05-03-2006 07:50 AM - edited 03-03-2019 03:03 AM
I have a switch stack of 2950's and a 3750 with the SMI version of IOS. I am trying to get Ghost multicasting working. Every time I start a multicast session it seems that the multicast packets to port 7777 show up on every port on every switch (I've plugged my laptop with Ethereal into several switches and found this) I thought that by default the 2950's are supposed to have IGMP snooping on and that should prevent flooding. What am I missing?
thanks for your help on this,
Michael
05-03-2006 08:45 AM
Check to make sure your program is not setup in broadcast mode .
05-03-2006 09:33 AM
I don't think that's it though because Ghost has 3 data transfer options, multicast, directed broadcast, and unicast. Multicast is the option that has been selected for the task.
Michael
05-03-2006 10:54 AM
Hi Michael, What Multicast IP address are you transmitting to?
As you may know, a multicast IP address and multicast MAC address are not 1-to-1 mapped, and only use 23 out of the 64 bits in a MAC address to map to a given IP address. As the result the group 230.0.0.1 (for example) and 224.0.0.1 will be mapped to the same mac address 0100.5e00.0001. This is a known reserved group, and any traffic for that group will be flooded out all ports, regardless of IGMP snooping. Since the switch uses the mac address table to forward traffic, any packet going to mac address 0100.5e00.0001 will be flooded.
So due to the 23 bit mapping, you need to avoid using the ip address range 224-239.0.0.x, and 224-239.128.0.x, otherwise it may cause flooding or other problems. If this is what you're running into, try using an address such as 2xx.1.1.1 instead.
HTH,
Bobby
*Please rate helpful posts.
05-03-2006 10:55 AM
Hi Michael, What Multicast IP address are you transmitting to?
As you may know, a multicast IP address and multicast MAC address are not 1-to-1 mapped, and only use 23 out of the 64 bits in a MAC address to map to a given IP address. As the result the group 230.0.0.1 (for example) and 224.0.0.1 will be mapped to the same mac address 0100.5e00.0001. This is a known reserved group, and any traffic for that group will be flooded out all ports, regardless of IGMP snooping. Since the switch uses the mac address table to forward traffic, any packet going to mac address 0100.5e00.0001 will be flooded.
So due to the 23 bit mapping, you need to avoid using the ip address range 224-239.0.0.x, and 224-239.128.0.x, otherwise it may cause flooding or other problems. If this is what you're running into, try using an address such as 2xx.1.1.1 instead.
HTH,
Bobby
*Please rate helpful posts.
05-03-2006 10:30 AM
The SMI version of IOS for the 3750 (or 3550, 3560) doesn't support inter-vlan routing for Multicast traffic so it will flood to all ports in the VLAN by default since the 2950 will not see a multicast router and therefore IGMP snooping won't work.
HTH
Andy
05-03-2006 11:53 AM
Thanks Andy, this makes a lot of sense now. Well I just received my new "ipservices" image this morning. I'll put it on in the next couple of days and let you guys know.
Michael
05-04-2006 11:52 AM
Check out this link:
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008059a9df.shtml
This should explain the cause and possible remedies.
Eugene
05-05-2006 11:44 AM
Thanks for the link, an interesting read - I have filed it away for future reference. But Andy has hit the nail on the head; I upgraded my switch last night with the enhanced image and successfully did a multicast to all of my vlans without flooding any unnessary ports.
Wish I could enter a 'solved my problem' but I think because I already rated his response I no longer have that option.
thanks guys,
Michael
05-19-2006 10:17 AM
I've some problem on my network, where i can see lots og multicast packets, to 224.0.0.2 but the source is not found.
Anyway for me to disable this traffic??
05-19-2006 12:39 PM
You should be able to use a packet sniffer like Ethereal to determine the IP address sending the packets. You may want to mirror a switch port of a device you know is receiving the packets.
05-19-2006 12:54 PM
224.0.0.2 is the all routers multicast address. You should probably investigate what that traffic is, because it might be important.
Eugene
"Don't forget to rate"
05-20-2006 12:05 AM
i've use ethereal to sniff, and the source ip is untracable/unreachable.
I can't even ping to the source ip, but from the mac address, it show is a cisco switch mac address, but i've search thru the entire network but can't find the switch holding the mac address which generating the multicast packet.
i've tried rebooted all the switches, but the traffic still exist..
i need to track down this source but i cant find it anywhere..
05-20-2006 11:14 PM
> i need to track down this source
On an IOS based switch:
show mac-address-table address
will show you which port the traffic is coming from.
05-21-2006 08:56 AM
i've done that, but the source is not connected to that port shown..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide