multicast and igmp snooping

[jschweng]

We have a couple of 3750 switches which carry vlan 238 and they are connected together with a trunk

A host on that subnet is sending out multicast group 239.252.255.26 as a status message

We have igmp snooping enabled on vlan 238

and if I do show ip igmp snooping groups the only members of the sender.

We do run pim sm on v and the switches are connected to our core siwtches which also run pim sm

There are other hosts on vlan 238 which do not want to receive that groups but apparently the switch is

forwarding it to their interface.

is there any reason why - anything special about that group?

I looked at teh dest MAC on the pactkes and its 01:00:5E:7C:FF:1A which is not broadcast

thanks in advance

[nkarpysh]

Hello,

01:00:5E:7C:FF:1A - is the Multicast MAC built from group address. and all hosts which want to get that multicast are listening for this MAC on their NICs like for their own unicast MAC addresses.

If you see the host under igmp snooping - than that host send IGMP join asking for this mcast. Not sure what this group is about  - but possibly all want it. You can try  sniffering the host which you say "does not want it" and see if that eventually send IGMP joins for that group. Or do igmp snooping debug on switch to check that.

Nik

[jschweng]

That's what is puzzling to me because I dont see that any of the hosts receiving that group are sending joins to teh switch. if i do show ip igmp snooping goups - the only ports which are part of that groups is the sender.  so i dont see why it gets sent to the other ports.  but i will check with a packet capture and see what i can find - thanks

i guess there is no reason that particular group would be broadcast by default on a cisco switch is there?

[nkarpysh]

If IGMP snooping is enabled - then yes no reason to broadcast. With snooping disabled - switch can broadcast it.

Nik

[jschweng]

If the source is sendign out this 239.252.x.x. group and no one else is subscribing to that group on the same segment - then is the default behavior per the RFC to flood the packet to every port?

If so I thought it would eventually prune off and stop