Showing results for 
Search instead for 
Did you mean: 

multicast storm during join / leave




trying to figure out problem thats been bugging me for a while. We do have several setups like this and even bigger, but only this one has this particular problem.





Lets keep it simple.

All of the not needed connections have been shutdown (like optics out of this stack...) so there are basically only router and stack. Stack is "OK" 


There are several multicast sources and currently there are few destinations. The moment i shutdown port , or bring it up (port that is a part of iptv (multicass) there is a multicast storm to destination ports and of course our source "coordinator" - it is windows 2012r2 machine , there is a wireshark and this is what i m getting during the storm (see pic from wireshark) - various ips 10.40.20.x are multicast sources that normaly do not do this there is like 1mbps receiving part. Now it goes to 80-100mbps.


This is on the router for the said vlan interface
interface Vlan406
description iptv
ip address
ip pim sparse-dense-mode
ip nat inside
ip virtual-reassembly in
zone-member security LAN

switch of course is snooping
Vlan 406:
IGMP snooping : Enabled
IGMPv2 immediate leave : Disabled
Multicast router learning mode : pim-dvmrp
CGMP interoperability mode : IGMP_ONLY
Robustness variable : 2
Last member query count : 2
Last member query interval : 1000
Topology change : No
Vlan 407:

show ip igmp snooping groups | count 406
Number of lines which match regexp = 12
after manual checking yes, there are currently 12 multicast groups on switch for the 406 VLAN


version that the stack is running
System image file is "flash:/c2960x-universalk9-mz.152-7.E5/c2960x-universalk9-mz.152-7.E5.bin"

I ve tried to make switch querier and severed the connection after that with router. Groups still do work, but so does the multicast storm during shutdown / no shutdown

During this event when i do show controllers util , i can see how they are transmitting and there are 2 100mbps consumere devices that are on 100percent.  After a while (like 30 - 60 seconds) this will pass.

anyone little help ? Can post full configs if needed.
Thank you.

2 Replies 2

Flavio Miranda
VIP Mentor VIP Mentor
VIP Mentor

Broadcast storm is caused by loop. Is there any possibility of a loop in your topology?

its not a broadcast storm, for some reason multicast packet are being fragmented (according to the wireshark and my screen shot that i provided). And transmitted to every destination port. Like there is no igmp at that moment.

and no there are no loops , that would be the first thing that will come up in the logs. Even if i shutdown every vlan 406 port on 2nd and 3rd switch this is still hapenning. So basically its hapenning on L2, and i m pulling my hair as to why.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers