RFC 3376
Internet Group Management Protocol, Version 3
RFC 3376: Internet Group Management Protocol, Version 3 🎀
okay bestie, RFC 3376 is IGMPv3 🦋 and it dropped in October 2002. It's on the Standards Track, and it obsoletes RFC 2236 (that's IGMPv2), so this is the one that replaces it. Nothing in the header says it updates another RFC.
The authors are B. Cain from Cereva Networks, S. Deering, I. Kouvelas from Cisco Systems, B. Fenner from AT&T Labs - Research, and A. Thyagarajan from Ericsson. The header doesn't list an affiliation for S. Deering, so I'm not guessing one 🙈
Also, it's from the Network Working Group, so this is a real internet standard, not a random blog post 💅
Status of this Memo 📋
okay so this bit is the official vibe check ✨ This document specifies an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements. For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). And distribution of this memo is unlimited 🌸
Copyright Notice 🔒
Copyright (C) The Internet Society (2002). All Rights Reserved. Very legal, very official 💜
Abstract 🦋
so IGMPv3 is Version 3 of the Internet Group Management Protocol. IGMP is what IPv4 systems use to tell their neighboring multicast routers which IP multicast groups they belong to 💖
the big new thing in v3 is "source filtering" 😭 it lets a system say it wants packets only from specific source addresses, or from all but specific source addresses, sent to a particular multicast address. Multicast routing protocols can use that info so they don't deliver multicast packets from certain sources to networks where nobody is listening. Main character energy for routers 👑
This document obsoletes RFC 2236.
Table of Contents 🗂️
1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . . 2
2. The Service Interface for Requesting IP Multicast Reception . 3
3. Multicast Reception State Maintained by Systems . . . . . . . 5
4. Message Formats . . . . . . . . . . . . . . . . . . . . . . . 7
5. Description of the Protocol for Group Members . . . . . . . . 19
6. Description of the Protocol for Multicast Routers . . . . . . 24
7. Interoperation with Older Versions of IGMP. . . . . . . . . . 35
8. List of Timers, Counters, and Their Default Values. . . . . . 40
9. Security Considerations . . . . . . . . . . . . . . . . . . . 43
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 47
11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 47
12. Normative References. . . . . . . . . . . . . . . . . . . . . 47
13. Informative References. . . . . . . . . . . . . . . . . . . . 47
Appendix A. Design Rationale. . . . . . . . . . . . . . . . . 49
Appendix B. Summary of changes from IGMPv2. . . . . . . . . . 50
Authors' Addresses. . . . . . . . . . . . . . . . . . . . . . 52
Full Copyright Statement. . . . . . . . . . . . . . . . . . . 531. Introduction 🌈
okay so IGMP is used by IPv4 systems (hosts and routers) to report their IP multicast group memberships to any neighboring multicast routers 🧚 Also, a multicast router can be a member of one or more multicast groups itself. When that happens, it does both the "multicast router part" of the protocol (collecting the membership info its multicast routing protocol needs) and the "group member part" (telling itself and other neighboring multicast routers about its memberships). It's giving multitasking 💅
IGMP also handles other IP multicast management stuff, using message types that aren't for group membership reporting. This document is only about the group membership reporting functions and messages, so that's the tea ☕
This document specifies Version 3 of IGMP 💖 Version 1, from [RFC-1112], was the first widely-deployed version and the first one to become an Internet Standard. Version 2, from [RFC-2236], added "low leave latency", which means it got faster at letting a multicast router learn that nobody in a group is left on an attached network 😭 Version 3 adds "source filtering", which is the ability for a system to say it only wants packets from specific source addresses (like what [SSM] calls Source-Specific Multicast), or from all but specific source addresses, sent to a particular multicast address. And v3 is designed to be interoperable with Versions 1 and 2 🫶
Multicast Listener Discovery (MLD) does a similar job for IPv6 systems. MLD version 1 [MLD] does what IGMP version 2 does, and MLD version 2 [MLDv2] does what IGMP version 3 does 🔥
The capitalized key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC-2119]. Since there's no italics here, emphasis is shown by wrapping a word or phrase in "" characters, so you'll see things like *only and all but 🙈
2. The Service Interface for Requesting IP Multicast Reception 🎀
okay, inside an IP system there's (at least conceptually) a service interface that upper-layer protocols or application programs use to ask the IP layer to turn reception of packets sent to specific IP multicast addresses on or off. To fully use what IGMPv3 can do, a system's IP service interface must support this operation, which is literally the main character of this whole section 👑
IPMulticastListen ( socket, interface, multicast-address,
filter-mode, source-list )Here's what each parameter does:
- socket is an implementation-specific parameter that tells apart the different requesting entities (like programs or processes) inside the system. The socket parameter of BSD Unix system calls is a specific example 🧚
- interface is a local identifier of the network interface where reception of the specified multicast address gets turned on or off. Interfaces can be physical (like an Ethernet interface) or virtual (like the endpoint of a Frame Relay virtual circuit or the endpoint of an IP-in-IP "tunnel"). An implementation may allow a special "unspecified" value to be passed as the interface parameter. In that case the request applies to the "primary" or "default" interface of the system, which might be set up by system configuration. If you want reception of the same multicast address on more than one interface, IPMulticastListen gets invoked separately for each interface you want 💅
- multicast-address is the IP multicast address, or group, the request is about. If you want more than one multicast address on a given interface, IPMulticastListen gets invoked separately for each address 🌸
- filter-mode can be either INCLUDE or EXCLUDE 😭 In INCLUDE mode, reception of packets sent to the specified multicast address is requested only from the IP source addresses listed in the source-list parameter. In EXCLUDE mode, reception is requested from all IP source addresses except the ones listed in the source-list parameter. Opposite vibes, same vibe check 🙈
- source-list is an unordered list of zero or more IP unicast addresses from which multicast reception is desired or not desired, depending on the filter mode. An implementation MAY impose a limit on the size of source lists, but that limit MUST NOT be less than 64 addresses per list. When an operation makes the source list size limit get exceeded, the service interface MUST return an error. No going over the limit, periodt 💀
For a given combination of socket, interface, and multicast address, only a single filter mode and source list can be in effect at any one time. But either the filter mode or the source list (or both) can be changed by later IPMulticastListen requests that specify the same socket, interface, and multicast address. Each later request completely replaces any earlier request for that socket, interface, and multicast address. Clean slate, no drama 🧼
Older versions of IGMP didn't support source filters and had a simpler service interface with Join and Leave operations. Those turned reception of a given multicast address (from all sources) on or off for a given interface. Here's how the equivalent operations look in the new service interface 🦋
