how to trace the source of a multicast group

[Guangming_Li]

Hi Guys,

I got those multicast group below. I am just wondering how i can trace the source of a multicast group. i want to find out which port is connected to which source, and there ip address.

WS4500X#sh ip igmp groups
IGMP Connected Group Membership
Group Address Interface Uptime Expires Last Reporter Group Accounted
233.89.188.1 Vlan68 2d18h 00:02:22 172.16.68.199
239.255.255.250 Vlan68 2d18h 00:02:24 172.16.68.75
239.192.8.88 Vlan68 03:40:37 00:02:30 172.16.68.143
224.130.200.174 Vlan68 2d18h 00:02:22 172.16.68.251
224.100.100.100 Vlan68 2d18h 00:02:22 172.16.68.156
225.1.0.1 Vlan68 18:26:33 00:02:26 172.16.68.157
224.0.1.40 Vlan68 2d18h 00:02:22 172.16.68.15

thanks.

Guangming

[Peter Paluch · Accepted solution]

Hi Guangming,

Assuming that your 4500X is running multicast routing, you could try entering the show ip mroute command to show the multicast routing table. If you are using PIM-DM or PIM-SM, you will probably see entries of the (S,G) form where S is the IP address of the source of a multicast stream, and G is the IP address of a multicast group. This is a place where you can learn about multicast sources.

In general, multicast routers do not collect information about multicast sources beyond the normal rules of PIM operation. With PIM-DM, you are going to see every source in the show ip mroute. With PIM-SM, you will see sources in this output only if the router is a part of a source-rooted tree between the sender and the rendezvous point router or the final recipient. With BiDir-PIM, you are not going to see any sources whatsoever. Discovering multicast sources needs to be done in different way, either by utilizing NetFlow, or by monitoring the traffic on SPAN ports or directly at end hosts.

Please be aware that a multicast group can exist without any source sending data into it. A multicast group entry is created by a host subscribing into it, without knowing in advance if there is anyone transmitting data in that group - there can be groups without any sources.

Best regards,
Peter

[Guangming_Li]

Thanks Peter. Appreciate your help.

i didn't enable multicast routing on 4500x as the source and receiver are on the same vlan. 

I can only see output below when i run 'show ip mroute' which means there is no way to track the source of multicast unless i utilize Netflow or traffic monitoring?

WS4500X#sh ip mroute
IP Multicast Forwarding is not enabled.
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,
L - Local, P - Pruned, R - RP-bit set, F - Register flag,
T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet,
X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,
U - URD, I - Received Source Specific Host Report,
Z - Multicast Tunnel, z - MDT-data group sender,
Y - Joined MDT-data group, y - Sending to MDT-data group,
G - Received BGP C-Mroute, g - Sent BGP C-Mroute,
Q - Received BGP S-A Route, q - Sent BGP S-A Route,
V - RD & Vector, v - Vector
Outgoing interface flags: H - Hardware switched, A - Assert winner
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode

[Peter Paluch]

Hi Guangming,

I am sorry to respond late.

Yes, I am afraid so. Multicast within a single LAN does not require a router to take any part in its delivery, and consequently routers in general do not pay attention to a multicast that is constrained to a single VLAN. To discover sources of such multicasts, you indeed need to do network sniffing or NetFlow analysis.

I am sorry to disappoint you.

Best regards,
Peter