice but to drop the IGMP report coming in from Gi 1/0/17.

*Apr 2 15:49:54.353: IGMPSN: No mroute detected: Drop IGMPv2 report for group 239.1.2.3 from client 172.16.1.1 received on Vlan 2717, port Gi1/0/17

If an IGMP V2 client wishes to unsubscribe from a multicast stream, they can do so by sending the switch an IGMP-leave message.
The IGMP-Leave report example is mentioned here.
In general, when the switch receives the IGMP leave, the switch removes the entry from the IGMP snooping group table.

*Apr 2 15:52:11.237: IGMPSN: Received IGMP Leave for group 239.1.2.3 received on Vlan 2717, port Gi1/0/17
*Apr 2 15:52:11.238: IGMPSN: group: Leave for group 239.1.2.3 from Client 172.16.1.1 received on Vlan 2717, port Gi1/0/17, mvr group (No)
*Apr 2 15:52:11.238: IGMPSN: group: Skip client info adding - src_addr 172.16.1.1, client_addr 172.16.1.1, port_id Gi1/0/17, on vlan 2717
*Apr 2 15:52:11.238: IGMPSN: MCAST IP address 239.1.2.3, MAC address 0100.5e01.0203

As the switch does not have the mrouter port, it can not create the IGMP snooping group table. So, it does not have the entry of IGMP for port Gi 1/0/17. Hence it can not locate the same.

*Apr 2 15:52:11.238: IGMPSN: Can not Locate gce 0100.5e01.0203, on Vlan 2717
*Apr 2 15:52:11.238: IGMPSN: group: Group does not exist - Leave for group 239.1.2.3 from Client 172.16.1.1 received on Vlan 2717, port Gi1/0/17 send to router port
*Apr 2 15:52:11.238: IGMPSN: Call platform_l2mc_snoop_send_mrouter

Mrouter port creation is the first and vital step for the switch to start the IGMP snooping successfully.

As mentioned earlier, IGMP general queries depend on PIM, therefore, PIM dense mode has been enabled on R2 G1/0/45. (Interface Configuration Mode Command  ip pim dense-mode ).

*Apr 2 15:53:30.730: IGMPSN: router: Received non igmp pak on Vlan 2717, port Gi1/0/1
*Apr 2 15:53:30.730: IGMPSN: router: PIMV2 Hello packet received in 2717
*Apr 2 15:53:30.730: IGMPSN: l2mc_mrd_learn_router_port_internal Gi1/0/1 on Vlan 2717
*Apr 2 15:53:30.730: IGMPSN: router: Is not a router port on Vlan 2717, port Gi1/0/1
*Apr 2 15:53:30.730: IGMPSN: router: Is not a router port on Vlan 2717, port Gi1/0/1
*Apr 2 15:53:30.730: IGMPSN: router: Created router port on Vlan 2717, port Gi1/0/1
*Apr 2 15:53:30.730: IGMPSN: mgt: Reverting flood mode to only multicast router ports for Vlan 2717.
*Apr 2 15:53:30.730: IGMPSN: Adding router port Gi1/0/1 to all GCEs in Vlan 2717
*Apr 2 15:53:30.730: IGMPSN: added rport Gi1/0/1 on Vlan 2717
*Apr 2 15:53:30.734: IGMPSN: Notify others Gi1/0/1 on Vlan 2717
*Apr 2 15:53:30.734: IGMPSN: After l2mcm_rport_add-1 Gi1/0/1 on Vlan 2717
*Apr 2 15:53:30.734: IGMPSN: router: Calling HA mrouter sync Iport:Gi1/0/1 p_type:1 mrt_enable:0
*Apr 2 15:53:30.734: IGMPSN: igmpsn_ha_sync_mrouter_port_info enter Port Gi1/0/1 in vlan 2717
*Apr 2 15:53:30.734: IGMPSN: router: Learning port: Gi1/0/1 as rport on Vlan 2717
*Apr 2 15:53:30.734: IGMPSN: router: Received IGMP pak on Vlan 2717, port Gi1/0/1
*Apr 2 15:53:30.734: IGMPSN: l2mc_mrd_learn_router_port_internal Gi1/0/1 on Vlan 2717
*Apr 2 15:53:30.734: IGMPSN: router: Is a router port on Vlan 2717, port Gi1/0/1
*Apr 2 15:53:30.734: IGMPSN: router: Learning port: Gi1/0/1 as rport on Vlan 2717
*Apr 2 15:53:30.734: IGMPSN: Received IGMP Query for group 0.0.0.0 received on Vlan 2717, port Gi1/0/1 *****
*Apr 2 15:53:30.734: IGMPSN: IGMPv2 General Query received on Vlan 2717, port Gi1/0/1 Resp time 2500 (25 100) msecs, LLQ interval 2000 (2, 1000)
*Apr 2 15:53:30.734: IGMPSN: IGMP general queries received on Vlan 2717 updates all groups
*Apr 2 15:53:30.734: IGMPSN: timer: start report_timer 2500 msecs of vlan 2717