The Join operation is equivalent to:
IPMulticastListen ( socket, interface, multicast-address,
EXCLUDE, {} )and the Leave operation is equivalent to:
IPMulticastListen ( socket, interface, multicast-address,
INCLUDE, {} )where {} is an empty source list 🌈
An example of an API that provides the capabilities in this service interface is in [FILTER-API] ✨
3. Multicast Reception State Maintained by Systems 🧚
3.1. Socket State 💖
For each socket where IPMulticastListen has been invoked, the system records the desired multicast reception state for that socket. Conceptually, that state is a set of records of this form:
(interface, multicast-address, filter-mode, source-list)The socket state changes every time IPMulticastListen gets invoked on the socket, like this:
- If the requested filter mode is INCLUDE and the requested source list is empty, then the entry for the requested interface and multicast address gets deleted, if it's there. If there's no such entry, the request is ignored 🗑️
- If the requested filter mode is EXCLUDE or the requested source list is non-empty, then the entry for the requested interface and multicast address, if it's there, gets changed to hold the requested filter mode and source list. If there's no such entry, a new one gets created using the parameters from the request ✨
3.2. Interface State
Okay so, on top of the per-socket multicast reception state, a system also has to keep track of (or work out) multicast reception state for each of its interfaces. Conceptually, that's a bunch of records shaped like this:
(multicast-address, filter-mode, source-list)There's at most one record per multicast-address for a given interface, so no doubles, bestie 🫶. This per-interface state is derived from the per-socket state, but it can look different when different sockets have different filter modes and/or source lists for the same multicast address and interface. Here's an example. Say one app or process runs this on socket s1:
IPMulticastListen ( s1, i, m, INCLUDE, {a, b, c} )That's asking for packets sent to multicast address m on interface i, only if they come from source a, b, or c. Then another app or process runs this on socket s2:
IPMulticastListen ( s2, i, m, INCLUDE, {b, c, d} )That's asking for the same interface i and the same multicast address m, only from sources b, c, or d. To make both sockets happy, interface i has to receive packets sent to m from any one of a, b, c, or d. So in this example, the interface i reception state for multicast address m ends up as filter mode INCLUDE with source list {a, b, c, d}. Iconic teamwork 💅✨
After the IP layer accepts a multicast packet from an interface, delivering it to the app or process listening on a particular socket depends on that socket's multicast reception state 🦋 [and possibly also on other conditions, such as what transport-layer port the socket is bound to]. So in the example above, if a packet shows up on interface i, destined to multicast address m, with source address a, it gets delivered on socket s1 but not on socket s2. Also, IGMP Queries and Reports are not subject to source filtering and must always be processed by hosts and routers, no exceptions 🙈
Filtering based on a socket's multicast reception state is a brand-new feature of this service interface. The previous service interface [RFC1112] had no filtering based on multicast join state at all. A join on a socket just made the host join a group on the given interface, and packets for that group could be delivered to every socket whether it had joined or not. Main character energy for the new version 👑
Now, the general rules for deriving per-interface state from per-socket state go like this. For each distinct (interface, multicast-address) pair that shows up in any socket state, a per-interface record gets created for that multicast address on that interface. Then you look at all the socket records containing that same (interface, multicast-address) pair:
- If any such record has a filter mode of EXCLUDE, then the interface record's filter mode is EXCLUDE, and its source list is the intersection of the source lists of all socket records in EXCLUDE mode, minus any source addresses that appear in any socket record in INCLUDE mode. For example, if the socket records for multicast address m on interface i are:
from socket s1: ( i, m, EXCLUDE, {a, b, c, d} )
from socket s2: ( i, m, EXCLUDE, {b, c, d, e} )
from socket s3: ( i, m, INCLUDE, {d, e, f} )then the corresponding interface record on interface i is:
( m, EXCLUDE, {b, c} )If a fourth socket gets added, like this:
from socket s4: ( i, m, EXCLUDE, {} )then the interface record becomes:
( m, EXCLUDE, {} )- If all such records have a filter mode of INCLUDE, then the interface record's filter mode is INCLUDE, and its source list is the union of the source lists of all the socket records. For example, if the socket records for multicast address m on interface i are:
from socket s1: ( i, m, INCLUDE, {a, b, c} )
from socket s2: ( i, m, INCLUDE, {b, c, d} )
from socket s3: ( i, m, INCLUDE, {e, f} )then the corresponding interface record on interface i is:
( m, INCLUDE, {a, b, c, d, e, f} )An implementation MUST NOT use an EXCLUDE interface record to represent a group when all sockets for this group are in INCLUDE state. That's a hard no 🚫. And if system resource limits get hit while an interface state source list is being calculated, an error MUST be returned to the application that requested the operation, so the app isn't left hanging 💀
The rules above for deriving interface state get (re-)evaluated whenever an IPMulticastListen invocation changes the socket state by adding, deleting, or modifying a per-socket state record. Just keep in mind that a change in socket state doesn't necessarily mean the interface state changes too 🌸
4. Message Formats
4. Message Formats ✨
IGMP messages are wrapped up in IPv4 datagrams, with an IP protocol number of 2. Every IGMP message described in this document gets sent with an IP Time-to-Live of 1, IP Precedence of Internetwork Control (e.g., Type of Service 0xc0), and carries an IP Router Alert option [RFC-2113] in its IP header. IGMP message types are registered by the IANA [IANA-REG] as described by [RFC-3228] 🧚
There are two IGMP message types that matter for the IGMPv3 protocol described in this document:
Type Number (hex) Message Name
----------------- ------------
0x11 Membership Query
0x22 Version 3 Membership ReportAn implementation of IGMPv3 MUST also support the following three message types, so it can interoperate with previous versions of IGMP (see section 7). This part is non-negotiable, periodt 💅
0x12 Version 1 Membership Report [RFC-1112]
0x16 Version 2 Membership Report [RFC-2236]
0x17 Version 2 Leave Group [RFC-2236]Unrecognized message types MUST be silently ignored. Other message types may be used by newer versions or extensions of IGMP, by multicast routing protocols, or for other uses, so don't freak out if you see one 🦋
In this document, unless otherwise qualified, the capitalized words "Query" and "Report" refer to IGMP Membership Queries and IGMP Version 3 Membership Reports, respectively. Just so we're on the same page 🎀
4.1. Membership Query Message
Membership Queries are sent by IP multicast routers to query the multicast reception state of neighboring interfaces. Here's what they look like:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0x11 | Max Resp Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Group Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Resv |S| QRV | QQIC | Number of Sources (N) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address [1] |
+- -+
| Source Address [2] |
+- . -+
. . .
