IGMP - Internet Group Management Protocol

hey everyone now in this video i'm going to demonstrate how igmp works okay and igmp is used on a network that has multicast going through it if you want to do it properly i've seen people get scared of using igmp and they just turn it off altogether and then everything runs as a broadcast now obviously that's fundamentally bad because you want to avoid broadcast on a network generally so you know i'll show how to use igmp given some equipment here and i'll use my raspberry pi multicast tv server as the multicast source and demonstrate how it works okay first of all i'll go through what i've got on the bench this is the main switch that i'll be using this hp switch here and what i've got going in is the red one is the multicast source okay that goes off to the raspberry pi this cream beige colored one here just goes to my network so i can connect to it and gives it its gateway and provides dhcp for a few things and i've got a couple of things plugged in so i've got this macbook plugged in here on one of the ports and this port i've got going through to a dump switch and then it goes to an access point and also a wired host over here okay so that's the setup there now if i have a look at the config on the switch it's really basic all i've got is an ip address for that vlan 1 and a gateway for it there's no igmp running at the moment and there's also no tv server running at the moment so what you can see on the switch ports is just a bit of background traffic nothing special okay it's mostly from the aruba ap over there looking for other aps so you can see there's no real traffic going on there and the packet capture shows that too so i'm just doing a packet capture of this port so now what i'll do is i'll go to the raspberry pi and i'll start streaming some tv and if you noticed on the switch these lights just became solidly on then okay that means there's data going through those ports and if you look at the packet capture you can see it's just been swamped with all that tv traffic okay you can see the multicast destination address which is what i just started two three nine one one one one okay the thing is no one asked for it okay like if i start that on vlc here sure you can get it okay there it is we've got data coming in and that'll work fine but if no one's watching it it's flooding the whole network so obviously that's bad now i'll leave that multicast source running but back on the switch what i'll do is i'll go into the vlan and i'll just put ipigmp on now if i come over to this laptop you can see obviously there's no traffic going through at the moment other than the multicast coming in on this port but if i start that stream again on vlc here what happens well the switch starts forwarding the frames through that port and they go off to the host here and we see the video now if i stop that and i'll stop the capture as well what happened was all that traffic was coming in here and down here we got this igmp message that said leave the group okay so it's leaving that 2391101 which is the tv source and accordingly the port stopped forwarding the traffic okay so we're back to back to good now if i start that again i'll just start that okay now if i jump back on the switch and do uh show ip igmp groups you'll see as our multicast address that we're interested in here and we see we've got this uptime but we've also got this expires okay it expires in 37 seconds okay so it's still going now obviously but what that means is this switch hasn't seen any new igmp messages so it can't be sure if that's dropped off for some reason and just missed the igmp leave so what it's going to do in 22 seconds that's gonna that's going to expire and that'll stop the multicast uh forwarding through that port so just i'm gonna educate here for 12 seconds i know that that video will freeze once this countdown gets to zero so five four three something like that and any moment now there it is okay so what's happened there is the switch has stopped forwarding those multicast frames through and the reason is because it was looking for igmp messages saying that someone still wants it there weren't any so we just turned that off so how can we get around that well what we can do if i show the running again as soon as i put that i i put igmp on before i had the no querier at the moment okay with a query interval of 30. now for the purpose of this i'm going to say ip igmp queria okay so there it is now and uh the interval's 30 just for this demonstration i'm going to make that a bit smaller so i'm going to go ip igmp queria interval 10 okay so that's how it looks at the moment so if i have a look over here now on the captcha i'm just going to do a new capture and i'm just going to filter it just for igmp so we don't get swamped down with all the other traffic in there okay i'll stop him now that stop message will come through keep it fresh i'll start again so right now i've got nothing running nothing's being forwarded out here and if i show ipi gmp groups uh well we don't have anything okay so now what i'm going to do is i'm going to start this traffic now that started obviously and what happened that in the background here we saw this message it said i'd pi it's joy what happened here is we saw this message it said igmp and we're joining that group but you'll see this now query okay what that what happened there was that was the switch this zero 250 address that's the switch sending out a general query saying who wants what and this laptop will again say hey i want it two three nine one one one one that's the one i'm using and again this is like all the time you wouldn't really need it this often but that's what's going on it's the switch is constantly querying who wants what so that forces these igmp messages to come through okay so it knows that thing wants it so if i come back over here show igmp grooves this thing that supposedly expires in 20 seconds never will so i'll do it again ooh 14 12 or not looking good back to 28 okay it'll never expire because we have the ip igmp queria now that's all good and well but in this world we use wireless mainly so a number of new things have to come into consideration here mainly because clients on a wireless network could be anywhere they could have any speed connection to the ap depending on where they are but you've got a multicast source that might have to go to multiple clients so how does that work well i'll show you and also show you some of the rf side as well okay so here i've got a laptop on the wireless side and i've actually reduced the functionality of that ap because it would normally prevent this but just to show you what would happen with a simple ap if i start the stream on here here's what goes on that sent an igmp message through the ap and of course the switch is forwarding it now if i do the show ipi gmp group on the access point again we can see it because it's right there okay but what you'll notice on here is it might seem to be working but you'll probably see some glitches come through okay you may have yeah you might have just seen some there there glitches the data's not good