IGMP Snooping & L2 Multicast

The Multicast-to-Broadcast Fallacy

By default, an Ethernet switch is entirely unaware of IP Multicast groups. When a multicast frame arrives with a destination MAC address not present in the CAM (Content Addressable Memory) table, the switch follows standard unknown-unicast/multicast behavior: it floods the frame out of every port in the VLAN except the ingress port. In a 48-port access switch, one multicast stream floods 47 ports with unwanted traffic.

For a single 100 Mbps video stream, this means 47 endpoints — servers, printers, VoIP phones, workstations — receive a stream none of them requested, consuming CPU cycles for packet processing and injecting noise onto every link. Scale this to 20 multicast streams in a broadcast domain, and available bandwidth collapses for every host on the VLAN.

How IGMP Snooping Intervenes

IGMP Snooping allows the Layer 2 switch to examine (snoop) IGMP control messages exchanged between hosts and routers — without being a Layer 3 device itself. When the switch detects an IGMP Membership Report (Join) on a port, it records the port number and multicast group address in its Layer 2 Multicast Table (separate from the standard MAC address table).

From this point, traffic for that multicast group is forwarded only to ports with active memberships plus the configured MRouter port. Ports with no active members receive nothing — no wasted bandwidth, no phantom CPU load on end hosts. This is the definition of Layer 2 Multicast Pruning.

The Querier Mechanism: Keeping Membership Fresh

Membership tables would become stale if hosts leave groups without announcing it (e.g., power-off). IGMP defines a Querier role — typically the Layer 3 gateway — that periodically sends General Query messages to the all-hosts multicast address (224.0.0.1). Hosts with active group memberships must respond with Membership Reports within the Query Response Interval (default: 10 seconds).

If a host fails to respond to a General Query (or multiple queries), the switch removes its port from the membership entry. If no hosts respond for a group at all, the group entry is deleted entirely, stopping forwarding on that stream completely.

• Query Interval: Default 125 seconds between General Queries.
• Query Response Interval: 10 seconds — the window for hosts to respond.
• Group Membership Timeout: Typically (Robustness Variable × Query Interval) + Query Response Interval ≈ 260 seconds.

IGMPv2 vs. IGMPv3: Source-Specific Multicast

IGMP has evolved through three versions, each adding precision to group membership management:

• IGMPv1: Basic join/leave. No explicit Leave message — groups expire via timeout only. Slow convergence.
• IGMPv2: Introduces the explicit Leave Group message, triggering a Group-Specific Query before removing the entry. Enables Fast-Leave processing on ports with a single receiver, dramatically reducing channel-change latency for IPTV.
• IGMPv3: Adds Source-Specific Multicast (SSM). Instead of joining a group ($*,G$), hosts can request traffic from a specific sender ($S,G$). This allows a network to enforce that a receiver only accepts video from the authorized encoder, blocking any rogue source injecting content into the same group address.

CPU Exhaustion: The Control Plane Cost

IGMP Snooping has a hidden cost: IGMP Join, Leave, and Query packets are exception traffic — packets that cannot be handled by hardware ASICs and must be forwarded to the switch CPU for processing. In large VLANs with hundreds of active multicast groups and frequent leave/join cycling (e.g., IPTV channel zapping), this can generate thousands of IGMP messages per second, causing Control Plane Exhaustion.

Mitigation strategies include:

• IGMP Rate Limiting: Apply a CoPP (Control Plane Policing) policy specifically for IGMP traffic to cap the CPU-bound exception rate.
• IGMP Join Suppression: In environments with many receivers per group, suppress redundant Join messages to prevent CPU spikes when all receivers respond to a General Query simultaneously.
• VLAN Segmentation: Limit multicast group density per VLAN to reduce the per-VLAN IGMP table size and associated CPU overhead.

MLD Snooping: The IPv6 Equivalent

IPv6 replaces IGMP with MLD (Multicast Listener Discovery), defined in RFC 2710 (MLDv1) and RFC 3810 (MLDv2). MLD Snooping on a Layer 2 switch performs the same function — pruning multicast distribution based on listener reports — but operates on ICMPv6 messages (type 130-132 for MLDv1, type 143 for MLDv2). In dual-stack networks, both IGMP Snooping (IPv4 multicast) and MLD Snooping (IPv6 multicast) must be enabled and configured independently. Many switch platforms enable IGMP Snooping by default but leave MLD Snooping disabled, causing IPv6 multicast to flood as broadcast while IPv4 multicast is correctly pruned.