. . .
+- -+
| Source Address [N] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+4.1.1. Max Resp Code
4.1.1. Max Resp Code 🍓
The Max Resp Code field sets the maximum time allowed before sending a responding report. The actual time allowed, called the Max Resp Time, is measured in units of 1/10 second and gets derived from the Max Resp Code like this:
If Max Resp Code < 128, Max Resp Time = Max Resp Code
If Max Resp Code >= 128, Max Resp Code represents a floating-point value laid out like this:
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|1| exp | mant |
+-+-+-+-+-+-+-+-+Max Resp Time = (mant | 0x10) << (exp + 3)
Small values of Max Resp Time let IGMPv3 routers tune the "leave latency" (the time between the moment the last host leaves a group and the moment the routing protocol is notified that there are no more members). Bigger values, especially in the exponential range, let you tune how bursty IGMP traffic gets on a network 🌈
4.1.2. Checksum 🔥
The Checksum is the 16-bit one's complement of the one's complement sum of the whole IGMP message (the entire IP payload). When computing the checksum, the Checksum field is set to zero. When receiving packets, the checksum MUST be verified before processing a packet, no skipping 🙅♀️ [RFC-1071]
4.1.3. Group Address 🎀
The Group Address field is set to zero when sending a General Query, and set to the IP multicast address being queried when sending a Group-Specific Query or Group-and-Source-Specific Query (see section 4.1.9, below) ✨
4.1.4. Resv (Reserved) 🫧
The Resv field is set to zero on transmission, and ignored on reception. Easy 💖
4.1.5. S Flag (Suppress Router-Side Processing) 🦋
When set to one, the S Flag tells any receiving multicast routers that they're supposed to suppress the normal timer updates they do when they hear a Query. It does not, however, suppress the querier election or the normal "host-side" processing of a Query that a router might need to do because it's a group member itself 👑
4.1.6. QRV (Querier's Robustness Variable) 🧚
If non-zero, the QRV field holds the [Robustness Variable] value used by the querier, i.e., the sender of the Query. If the querier's [Robustness Variable] exceeds 7, the maximum value of the QRV field, the QRV is set to zero. Routers adopt the QRV value from the most recently received Query as their own [Robustness Variable] value, unless that most recently received QRV was zero. In that case, the receivers use the default [Robustness Variable] value specified in section 8.1 or a statically configured value 🌸
4.1.7. QQIC (Querier's Query Interval Code) 💜
The Querier's Query Interval Code field specifies the [Query Interval] used by the querier. The actual interval, called the Querier's Query Interval (QQI), is measured in units of seconds and gets derived from the Querier's Query Interval Code like this:
If QQIC < 128, QQI = QQIC
If QQIC >= 128, QQIC represents a floating-point value laid out like this:
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|1| exp | mant |
+-+-+-+-+-+-+-+-+QQI = (mant | 0x10) << (exp + 3)
Multicast routers that aren't the current querier adopt the QQI value from the most recently received Query as their own [Query Interval] value, unless that most recently received QQI was zero. In that case, the receiving routers use the default [Query Interval] value specified in section 8.2. Lowkey the most important detail in this whole part, so don't skip it 🫶
4.1.8. Number of Sources (N) 💅
okay so the Number of Sources (N) field tells you how many source addresses are riding along in the Query 🫶. It's zero in a General Query or a Group-Specific Query, and non-zero in a Group-and-Source-Specific Query ✨. This number is capped by the MTU of the network the Query gets sent over 🧚. Like, on an Ethernet with an MTU of 1500 octets, the IP header with the Router Alert option eats 24 octets, and the IGMP fields up to and including Number of Sources (N) eat 12 octets, which leaves 1464 octets for source addresses 🎀. That limits you to 366 source addresses (1464/4) 😭
4.1.9. Source Address [i] 🌸
The Source Address [i] fields are a vector of n IP unicast addresses, where n is the value in the Number of Sources (N) field 💖
4.1.10. Additional Data 🙈
If the Packet Length field in the IP header of a received Query shows there are extra octets past the fields we've been talking about, IGMPv3 implementations MUST include those octets when computing the IGMP Checksum to verify it, but they MUST otherwise ignore those extra octets. When sending a Query, an IGMPv3 implementation MUST NOT include any octets beyond the fields described here ✨
4.1.11. Query Variants 🦋
There are three variants of the Query message:
- A "General Query" is sent by a multicast router to learn the complete multicast reception state of the neighboring interfaces (that is, the interfaces attached to the network on which the Query is transmitted). In a General Query, both the
Group Addressfield and the Number of Sources (N) field are zero. - A "Group-Specific Query" is sent by a multicast router to learn the reception state, with respect to a single multicast address, of the neighboring interfaces. In a Group-Specific Query, the
Group Addressfield contains the multicast address of interest, and the Number of Sources (N) field contains zero. - A "Group-and-Source-Specific Query" is sent by a multicast router to learn if any neighboring interface wants to receive packets sent to a specified multicast address, from any of a specified list of sources. In a Group-and-Source-Specific Query, the
Group Addressfield contains the multicast address of interest, and theSource Address [i]fields contain the source address(es) of interest 👑
4.1.12. IP Destination Addresses for Queries 🧚
In IGMPv3, General Queries are sent with an IP destination address of 224.0.0.1, the all-systems multicast address. Group-Specific and Group-and-Source-Specific Queries are sent with an IP destination address equal to the multicast address of interest. However, a system MUST accept and process any Query whose IP Destination Address field contains any of the addresses (unicast or multicast) assigned to the interface on which the Query arrives 🔥
4.2. Version 3 Membership Report Message 🎀
Version 3 Membership Reports are sent by IP systems to report (to neighboring routers) the current multicast reception state, or changes in the multicast reception state, of their interfaces. Reports have the following format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0x22 | Reserved | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Number of Group Records (M) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Group Record [1] .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Group Record [2] .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| . |
. . .
| . |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Group Record [M] .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+where each Group Record has the following internal format:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record Type | Aux Data Len | Number of Sources (N) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Multicast Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address [1] |
+- -+
| Source Address [2] |
+- -+
. . .
