@andromeda let me try to summarize it.
If you are looking to filter the Source of Multicast traffic in a scenario where attacker just target multicast group address to disrupt the multicast stream then you need to do it using IP Multicast boundary.
You can only allow specific Sources and Designation groups in ACL and bind it with ip multicast boundary command. The traffic not match by ACL will be discarded once it reached to Router control plane.
Let say in above scenario, you want to block multicast traffic sourced from 181.1.2.201 then you can do that by doing below. Below config will block multicast traffic from 181.1.2.201 but allow anything else
ip access-list extended acc_grp13
deny ip host 181.1.2.201 any
permit ip any any
!
interface gigabitethernet 2/3/0
ip multicast boundary acc_grp13 in
Let say, you want to allow source "181.1.2.201" and destination "232.1.1.8" but block any thing else source from ""181.1.2.201" and then allow all the multicast sources then:
ip access-list extended acc_grp13
permit host 181.1.2.201 host 232.1.1.8"
deny host 181.1.2.201 any
permit ip any any
!
interface gigabitethernet 2/3/0
ip multicast boundary acc_grp13 in
!
IGMP Access group:
IGMP Access-group will allow you to decide receiver on the interfaces are allowed to join which multicast group.
The following example shows how to configure a standard access list to filter the groups that are available on an interface for receivers to join. In this example, Ethernet interface 1/3 is configured to restrict receivers from joining groups in the range 226.1.0.0 through 226.1.255.255. Receivers are permitted to join all other groups on Ethernet interface 1/3.
access-list 1 deny 226.1.0.0 0.0.255.255
access-list 1 permit any log
!
interface ethernet 1/3
ip igmp access-group 1
---
PIM Neighbor Filter. The pim neighbor filter controls which devices can be your PIM neighbor. But this is typically not used for multicast security, infact it is useful in bandwidth saving on slower links
