IGMP — Internet Group Management Protocol

Why it exists

A router on a LAN cannot guess which hosts want a multicast stream. Without a membership protocol it would have to flood every group to every port, or refuse to deliver any of them.

IGMP is the last-hop conversation: hosts report membership, routers query to keep it fresh. Getting the traffic to that router is PIM’s job. IGMP working perfectly with no multicast routing delivers nothing.

A host joins, and the switch notices

A receiver sends an unsolicited report. The querier records membership, and a snooping switch installs the port in the group’s forwarding set instead of flooding the VLAN.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
Receiver	host	Wants: 239.1.1.1
SW1 · snooping	switch	—
R1 · querier	router	—
Uninterested host	host	—
Receiver — SW1 · snooping	link	up
SW1 · snooping — R1 · querier	link	up
SW1 · snooping — Uninterested host	link	up

1 / 4

The receiver wants 239.1.1.1. Nothing on the segment knows that yet — without a report, the switch would treat the group as broadcast.

What changed

Receiver: Wants → 239.1.1.1
Emphasis on Receiver

How it works

Version 2 is join, leave, and a querier election by lowest IP. Version 3 adds source filtering — INCLUDE and EXCLUDE lists — which is what makes source-specific multicast expressible at all.

The querier periodically asks who still wants each group. Hosts answer with current-state records. A change of interest is sent immediately as an unsolicited report rather than waiting for the next query.

Snooping is a switch behaviour, not a host protocol. The switch overhears reports and queries, builds a forwarding set per group, and floods only to interested ports plus the multicast router port. Without a querier that table empties.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

IPv4: Protocol 2 (IGMP). Reports are sent to 224.0.0.22 with a Router Alert option so every router on the segment processes them. RFC 3376
IGMPv3 Membership Report: Type 0x22, checksum, and a list of group records. RFC 3376

Configure it

```
ip multicast-routing distributed
```
Required if this router will also run PIM. IGMP alone does not forward between subnets.
```
interface Vlan10
 ip address 192.0.2.1 255.255.255.0
 ip pim sparse-mode
 ip igmp version 3
```
Version 3 is what lets hosts send INCLUDE lists. Sparse mode is the usual partner when PIM is also enabled on the interface.
Common mistake: Leaving the interface on version 2 and expecting SSM to work. A v2 report names no source.
RFC 3376 §4.2
```
ip igmp snooping
ip igmp snooping vlan 10
```
Constrains flooding to ports that reported. Without a querier on the VLAN this table ages out and flooding returns.
RFC 4541 §2.1
```
ip igmp snooping querier
ip igmp snooping vlan 10 querier
```
Needed on a layer-2-only segment with no multicast router. The switch becomes the querier so reports keep arriving.
RFC 4541 §2.2

Verify

show ip igmp groups: Groups this router believes have members.
show ip igmp interface Vlan10: Version 3 and querier status.
show ip igmp snooping groups vlan 10: Ports installed from reports, plus the mrouter port.

Caveats

One v2 host on the VLAN can force compatibility mode for a group and break source-specific joins for everyone.
Fast leave is safe only on ports with a single receiver.

When it breaks

Symptom first, because that is what you have when it happens.

Multicast floods to every port in the VLAN instead of only to the ports that asked for it.
Narrow it down
1. Check whether snooping is enabled on that VLAN.
2. Confirm a querier exists — snooping needs one to keep membership fresh.
3. Look for the multicast router port being learned correctly.
Cause
Snooping builds its table from reports, and reports are only sent in response to queries. With no querier on the segment, membership ages out, the switch has nothing to constrain flooding with, and falls back to treating multicast as broadcast.
Fix
Enable a querier on the VLAN. A layer-2-only segment with no router still needs one, which is why switches implement it.
A receiver leaves a group and traffic keeps arriving for several seconds.
Narrow it down
1. Check whether fast leave is configured on the port.
2. Count how many receivers are on that port.
3. Look at the group-specific query and its response interval.
Cause
On a leave, the switch queries the group to see whether anyone else still wants it, and waits for the response interval before pruning. That delay is deliberate — pruning immediately would cut off other receivers on the same port.
Fix
Enable fast leave only where a port has exactly one receiver. On a port with several it does exactly what the delay exists to prevent.
Some receivers get the stream and others on the same VLAN do not, with identical configuration.
Narrow it down
1. Compare the IGMP version each host is using.
2. Check whether any host is forcing the segment to a lower version.
3. Look at whether the group is source-specific.
Cause
Version interoperability. One host speaking version 2 makes the querier fall back for the whole group, and source-specific joins that need version 3 stop working for everyone.
Fix
Find the host holding the version down. Pinning the querier version does not help — the fallback exists so older hosts are not cut off.
Receivers on one switch get the stream and receivers on another do not, even though both reported.
Narrow it down
1. Check which ports the switch has learned as multicast router ports.
2. Confirm PIM is enabled on the uplink the querier actually uses.
3. Look for a topology change that moved the querier without updating snooping.
Cause
Snooping forwards group traffic toward multicast router ports as well as toward interested hosts. A missing or stale mrouter port blackholes traffic that should leave the VLAN toward the router.
Fix
Restore the querier adjacency and clear stale snooping state so the mrouter port is relearned from queries.
An application in the SSM range never receives traffic; IGMP counters look healthy.
Narrow it down
1. Check whether the host sent an INCLUDE list with a source.
2. Confirm the report was version 3, not version 2.
3. Look for an empty mroute table on the last-hop router.
Cause
A v2 report names only the group. In the SSM range there is no shared tree and no RP, so the router has no source to join toward.
Fix
Move the host to IGMPv3, or use SSM mapping as a temporary translation table and accept that you now maintain the source list by hand.