. . .
. . .
+- -+
| Source Address [N] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Auxiliary Data .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+4.2.1. Reserved 🧸
The Reserved fields are set to zero on transmission, and ignored on reception 🫶
4.2.2. Checksum 🔥
The Checksum is the 16-bit one's complement of the one's complement sum of the whole IGMP message (the entire IP payload). For computing the checksum, the Checksum field is set to zero. When receiving packets, the checksum MUST be verified before processing a message 💅
4.2.3. Number of Group Records (M) 🍓
The Number of Group Records (M) field specifies how many Group Records are present in this Report ✨
4.2.4. Group Record 🌈
Each Group Record is a block of fields containing information about the sender's membership in a single multicast group on the interface the Report is sent from 🦋
4.2.5. Record Type 💜
See section 4.2.12, below. 👑
4.2.6. Aux Data Len 🌸
The Aux Data Len field contains the length of the Auxiliary Data field in this Group Record, in units of 32-bit words. It may contain zero, to indicate the absence of any auxiliary data 🙈
4.2.7. Number of Sources (N) 🧚
The Number of Sources (N) field specifies how many source addresses are present in this Group Record 💖
4.2.8. Multicast Address 🎀
The Multicast Address field contains the IP multicast address this Group Record is about ⭐
4.2.9. Source Address [i] 🫶
The Source Address [i] fields are a vector of n IP unicast addresses, where n is the value in this record's Number of Sources (N) field ✨
4.2.10. Auxiliary Data 💀
The Auxiliary Data field, if present, contains additional information about this Group Record. The protocol specified in this document, IGMPv3, does not define any auxiliary data. Therefore, implementations of IGMPv3 MUST NOT include any auxiliary data (i.e., MUST set the Aux Data Len field to zero) in any transmitted Group Record, and MUST ignore any auxiliary data present in any received Group Record. The semantics and internal encoding of the Auxiliary Data field are to be defined by any future version or extension of IGMP that uses this field 🔥
the Auxiliary Data field is basically reserved for the future, so right now it's a big no-no to put anything in it 🙅♀️
4.2.11. Additional Data 🌈
If the Packet Length field in the IP header of a received Report shows there are extra octets of data past the last Group Record, IGMPv3 implementations MUST include those octets when computing the IGMP Checksum to verify it, but they MUST otherwise ignore those extra octets. When sending a Report, an IGMPv3 implementation MUST NOT include any octets beyond the last Group Record 🦋
4.2.12. Group Record Types ✨
okay so a Report can carry a bunch of different Group Record types, and each one tells the router something different 🫶
- A "Current-State Record" 🪞 is what a system sends back when it gets a Query on an interface. It spills the interface's current reception state for one multicast address. Its Record Type is one of these two values:
Value Name and Meaning
----- ----------------
1 MODE_IS_INCLUDE - indicates that the interface has a
filter mode of INCLUDE for the specified multicast
address. The Source Address [i] fields in this Group
Record contain the interface's source list for the
specified multicast address, if it is non-empty.
2 MODE_IS_EXCLUDE - indicates that the interface has a
filter mode of EXCLUDE for the specified multicast
address. The Source Address [i] fields in this Group
Record contain the interface's source list for the
specified multicast address, if it is non-empty.- A "Filter-Mode-Change Record" 🔄 gets sent whenever a local call to IPMulticastListen flips the filter mode of an interface-level state entry for a multicast address (INCLUDE to EXCLUDE, or EXCLUDE to INCLUDE). It rides along in a Report sent from the interface where the change happened. Its Record Type is one of these two values:
Value Name and Meaning
----- ----------------
3 CHANGE_TO_INCLUDE_MODE - indicates that the interface
has changed to INCLUDE filter mode for the specified
multicast address. The Source Address [i] fields
in this Group Record contain the interface's new
source list for the specified multicast address,
if it is non-empty.
4 CHANGE_TO_EXCLUDE_MODE - indicates that the interface
has changed to EXCLUDE filter mode for the specified
multicast address. The Source Address [i] fields
in this Group Record contain the interface's new
source list for the specified multicast address,
if it is non-empty.- A "Source-List-Change Record" 📝 gets sent when a local IPMulticastListen call changes the source list without also changing the filter mode. Same deal: it's included in a Report sent from the interface where the change happened. Its Record Type is one of these two values:
Value Name and Meaning
----- ----------------
5 ALLOW_NEW_SOURCES - indicates that the Source Address
[i] fields in this Group Record contain a list of the
additional sources that the system wishes to
hear from, for packets sent to the specified
multicast address. If the change was to an INCLUDE
source list, these are the addresses that were added
to the list; if the change was to an EXCLUDE source
list, these are the addresses that were deleted from
the list.
