TOIP GTW CISCO2951/K9 multicasting

[Halil.Zakaria]

Hello,

before to begin I thank you for your precious support in advance.

we have some slowness in a branch site, a L2/L3 switch is connecting to 10 WS-C2960-48PST-L access switches  connected to users phones and PCs (pc's are connected to phones) , 40 users / access switch

a voice gateway in the same vlan as voice vlan is connected to L2/L3 switch.

no whatever configuration of IGMP is in place for the whole branch offices switches and routers.

I 've found that the gateway is multicasting an important traffic as indicated in the capture.

according to default behavirour of a L2 switch (with no igmp configured) is to broadcast traffic destined to 01:00:5E:xx:xx:xx to all ports which causing this traffic to reach all IP phones slowing the network

is this traffic legitimate.what is it for, can I just filter it to avoid any performance impacts

Thank you

[Mohammed al Baqari]

Hi,

Can you confirm what is the device holding the IP 10.250.33.250 which is the source in the capture? I am assuming that is the gateway in the site.

If my assumption is correct, most likely, this will be music-on-hold streamed from voice gateway flash memory (someone needs to confirm that from IPT team)

Depending on your configuration, if you filter out this traffic, you won't be hearing music on hold. The best option is to configure IGMP snooping to make sure that only phones which are held are getting the stream instead of flooding it out of all ports.

On a side note, I have never seen MOH causing performance issues. Its very light traffic compared to the port size (Gig Ports)

[Halil.Zakaria]

Hello,

10.250.33.250  is the local voice gateway which acts also as a dhcp server for voip vlan.

so when I capture packets inbound to L2/L3 switch I see the multicasting(23.1MB in last 15minutes) but when I capture traffic toward the voice gateway I see no IGMP reports to joing the group:239.1.0.11 which brought to my mind the fact that this traffic might be iligitimate.

I think also that this TOIP is a back-up gateway cause I see only dhcp requests and few tcp sccp session from call manager towards it.