Design notes

One older host on a segment makes the querier fall back for that group. Source-specific joins that need version 3 then fail for everyone, with no error on the v3 hosts.

Fast leave skips the group-specific query that checks for other receivers on the same port. It is safe where a port has exactly one receiver and harmful where it has several.

Misconceptions

“IGMP routes multicast.”: It signals membership between a host and its local router. Getting the traffic to that router is PIM’s job. A working IGMP setup with no multicast routing delivers nothing.
“Snooping is a router feature.”: It is a switch feature, and it works by inspecting messages that are not addressed to it. That is also why it needs a querier: without the queries it is meant to overhear, its table empties.
“IGMPv3 is just version 2 with more messages.”: It adds source filtering, which is what makes source-specific multicast possible — a receiver asks for a group from a named source and no rendezvous point is needed at all.

More walkthroughs

Leave without a querierfailure

A receiver leaves, but with no querier on the VLAN the snooping switch cannot refresh membership. State ages out and the group floods again — or never prunes cleanly.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
Receiver leaving	host	Wants: nothing
SW1 · snooping, no querier	switch	—
Other ports	host	—
Receiver leaving — SW1 · snooping, no querier	link	up
SW1 · snooping, no querier — Other ports	link	up

1 / 3

The host leaves 239.1.1.1. In v3 that is a CHANGE_TO_INCLUDE with an empty source list; in v2 it is a Leave Group message to the group address.

What changed

Leave: Receiver leaving → SW1 · snooping, no querier
Receiver leaving: Wants → nothing

Naming the sourcecomparison

IGMPv3 INCLUDE lists let a receiver ask for one source on a group. That is what SSM needs — and what a single v2 host on the segment silently disables for everyone.

Link
Blocking
Packet in flight
Discarded
Emphasis

Select a device to read its state. Arrow keys walk the topology.

Text equivalent of this diagram

Devices and links at this step
Element	Kind	State
v3 receiver	host	Report: INCLUDE 198.51.100.7
v2 receiver	host	—
SW1	switch	—
R1 · querier	router	—
v3 receiver — SW1	link	up
v2 receiver — SW1	link	up
SW1 — R1 · querier	link	up

1 / 3

The v3 host asks for (198.51.100.7, 232.1.1.1) with an INCLUDE list. The report names the source; the group address alone is not the channel.

What changed

INCLUDE: v3 receiver → R1 · querier
v3 receiver: Report → INCLUDE 198.51.100.7

Terms

RPF check: Forward a multicast datagram only if it arrived on the reverse-path interface toward the source (or the RP for (*,G)). Any other interface is an RPF failure.
IGMPv3 INCLUDE list: The membership report that names which sources a receiver wants. It is what makes SSM expressible; IGMPv2 has no field for a source, so a v2 report in the SSM range does nothing.

Check yourself

Multicast floods the whole VLAN despite snooping being enabled. What is missing?
Why does a switch wait before pruning after a leave?
What does IGMP do?
What does IGMPv3 add that makes source-specific multicast possible?
How is the IGMP querier chosen on a multi-router LAN?
A single IGMPv2 host joins a group used by v3 INCLUDE receivers. What happens?
What does an IGMP snooping switch do with a Membership Report?
How does an IGMPv3 host leave a group?

Why it exists

A host joins, and the switch notices

How it works

On the wire

Configure it

Verify

Caveats

When it breaks

Multicast floods to every port in the VLAN instead of only to the ports that asked for it.

Narrow it down

Cause

Fix

A receiver leaves a group and traffic keeps arriving for several seconds.

Narrow it down

Cause

Fix

Some receivers get the stream and others on the same VLAN do not, with identical configuration.

Narrow it down

Cause

Fix

Receivers on one switch get the stream and receivers on another do not, even though both reported.

Narrow it down

Cause

Fix

An application in the SSM range never receives traffic; IGMP counters look healthy.

Narrow it down

Cause

Fix

Design notes

Misconceptions

More walkthroughs

Leave without a querierfailure

Naming the sourcecomparison

Terms

Check yourself

Related

PIM-SM

SSM