6 BLOCK_OLD_SOURCES - indicates that the Source Address
[i] fields in this Group Record contain a list of the
sources that the system no longer wishes to
hear from, for packets sent to the specified
multicast address. If the change was to an INCLUDE
source list, these are the addresses that were
deleted from the list; if the change was to an
EXCLUDE source list, these are the addresses that
were added to the list.If one source list change both allows new sources and blocks old ones, the system sends two Group Records for that multicast address: one ALLOW_NEW_SOURCES and one BLOCK_OLD_SOURCES. Two records, one change, very organised 💅
We're going to call either a Filter-Mode-Change Record or a Source-List-Change Record a "State-Change Record" 🏷️
Unrecognized Record Type values MUST be silently ignored. 🙈
4.2.13. IP Source Addresses for Reports 🌸
An IGMP report goes out with a valid IP source address for the destination subnet. A system that hasn't gotten an IP address yet can use 0.0.0.0 instead. Heads up though: lots of systems on the same LAN can all be using 0.0.0.0 at once 👯 Routers MUST accept a report with a source address of 0.0.0.0. ✨
4.2.14. IP Destination Addresses for Reports 🦋
Version 3 Reports get sent to 224.0.0.22, which is where every IGMPv3-capable multicast router is listening. A system running in version 1 or version 2 compatibility mode sends its version 1 or version 2 Reports to whatever multicast group is in the Group Address field of the Report. Also, a system MUST accept and process any version 1 or version 2 Report whose IP Destination Address field contains any of the addresses (unicast or multicast) assigned to the interface where the Report arrives. Not picky, just thorough 💖
4.2.15. Notation for Group Records 🧚
For the rest of this doc, we're using this shorthand to describe what's inside a Group Record for one multicast address:
IS_IN ( x ) - Type MODE_IS_INCLUDE, source addresses x
IS_EX ( x ) - Type MODE_IS_EXCLUDE, source addresses x
TO_IN ( x ) - Type CHANGE_TO_INCLUDE_MODE, source addresses x
TO_EX ( x ) - Type CHANGE_TO_EXCLUDE_MODE, source addresses x
ALLOW ( x ) - Type ALLOW_NEW_SOURCES, source addresses x
BLOCK ( x ) - Type BLOCK_OLD_SOURCES, source addresses xHere, x is either:
- a capital letter (like
A) standing in for a set of source addresses, or - a set expression (like
A+B), whereA+Bis the union of sets A and B,A*Bis their intersection, andA-Bmeans removing every element of set B from set A. 🧮
4.2.16. Membership Report Size 📦
If the Group Records a Report needs don't fit in one Report message (based on the MTU of the network they're going out on), they get sent across as many Report messages as it takes to report the whole set. 🚀
Now, if one Group Record has so many source addresses that it won't fit in a single Report message, here's the tea. If its Type is not MODE_IS_EXCLUDE or CHANGE_TO_EXCLUDE_MODE, it gets split into several Group Records, each with a different subset of the sources, and each one sent in its own Report message. If its Type is MODE_IS_EXCLUDE or CHANGE_TO_EXCLUDE_MODE, only one Group Record gets sent, packed with as many sources as will fit, and the rest just don't get reported. Which sources make the cut is arbitrary, but it's preferable to report the same set in each subsequent report instead of mixing it up every time. Consistency is iconic 🫶
5. Description of the Protocol for Group Members 👑
IGMP is an asymmetric protocol, which means it has separate behaviours for group members (hosts or routers that want to receive multicast packets) and for multicast routers. This section covers the part of IGMPv3 that applies to all group members. (Quick side note: a multicast router that's also a group member does both parts, handling its own IGMP message transmissions along with its neighbours'. The multicast router part of IGMPv3 is in section 6. 🧠)
A system runs the protocol from this section over all interfaces where multicast reception is supported, even if more than one of those interfaces is plugged into the same network. 🔌
For interoperability with multicast routers running older versions of IGMP, systems keep a MulticastRouterVersion variable for each interface where multicast reception is supported. This section describes group member behaviour on interfaces where MulticastRouterVersion = 3. The algorithm for working out MulticastRouterVersion, along with the behaviour for versions other than 3, is in section 7. 💅
The all-systems multicast address, 224.0.0.1, is the special case. On all systems (every host and router, multicast routers included), reception of packets sent to the all-systems multicast address, from any source, is permanently enabled on every interface where multicast reception is supported. No IGMP messages are ever sent about the all-systems multicast address. Zero drama, always on ✨
There are two kinds of events that trigger IGMPv3 protocol actions on an interface:
- a change of the interface reception state, caused by a local invocation of IPMulticastListen.
- reception of a Query.
(Received IGMP messages of types other than Query get silently ignored, except when they're needed for interoperation with earlier versions of IGMP. 🙈)
The next subsections describe what to do for each of these two cases. In those descriptions, timer and counter names show up in square brackets, and their default values are specified in section 8. 🎀
5.1. Action on Change of Interface State 🦋
okay so, when IPMulticastListen gets invoked it can flip the multicast reception state of an interface, following the rules in section 3.2 ✨ Every flip hits the per-interface entry for one multicast address, so it's always one group at a time, bestie 💅
A change of interface state makes the system immediately transmit a State-Change Report from that interface 🚀 Which Group Record(s) end up in that Report depends on comparing the filter mode and source list for the affected address before and after the change, using the table below 🔍 If there was no interface state for that address before (aka the change made a brand new per-interface record), or there's no state after (aka the change deleted one), then "non-existent" counts as filter mode INCLUDE with an empty source list 🧚
Old State New State State-Change Record Sent
--------- --------- ------------------------
INCLUDE (A) INCLUDE (B) ALLOW (B-A), BLOCK (A-B)
EXCLUDE (A) EXCLUDE (B) ALLOW (A-B), BLOCK (B-A)
INCLUDE (A) EXCLUDE (B) TO_EX (B)
EXCLUDE (A) INCLUDE (B) TO_IN (B)If the computed source list for either an ALLOW or a BLOCK State-Change Record is empty, that record gets left out of the Report 🙈
To cover the chance that a multicast router misses the State-Change Report, it gets retransmitted [Robustness Variable] - 1 more times, at intervals picked at random from the range (0, [Unsolicited Report Interval]) 🔁
If more changes hit the same interface state entry before all the retransmissions of the first State-Change Report are finished, each extra change immediately triggers a brand new State-Change Report 🔥 The contents of that new report get worked out the same way as before: compare the interface state for the affected group before and after the latest change, then build the difference records using the table above. BUT those records aren't sent on their own. They get merged with the pending report to create the new State-Change report, and the merge rules are described below 💜
Sending the merged State-Change Report ends the retransmissions of the earlier State-Change Reports for that multicast address, and it becomes the first of [Robustness Variable] transmissions of State-Change Reports 🎀
Each time a source is included in the difference report, its retransmission state has to be maintained until [Robustness Variable] State-Change reports have been sent by the host. This keeps a series of successive state changes from breaking the protocol robustness 🛡️