what's happening well if we have a do a bit of a packet capture here on the wireless side what we'll see is the raspberry pi source obviously but the destination is a multicast mac address and look at the rate it's 12 megabits a second okay that's the multicast rate of this network and if we have a look up on the spectrum display you can see yeah i'm using channel 36 as the primary one but see how it's swamping it there okay now what that means is i'm sending this out at 12 meg and i'm also just using one of the channels instead of the 40 as well which is a bonded 40 meg pair here but what that also means is because this destination is multicast and not the mac address of this a this laptop here these frames are not acknowledged okay they just go out and hope for the best and that's the reason they go low they go 12 meg in the hope that the client will get them and that's it but the thing is there's always going to be collisions of some sort and you will get errors like that in the actual traffic okay and it uses up a lot of rf time okay so if i stop that okay that'll stop forwarding through from the switch which is lucky so the the ap will stop transmitting that and that should should clean up there a bit but what we do in the config for the ap is set this broadcast filtering back to up which is what its default is anyway and put a bit of optimization on for multicast and when you do all that okay just come back to here okay so this is the ap again if i join that group again on this laptop traffic will come in but you'll notice immediately on the rf we're using 40 meg channels now okay we're using 36 and 40. and if i have a look at the data coming in what you'll see now you won't see the acknowledgement because it's the laptop doing the capture but their acknowledgment's there now so what's happening is the data is coming in but look at the destination address it's actually this apple rather than a multicast address okay and the rate that it's coming in at now is 450 megabits a second which is very different to before okay so these frames are acknowledged then look at this we've got rts is going on here it's sending the data it's making sure it's there okay and because of that we don't get glitches anymore okay the data's guaranteed to get there to a degree and what that means on the rf side is we're staying in the air less time so we're using less of the rf now you might see okay you're using channel 36 and 40 before it only had 36 but the amount of time this was on in 36 was a lot more you can see it's redder there than it is up here so these frames they're getting on using 40 meg being really quick and then they're getting off the the air okay so someone else can use it so even if you think your application you've got data for it you've still got to share this rf space with everyone around your own ssids that you might have or someone else's so you want to be on the air and off as quick as you can okay so going back to igmp for a minute what i've got here is a couple of laptops but this one is connected through the cable to this switch here which is just a dumb switch okay it doesn't know anything about anything and this laptop over here goes wirelessly to the ap and then it's wired into this same dumb switch now that switch to get the traffic in the first place is connected through this cable here into this port right here okay so what i'm saying is from this switch's point of view it has two clients down there although it only sees one port that it's got to forward traffic to so what i'll do now is i'll set up this uh port over here that this laptop's in to be a port mirror of this one so we can see what's going through this port okay so i want to mirror traffic from 13 onto port 7. i'll go back to the old uh switch there and i'll go mirror port is which one seven okay that's what i'm going to put it out to then i'm going to go to interface 13 which is the one i want to see and monitor that okay now on the laptop i'll just disable its its own network stuff because i'm just going to use this to monitor now so i'll do that turn ethernet off which still actually has it on believe it or not so so now i'll just restart all that so now what i'm capturing on this port to this laptop here is actually what's going through this port so i can see what's going on and as you can see this igmp message is bouncing all around the place okay what i'm going to do now is i'm going to stop the wireless one okay and if i have a look on the capture here which i'll just stop and show you what's going on you can see what happened now earlier as i'm pointed out we have this membership query general that's just from the switch to everyone saying who wants what basically and they'll all report in on what they want now when i left on that laptop the laptop sent this leave group okay it said i don't want to be part of that group anymore and it left now immediately after that the switch sent out a query that's specific for that group basically saying does anyone still want that traffic now the reason it would do that is because this port on the switch here is actually serving multiple clients okay it doesn't know there's a switch downstream here or or whatever's going on so the leave message came in from one of these which would be via the ap for the wireless client and reach the switch here with what we saw but what it was asking there by saying membership query specific it's saying does anyone else want this traffic down on this port and when it send it out it got to this laptop and said oh yeah i still want it so it came back so that's why you have an igmp query on your network so if it sees something like a leave message it doesn't just say okay i heard the leave message coming in this port i'm going to stop porting out this port now okay that would have killed the other client okay so it's just a way of managing it and keeping everything up to date on who's joining what group okay so that's basically how igmp works as you know broadcasts on a wide network are bad but they're even worse on a wireless network and if you don't have igmp set up properly you're basically dealing with broadcasts okay now you might not really care about that so much if you say your application might not have stuff like video it might just be a low bit rate sort of application but it doesn't matter because once you hit wireless you're sharing that with everyone and while those data rates are low if you're using multicast destination in the air you're using more air time than you really need to do okay so a bit of planning avoids a lot of problems so don't be scared of igmp it's there for a reason and if you're using multicast you should set igmp up properly and you won't have any worries and it works quite well obviously that's why they came up with it in the first place so i'll leave that there and until next time take it easy [Music]

Channel: Tall Paul Tech

Views: 16,006

Rating: 4.9499998 out of 5

Keywords: IGMP, Multicast, Wi-Fi, Internet Group Management Protocol, igmp group, Spectrum, Spectrum analysis, Macbook, VLC

Id: MaTkt-wNHRg

Length: 14min 33sec (873 seconds)

Published: Wed Aug 12 2020