The switch creates the mrouter port for the respective VLAN in which it receives the general query from the queried.

SW2#show ip igmp snooping vlan 2717
Vlan 2717:
--------
IGMP snooping : Enabled
Pim Snooping : Disabled
IGMPv2 immediate leave : Enabled
Explicit host tracking : Enabled
Multicast router learning mode : pim-dvmrp
CGMP interoperability mode : IGMP_ONLY
Robustness variable : 2
Last member query count : 2
Last member query interval : 1000


SW2#show ip igmp snooping querier
Vlan      IP Address       IGMP Version      Port
-------------------------------------------------------------
2717      172.17.1.254     v2                Gi1/0/1

SW2#show ip igmp snooping mrouter
Vlan    ports
----    -----
2717    Gi1/0/1(dynamic)

Querier sends IGMP general query every 60 seconds.

~
*Apr 6 10:37:02.793: IGMPSN: Received IGMP Query for group 0.0.0.0 received on Vlan 2717, port Gi1/0/1
*Apr 6 10:37:02.793: IGMPSN: IGMPv2 General Query received on Vlan 2717, port Gi1/0/1 Resp time 10000 (100 100) msecs, LLQ interval 2000 (2, 1000)
*Apr 6 10:37:02.793: IGMPSN: IGMP general queries received on Vlan 2717 updates all groups
~
~
*Apr 6 10:38:02.793: IGMPSN: Received IGMP Query for group 0.0.0.0 received on Vlan 2717, port Gi1/0/1
*Apr 6 10:38:02.793: IGMPSN: IGMPv2 General Query received on Vlan 2717, port Gi1/0/1 Resp time 10000 (100 100) msecs, LLQ interval 2000 (2, 1000)
*Apr 6 10:38:02.793: IGMPSN: IGMP general queries received on Vlan 2717 updates all groups
~

The host connected to port Gi 1/0/17 (PC21) needs the multicast stream destined to 239.1.2.3 so, PC21 sends the report destined to 239.1.2.3 intended for querier 172.17.1.254.
Switch snoops the same packet and creates an entry in the IGMP snooping table.

*Apr 6 10:38:03.714: IGMPSN: Received IGMPv2 Report for group 239.1.2.3 received on Vlan 2717, port Gi1/0/17
*Apr 6 10:38:03.714: IGMPSN: NEW report: Call process_report port:Gi1/0/17 Querier is IGMPv1, Vlan 2717, quer_ver numeric 2.
*Apr 6 10:38:03.714: IGMPSN: Group: Received IGMPv2 report for mcast group 239.1.2.3 from Client 172.17.1.1. Received on Vlan 2717, port Gi1/0/17.
*Apr 6 10:38:03.714: IGMPSN: group: Adding client ip 172.17.1.1, port_id Gi1/0/17, on vlan 2717
*Apr 6 10:38:03.714: IGMPSN: MCAST IP address 239.1.2.3, MAC address 0100.5e01.0203
*Apr 6 10:38:03.714: IGMPSN: Locate gce 0100.5e01.0203, on Vlan 2717
*Apr 6 10:38:03.714: IGMPSN: locate group 239.1.2.3, on Vlan 2717
*Apr 6 10:38:03.714: IGMPSN: Add v2 group 239.1.2.3 member port Gi1/0/17, on Vlan 2717
*Apr 6 10:38:03.714: IGMPSN: group: Added port Gi1/0/17 to group 239.1.2.3
*Apr 6 10:38:03.714: TIMER_START for group239.1.2.3 for time 10000 * 100
*Apr 6 10:38:03.714: IGMPSN: group: Forwarding 239.1.2.3 report to router ports
*Apr 6 10:38:03.714: IGMPSN: Call platform_l2mc_snoop_send_mrouter