If the interface reception-state change that triggers the new report is a filter-mode change, then the next [Robustness Variable] State-Change Reports will include a Filter-Mode-Change record 👑 This applies even if any number of source-list changes happen in that period. The host has to keep retransmission state for the group until those [Robustness Variable] State-Change reports have been sent. Once [Robustness Variable] State-Change reports with Filter-Mode-Change records have gone out after the last filter-mode change, and source-list changes to the interface reception have scheduled additional reports, the next State-Change report will include Source-List-Change records 🌈
Each time a State-Change Report is transmitted, the contents are determined as follows. If the report should contain a Filter-Mode-Change record, then if the current filter mode of the interface is INCLUDE, a TO_IN record gets included in the report; otherwise a TO_EX record gets included ✨ If instead the report should contain Source-List-Change records, an ALLOW and a BLOCK record get included. The contents of those records are built according to the table below 🧁
Record Sources included
------ ----------------
TO_IN All in the current interface state that must be forwarded
TO_EX All in the current interface state that must be blocked
ALLOW All with retransmission state that must be forwarded
BLOCK All with retransmission state that must be blockedIf the computed source list for either an ALLOW or a BLOCK record is empty, that record is omitted from the State-Change report 🙈
Note: when the first State-Change report is sent, the non-existent pending report to merge with can be treated as a source-change report with empty ALLOW and BLOCK records, since no sources have retransmission state yet 🥹
5.2. Action on Reception of a Query 🎀
When a system receives a Query, it does not respond immediately 🙅 Instead, it delays its response by a random amount of time, bounded by the Max Resp Time value derived from the Max Resp Code in the received Query message ⏳ A system can receive a variety of Queries on different interfaces and of different kinds (General Queries, Group-Specific Queries, and Group-and-Source-Specific Queries), and each of those may need its own delayed response 💌
Before scheduling a response to a Query, the system must first consider previously scheduled pending responses and, in many cases, schedule a combined response. So the system must be able to maintain this state:
- A timer per interface for scheduling responses to General Queries.
- A per-group and interface timer for scheduling responses to Group-Specific and Group-and-Source-Specific Queries.
- A per-group and interface list of sources to be reported in the response to a Group-and-Source-Specific Query.
When a new Query with the Router-Alert option arrives on an interface, and the system has state to report, a delay for a response is randomly selected in the range (0, [Max Resp Time]), where Max Resp Time is derived from the Max Resp Code in the received Query message 🎯 The rules below then decide whether a Report needs to be scheduled and what type to schedule. The rules are considered in order, and only the first matching rule is applied 📋
- If there is a pending response to a previous General Query scheduled sooner than the selected delay, no additional response needs to be scheduled 😌
- If the received Query is a General Query, the interface timer is used to schedule a response to the General Query after the selected delay. Any previously pending response to a General Query is canceled 🙅♀️
- If the received Query is a Group-Specific Query or a Group-and-Source-Specific Query, and there is no pending response to a previous Query for this group, then the group timer is used to schedule a report. If the received Query is a Group-and-Source-Specific Query, the list of queried sources is recorded to be used when generating a response 📝
- If there already is a pending response to a previous Query scheduled for this group, and either the new Query is a Group-Specific Query or the recorded source-list associated with the group is empty, then the group source-list is cleared and a single response is scheduled using the group timer. The new response is scheduled to be sent at the earliest of the remaining time for the pending report and the selected delay 🫶
- If the received Query is a Group-and-Source-Specific Query and there is a pending response for this group with a non-empty source-list, then the group source list is augmented to contain the list of sources in the new Query, and a single response is scheduled using the group timer. The new response is scheduled to be sent at the earliest of the remaining time for the pending report and the selected delay 🧚
When the timer in a pending response record expires, the system transmits, on the associated interface, one or more Report messages carrying one or more Current-State Records (see section 4.2.12), as follows 📨
- If the expired timer is the interface timer (aka it's a pending response to a General Query), then one Current-State Record is sent for each multicast address for which the specified interface has reception state, as described in section 3.2. The Current-State Record carries the multicast address and its associated filter mode (
MODE_IS_INCLUDEorMODE_IS_EXCLUDE) and source list. Multiple Current-State Records get packed into individual Report messages, to the extent possible 📦
This naive algorithm may result in bursts of packets when a system is a member of a large number of groups 😬 Instead of using a single interface timer, implementations are recommended to spread transmission of such Report messages over the interval (0, [Max Resp Time]). Note that any such implementation MUST avoid the "ack-implosion" problem, i.e., MUST NOT send a Report immediately on reception of a General Query 🚫
- If the expired timer is a group timer and the list of recorded sources for that group is empty (aka it's a pending response to a Group-Specific Query), then, if and only if the interface has reception state for that group address, a single Current-State Record is sent for that address. The Current-State Record carries the multicast address and its associated filter mode (
MODE_IS_INCLUDEorMODE_IS_EXCLUDE) and source list 💖 - If the expired timer is a group timer and the list of recorded sources for that group is non-empty (aka it's a pending response to a Group-and-Source-Specific Query), then, if and only if the interface has reception state for that group address, the contents of the responding Current-State Record are determined from the interface state and the pending response record, as specified in the table below 🔎
set of sources in the
interface state pending response record Current-State Record
--------------- ----------------------- --------------------
INCLUDE (A) B IS_IN (A*B)
EXCLUDE (A) B IS_IN (B-A)If the resulting Current-State Record has an empty set of source addresses, then no response is sent 🙃
Finally, after any required Report messages have been generated, the source lists associated with any reported groups get cleared 🧹✨
6. Description of the Protocol for Multicast Routers 👑
okay so IGMP's whole job for a multicast router is figuring out, for each network it's directly plugged into, which multicast addresses the people on that network are into 🫶. IGMPv3 levels up: the router can also learn which sources its neighbours want, for packets going to any given multicast address 💅. All that info gets handed to whatever multicast routing protocol the router is using, so multicast packets actually reach every network with interested receivers 🦋.
This section is the multicast-router side of IGMPv3 🎀. Routers can also join groups themselves, so they do the group member stuff too, which is section 5 🧚.
