Multicast Error Message

[lalit]

Hi,

I am getting the following error message on Cisco 6506 Catalyst switch contineously.

" %MCAST-5-RX_IGMPREPORT: IGMP: Rcvd IGMP Report 01-00-5e-00-00-fd "

Please let me know how do i stop this message coming on the switch.

As i read in cisco site that this message is informational only.Please let me know how do i stop this message from coming.

Pls help.

Thanks & Regds,

Lalit

[Peter Paluch]

Lalit,

I do not believe this message can be stopped. You should better act on it. The switch is warning you that some of your multicast groups is using an IP address that maps onto a link-local MAC multicast address and is flooded out all ports, instead of being controlled by IGMP Snooping.

You are most probably using a multicast group whose IP address is somewhere among the following 32 IP addresses:

224.0.0.253

224.128.0.253

225.0.0.253

225.128.0.253

226.0.0.253

226.128.0.253

...

239.0.0.253

239.128.0.253

Each of these multicast IP addresses is mapped onto the same multicast MAC address 01-00-5e-00-00-fd.  This multicast MAC is one of the link-local multicasts for which there are no flooding restrictions. Catalyst switches do not perform any flood restrictions on such multicast groups, and flood the multicasts onto all ports within the VLAN. The advantages of IGMP Snooping are thereby completely lost.

Rather than trying to ignore that warning message, you should change your multicast IP addresses so that they avoid being mapped to the link-local multicast MAC range, i.e. you should avoid all multicast IP addresses of the form

224.0.0.x

224.128.0.x

225.0.0.x

225.128.0.x

226.0.0.x

226.128.0.x

...

239.0.0.x

239.128.0.x

where x is an arbitrary number between 0 and 255 inclusive. Using any of these multicast IP addresses will result into the traffic being flooded out all ports (except the ingress port) and nullifying any advantages of the IGMP Snooping.

Do you believe you will be able to readdress your multicast streams?

Best regards,

Peter

[lalit]

Hi Peter,

Thanks for the reply...

How do i find that which maching causing this issue.Is there any command through which i can disable this....

Thanks & Regds,

Lalit

[Peter Paluch]

Hello Lalit,

Try using the show ip igmp group and show ip igmp snooping group to find out which stations on which ports have subscribed themselves to one of the 32 IP multicast groups mentioned above. You should be able to identify at least one station that sent an IGMP Join towards such group from these outputs.

Best regards,

Peter

[lalit]

Hello Peter,

Thanks for reply.

The Cisco 6506 Switch is ruuning on CatOS and the command show ip igmp group and show ip igmp snooping group is not available.

I am getting contineously non stop " %MCAST-5-RX_IGMPREPORT: IGMP: Rcvd IGMP Report 01-00-5e-00-00-fd " mesage on the switch once i logged into it.

Please let me know how do i overcome from this notification.

Thanks & Regds,

Lalit

[Peter Paluch]

Hello Lalit,

Try using this command to find out more about the source of those joins:

show multicast group

Best regards,

Peter

[lalit]

Hi Peter,

Whether we can find out the actual root cause from the Show multicast group output.

Also please let me know how do we find the source from show multicast group o/p.

Need your help on this. I am getting the message contineously after telneting into the switch.The switch is running with CatOS.

Also I am getting this message only on the access switch running CatOS.The Distribution switch connected to the access switch am not getting any " %MCAST-5-RX_IGMPREPORT: IGMP: Rcvd IGMP Report  " message.

Is this message is perticular only to CatOS.......Pls let me know.

Thanks & Regds,

Lalit

[Peter Paluch]

Lalit,

I have suggested using the command show multicast group command. Please use it as I suggested in my last post and copy the results here.

Thank you!

Best regards,

Peter

[lalit]

Hi Peter,

Thanks for the reply.

Please find the below show multicast group o/p.

* = Static Entry. + = Permanent Entry.

                                               Destination Ports or

VLAN  Dest MAC/Route Des    [CoS]     Age      VCs / [Protocol Type]

----  ------------------    -----  ----------  ---------------------

10    01-00-5e-7f-ff-fa  &                      1/14,5/2

24    01-00-5e-7f-ff-fa  &                      5/2

26    01-00-5e-00-01-3c                         5/2

46    01-00-5e-7f-ff-fa  &                      5/2

125   01-00-5e-50-44-53                         5/2

125   01-00-5e-7f-ff-fa  &                      1/4,1/6,5/2

125   01-00-5e-7f-ff-fd                         5/2

249   01-00-5e-7f-ff-fa  &                      5/2

Total Number of Entries = 8

Note :  5/2 is a Trunk Port connected to a diffrent switch.

Thanks & Regds,

Lalit

[Peter Paluch]

Hello Lalit,

I have hoped that the output would provide information about the offending multicast group related to a port, but it does not - obviously, the Catalyst tries to ignore these IGMP joins.

Does the logging message include any more information - for example, who sent the IGMP Join, which port did the message enter through, what VLAN it is in, etc.?

If not, we have to try monitoring the traffic. Do you believe you could attach a PC or a notebook running Wireshark to a dedicated port on this switch, and configuring a SPAN session to monitor individual ports or VLANs? If we capture the IGMP Join message, we should be able to discover its sender, as the IGMP message is encapsulated in an IP packet.

Best regards,

Peter

[lalit]

Hello Peter,

Thanks for your reply.

I have captured the packet through wireshark but am not seeing anything related to IGMP join message.I am seeing only Membership Query and Membership Report.

Thanks & Regds,

Lalit

[Peter Paluch]

Lalit,

Can you post the capture here? Include all IGMP traffic you have captured please.

Best regards,

Peter

[lalit]

Hello Peter,

Cant we find out anything from show multicast group o/p.....

I am seeing the mac-addresss  " 01-00-5e-7f-ff-fa " in the wireshark o/p.....

Is it the chances that port 5/2 connected to a switch where having  the IGMP request...In the o/p also it shows 1/4 & 1/6.

Is it very difficult find out the actual root cause of this issue....If i set the " logging level mcast 3 default " am not getting any message on the switch.But as per standard it suppose to be  " set logging level mcast 6 default "

Is there any IOS bug issue whcih causes this.

Thanks & Regds,

Lalit

[Peter Paluch]

Lalit,

Please... in order to save both your and my time, first and foremost, pay close attention to my requests in each of my posts. When I ask you for the dump file of the traffic, it is because I need it in order to move the analysis forward. I happily accept any discussion and speculation along with the information I request, but if you just start a new line of thought without either respecting my requests or explaining why you can not provide the necessary information, I have to request it again. This both delays the solution of your problem and wastes our time uselessly.

So, once again: are you able to post the dump file created by your Wireshark that contains only the IGMP traffic? Also, I need to know precisely how was this capture created, i.e. where was your sniffer, how was the SPAN session configured on your switch, etc. so that I know what traffic I am looking at.

Best regards,

Peter