SW2#show ip igmp snooping group

Vlan         Group           Type       Version      Port List
-----------------------------------------------------------------------
2717         239.1.2.3       igmp       v2           Gi1/0/17

If the switch receives data traffic destined to multicast group 239.1.2.3 either from the uplink Gi1/0/1 or from any other port in VLAN 2717, the switch only forwards it to interface Gi 1/0/17 and does not forward to any other port in VLAN 2717.

Also, the IGMP report reaches Querier (R2) from mrouter port of SW2 and Querier creates the respective IGMP group entry for the same. If R2 receives multicast data traffic destined to 239.1.2.3 it is forwarded to SW2.

Sender/Source Side Forwarding

PC11, 172.16.1.1 is connected to SW1 Gi 1/0/3, sending multicast traffic destined to 239.1.2.3 UDP port 1234.

SW1#show int gigabitEthernet 1/0/3
GigabitEthernet1/0/3 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 2416.9d7a.1083 (bia 2416.9d7a.1083)
~
~
5 minute input rate 1857000 bits/sec, 170 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
9410 packets input, 12890025 bytes, 0 no buffer
Received 9394 broadcasts (9394 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 9394 multicast, 0 pause input
0 input packets with dribble condition detected
~
~

SW1#show int gigabitEthernet 1/0/3 counters

Port       InOctets     InUcastPkts   InMcastPkts     InBcastPkts
Gi1/0/3    12890593     17            9396            0 

!

SW1#show int te 1/1/1 counters

Port       InOctets      InUcastPkts    InMcastPkts     InBcastPkts
Te1/1/1    1166336       3940           1251            14 

Port       OutOctets     OutUcastPkts   OutMcastPkts    OutBcastPkts
Te1/1/1    3229106605    2731           2358824         6 

!

SW1#show ip igmp snooping querier
Vlan IP     Address           IGMP Version      Port
-------------------------------------------------------------
2716        172.16.1.254      v2                Te1/1/1

!

SW1#show ip igmp snooping mrouter
Vlan   ports
----   -----
2716   Te1/1/1(dynamic)

On SW1, IGMP snooping is enabled and the switch already has mrouter port, switch will by default forward the received multicast data traffic on mrouter port toward the querier.

EPC on source interface Gi 1/0/3.

SW1#show monitor capture file flash:mycap1.pcap
Starting the packet display ........ Press Ctrl + Shift + 6 to exit

1 0.000000 172.16.1.1 -> 239.1.2.3 RTCP 102 Sender Report Source description
2 0.000100 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328
3 0.000140 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328
4 0.000178 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328
5 0.000234 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328

Multicast Data streaming entering in the switch SW1 and going out from Te 1/1/1 towards the PIM router or Querier 172.16.1.254.

Multicast routing and PIM is enabled for 10.0.10.0/24, 10.0.20.0/24,172.16.1.0/24 and 172.17.1.0/24 on Core, R1 and R2. The multicast routing ensures to forward the multicast stream in the L3 network and finally, the stream reaches R2. As R2 has the IGMP group table entry previously learned through the IGMP report process, R2 forwards the stream to SW2.

SW2#show int gigabitEthernet 1/0/17 counters

Port       InOctets    InUcastPkts    InMcastPkts    InBcastPkts
Gi1/0/17   200         1709           103            0

Port       OutOctets   OutUcastPkts   OutMcastPkts   OutBcastPkts
Gi1/0/17   3661503     3              2667           0

Finally, PC21 receives the multicast stream. OutMcastPkts on Gi 1/0/17 incrementing.

EPC on interface Gi 1/0/17 of SW2.

SW2#show monitor capture file flash:mycap1.pcap
Starting the packet display ........ Press Ctrl + Shift + 6 to exit

~
~
14 18.002140 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328
15 18.002178 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328
16 18.002234 172.16.1.1 -> 239.1.2.3 UDP 1370 59218 -> 1234 Len=1328
~
~

Multicast Data streaming entering in the switch SW2 from Gi 1/0/1 and going out from Gi 1/0/17 towards the host requesting the multicast stream.