A router runs this protocol over each of its directly-attached networks 🌸. If it has more than one interface on the same network, it only has to run it over one of them ✨. On every interface where this is running, the router MUST enable reception of multicast address 224.0.0.22, from all sources (and MUST perform the group member part of IGMPv3 for that address on that interface) 💖.
Routers only need to know that at least one system on an attached network wants packets to a particular multicast address from a particular source 🔍. They don't have to track what every single neighbour is into (but see Appendix A.2 point 1 for the deets) 🙈.
IGMPv3 is backward compatible with older versions of IGMP 🔁. To stay compatible with older IGMP systems, IGMPv3 multicast routers MUST also implement versions 1 and 2 of the protocol (see section 7) 🍓.
6.1. Conditions for IGMP Queries 📮
Multicast routers send General Queries periodically to ask an attached network for group membership info 💌. These queries are how the router builds and refreshes the group membership state of systems on attached networks 🌈. Systems answer by reporting their group membership state (and their desired set of sources) using Current-State Group Records in IGMPv3 Membership Reports 📝.
As a member of a multicast group, a system can express interest in receiving or not receiving traffic from particular sources 👀. When its desired reception state changes, it reports those changes using Filter-Mode-Change Records or Source-List-Change Records 🔄. These records show an explicit state change for a group at a system, either in the group record's source list or its filter-mode ✨. When a group membership ends at a system, or traffic from a particular source isn't wanted anymore, a multicast router must query for other members of the group or listeners of the source before deleting the group (or source) and pruning its traffic 🧹.
To get every system on a network responding to group membership changes, multicast routers send specific queries 🎯. A Group-Specific Query checks that no systems want the specified group, or "rebuilds" the desired reception state for a particular group 🔎. Group-Specific Queries get sent when a router receives a State-Change record saying a system is leaving a group 🚪.
A Group-and-Source Specific Query checks that no systems on a network want traffic from a set of sources 🕵️♀️. These queries list sources for a particular group that have been asked to stop being forwarded 🛑. A multicast router sends this to learn whether any systems still want packets to the specified group address from the specified source addresses 💭. Group-and-Source Specific Queries are only sent in response to State-Change Records, and never in response to Current-State Records 🙅♀️. Section 4.1.11 describes each query in more detail 📖.
6.2. IGMP State Maintained by Multicast Routers 🗂️
Multicast routers running IGMPv3 keep state per group per attached network 🧠. That group state has a filter-mode, a list of sources, and various timers ⏰. For each attached network running IGMP, the router records the desired reception state for that network 📍. Conceptually, that state is a set of records of this form:
(multicast address, group timer, filter-mode, (source records))Each source record looks like this:
(source address, source timer)If all sources within a given group are desired, an empty source record list is kept with filter-mode set to EXCLUDE 🌟. This means hosts on this network want all sources for this group to be forwarded 📡. It's the IGMPv3 version of an IGMPv1 or IGMPv2 group join 💅.
6.2.1. Definition of Router Filter-Mode 🎚️
to keep internal state small, IGMPv3 routers keep a filter-mode per group per attached network 🤏. This filter-mode condenses the total desired reception state of a group into a minimum set that still satisfies everyone's memberships 🧩. It can change when certain types of group records come in, or when certain timer conditions happen ⏳. From here on, "router filter-mode" means the filter-mode of a particular group within a router 🫶. Section 6.4 covers how the router filter-mode changes for each group record received 📋.
Conceptually, when a group record comes in, the router filter-mode for that group gets updated to cover all the requested sources using the least amount of state 🧼. As a rule, once a group record with a filter-mode of EXCLUDE is received, the router filter-mode for that group will be EXCLUDE 🚨.
When a router filter-mode for a group is EXCLUDE, the source record list holds two kinds of sources 👯. The first kind is the set that represents conflicts in the desired reception state, and this set must be forwarded by some router on the network 🚚. The second kind is the set of sources that hosts have asked not to be forwarded 🙅. Appendix A explains why this second set gets kept while in EXCLUDE mode 📚.
When a router filter-mode for a group is INCLUDE, the source record list is the list of sources desired for the group 💖. This is the total desired set of sources for that group 🎯. Each source in the source record list must be forwarded by some router on the network 🔀.
Here's the tricky bit 🙃: a reported group record with a filter-mode of EXCLUDE makes the router switch its filter-mode for that group to EXCLUDE, so there has to be a way to switch back to INCLUDE 🔙. If every system with a group record in EXCLUDE filter-mode stops reporting, it's desirable for the router filter-mode for that group to go back to INCLUDE 🌈. That switch happens when the group timer expires, and section 6.5 explains it in full detail 📖.
6.2.2. Definition of Group Timers ⏲️
The group timer is only used when a group is in EXCLUDE mode, and it stands for the time until the filter-mode of the group expires and switches to INCLUDE mode 🕰️. A group timer is a decrementing timer with a lower bound of zero, kept per group per attached network 📉. Group timers get updated based on the types of group records received 🔁.
If a group timer expires while the router filter-mode for the group is EXCLUDE, there are no listeners on the attached network in EXCLUDE mode 😶. At that point, the router switches to INCLUDE filter-mode 🔄. Section 6.5 covers the actions taken when a group timer expires while in EXCLUDE mode 📖.
The table below sums up the role of the group timer 📊. Section 6.4 has the details on how the group timer is set for each type of group record received 📝.
Group
Filter-Mode Group Timer Value Actions/Comments
----------- ----------------- ----------------
INCLUDE Timer >= 0 All members in INCLUDE
mode.
EXCLUDE Timer > 0 At least one member in
EXCLUDE mode.
EXCLUDE Timer == 0 No more listeners to
group. If all source
timers have expired then
delete Group Record.
If there are still
source record timers
running, switch to
INCLUDE filter-mode
using those source records
with running timers as the
INCLUDE source record
state.6.2.3. Definition of Source Timers ⏱️
Each source record has a source timer, which is a decrementing timer with a lower bound of zero 🫧. Source timers get updated based on the type and filter-mode of the group record received 🔄. They're always updated (for a particular group) whenever that source shows up in a received record for that group 💫. Section 6.4 covers how source timers get set for each type of group record received 📋.
