cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
852
Views
0
Helpful
1
Replies

Why am I receiving EIGRP multicast?

Grant Curell
Level 1
Level 1

I have a home network with the attached network topology. I was running wireshark on HusbandCom (you'll have to forgive my wife and I's silly nicknames) and I noticed that I was receiving EIGRP multicast on it (wireshark screenshot attached). The question is why? Shouldn't multicast only be sent to those machines who have asked for it? I'll say up front that my knowledge of multicast is limited.

1 Accepted Solution

Accepted Solutions

Jon Marshall
Hall of Fame
Hall of Fame

Grant

EIGRP multicasts will be flooded to all ports within that vlan. They are a well known 224.0.0.10 address so they only stay within the local subnet ie. they are not routed.

Basically if you have an interface on a router eg. 192.168.5.1 255.255.255.0  and you enter this in your config -

router eigrp 10

network 192.168.5.0 255.255.255.0

then EIGRP starts up on that interface and begins sending out multicasts on that interface. It does this to find any other EIGRP speaking router(s) on the 192.168.5.0/24 subnet.

So if you had a server in the 192.168.5.0/24 subnet (think vlan) as well then it will receive those multicasts. A switch that is not setup with IGMP snooping and an IGMP querier treats multicast as broadcasts. You can setup IGMP snooping and have either a PIM enabled interface or if you do not want to route multicast traffic use the IGMP snooping querier function (if supported by the switch).

But from memory even if you do the above it does not filter 224.0.0.x addresses. They are treated differently from other multicast group addresses.

What you can do is one of two things -

1) the most obvious one is if you do not need EIGRP on the 192.168.5.0/24 network then don't have an entry for under the EIGRP configuration on your router

2) you could use a port acl on the switch interface connecting to your server. The main issue here is that a lot of switches do not allow an acl on a physical interface to be applied outbound ie you can only apply them inbound. (Some of the larger switches do support them in the outbound direction).

Jon

View solution in original post

1 Reply 1

Jon Marshall
Hall of Fame
Hall of Fame

Grant

EIGRP multicasts will be flooded to all ports within that vlan. They are a well known 224.0.0.10 address so they only stay within the local subnet ie. they are not routed.

Basically if you have an interface on a router eg. 192.168.5.1 255.255.255.0  and you enter this in your config -

router eigrp 10

network 192.168.5.0 255.255.255.0

then EIGRP starts up on that interface and begins sending out multicasts on that interface. It does this to find any other EIGRP speaking router(s) on the 192.168.5.0/24 subnet.

So if you had a server in the 192.168.5.0/24 subnet (think vlan) as well then it will receive those multicasts. A switch that is not setup with IGMP snooping and an IGMP querier treats multicast as broadcasts. You can setup IGMP snooping and have either a PIM enabled interface or if you do not want to route multicast traffic use the IGMP snooping querier function (if supported by the switch).

But from memory even if you do the above it does not filter 224.0.0.x addresses. They are treated differently from other multicast group addresses.

What you can do is one of two things -

1) the most obvious one is if you do not need EIGRP on the 192.168.5.0/24 network then don't have an entry for under the EIGRP configuration on your router

2) you could use a port acl on the switch interface connecting to your server. The main issue here is that a lot of switches do not allow an acl on a physical interface to be applied outbound ie you can only apply them inbound. (Some of the larger switches do support them in the outbound direction).

Jon

Review Cisco Networking for a $25 gift card