A source record with a running timer, when the router filter-mode for the group is INCLUDE, means at least one system (in INCLUDE filter-mode) is currently still wanting that source 💁. If a source timer expires while the router filter-mode for the group is INCLUDE, the router decides traffic from that source isn't wanted on the attached network anymore, and deletes the matching source record 🗑️.
Source timers are treated differently when the router filter-mode for a group is EXCLUDE 🔀. If a source record has a running timer while the router filter-mode is EXCLUDE, it means at least one system wants that source 💘. So it should be forwarded by a router on the network 🚀. Appendix A explains why state is kept for sources that have been asked to be forwarded while in EXCLUDE state 📚.
If a source timer expires while the router filter-mode for the group is EXCLUDE, the router tells the routing protocol there's no longer a receiver on the network interested in traffic from that source 📢.
When the router filter-mode for a group is EXCLUDE, source records only get deleted when the group timer expires 🧹. Section 6.3 describes the actions that should be taken depending on the value of a source timer 🎀.
6.3. IGMPv3 Source-Specific Forwarding Rules ✨
okay so whenever a multicast router gets a datagram from a source that's aimed at a particular group, it has to decide whether to forward that datagram onto an attached network or not 💅 the multicast routing protocol in use is the one making that call, and it should use the IGMPv3 info to make sure every source/group that's wanted on a subnetwork gets forwarded there 🫶 but IGMPv3 info does NOT override multicast routing info, bestie! for example, if the IGMPv3 filter-mode for G is EXCLUDE, a router may still forward packets from the excluded sources to a transit subnet 👀
here's the tea in table form 🍓 the table below sums up the forwarding suggestions that IGMP makes to the routing protocol for traffic coming from a source destined to a group. it also shows the actions taken when a source timer expires, depending on the group's router filter-mode 💖
Group
Filter-Mode Source Timer Value Action
----------- ------------------ ------
INCLUDE TIMER > 0 Suggest to forward traffic
from source
INCLUDE TIMER == 0 Suggest to stop forwarding
traffic from source and
remove source record. If
there are no more source
records for the group, delete
group record.
INCLUDE No Source Elements Suggest to not forward source
EXCLUDE TIMER > 0 Suggest to forward traffic
from source
EXCLUDE TIMER == 0 Suggest to not forward
traffic from source
(DO NOT remove record)
EXCLUDE No Source Elements Suggest to forward traffic
from source6.4. Action on Reception of Reports 🎀
6.4.1. Reception of Current-State Records
okay so when a router gets Current-State Records, it updates BOTH its group timers and its source timers 🔥 sometimes getting a certain type of group record makes the router filter-mode for that group flip, and the table below shows exactly what changes in the router's state and timers when Current-State Records come in 💅
to talk about source timers, we use some notation. ( A, B ) is how we write the total number of sources for a particular group, where:
A = set of source records whose source timers > 0 (Sources that at
least one host has requested to be forwarded)
B = set of source records whose source timers = 0 (Sources that IGMP
will suggest to the routing protocol not to forward)heads up, there are only two sets when a router's filter-mode for a group is EXCLUDE 🙈 when it's INCLUDE, there's just one set for the sources everyone wants forwarded (so like, simply (A)).
in the tables, a few abbreviations show up (all explained in detail in section 8) 🦋 GMI is the Group Membership Interval, which is the time it takes for group memberships to time out. LMQT is the Last Member Query Time, meaning the total time spent after Last Member Query Count retransmissions. LMQT is the "leave latency" 😭 aka the gap between a membership change being sent and the routing protocol actually seeing that change in its info.
in the "Actions" column of the router state tables, we write 'A=J', which means the set A of source records gets its source timers set to J. 'Delete A' means the set A of source records gets deleted. 'Group Timer=J' means the Group Timer for the group gets set to J 🌸
Router State Report Rec'd New Router State Actions
------------ ------------ ---------------- -------
INCLUDE (A) IS_IN (B) INCLUDE (A+B) (B)=GMI
INCLUDE (A) IS_EX (B) EXCLUDE (A*B,B-A) (B-A)=0
Delete (A-B)
Group Timer=GMI
EXCLUDE (X,Y) IS_IN (A) EXCLUDE (X+A,Y-A) (A)=GMI
EXCLUDE (X,Y) IS_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y)=GMI
Delete (X-A)
Delete (Y-A)
Group Timer=GMI6.4.2. Reception of Filter-Mode-Change and Source-List-Change Records
when the global state of a group changes somewhere in a system, that system sends either a Source-List-Change Record or a Filter-Mode-Change Record for that group 🧚 just like with Current-State Records, routers must act on these and maybe change their own state so it matches the new desired membership state of the network 💜
routers must query sources that are being requested to no longer be forwarded to a group 👀 when a router queries, or receives a query, for a specific set of sources, it lowers its source timers for those sources to a small interval of Last Member Query Time seconds. if group records come back in response to those queries and they show interest in getting traffic from the queried sources, the matching timers get updated 💅
same energy for groups! when a router queries a specific group, it lowers its group timer for that group to a small interval of Last Member Query Time seconds. if any group records showing EXCLUDE mode interest in the group come in during that interval, the group timer gets updated, and the suggestion to the routing protocol to forward the group stands without any interruption ✨
during a query period (that's Last Member Query Time seconds), the IGMP component in the router keeps suggesting to the routing protocol that it forwards traffic from the groups or sources it's querying 🫶 it's not until after Last Member Query Time seconds pass without a record expressing interest in the queried group or sources that the router may prune the group or sources from the network.
the table below describes the changes in group state and the actions taken when a router gets either a Filter-Mode-Change or a Source-List-Change Record 💖 it also describes the queries the querier sends when a particular report comes in.
we use some notation for the queries that get sent. 'Q(G)' means a Group-Specific Query to G. 'Q(G,A)' means a Group-and-Source Specific Query to G with source-list A. if source-list A ends up null because of an action (like A*B), then no query gets sent for that operation 🌈
to keep the protocol robust, queries sent by the actions in the table below need to be transmitted [Last Member Query Count] times, once every [Last Member Query Interval] 🔥
if there are already pending queries waiting to be retransmitted for the same group while new queries are being scheduled, the new and pending queries have to be merged 😭 also, received host reports for a group with pending queries may change what those queries contain. section 6.6.3 walks through how the state of pending queries gets built and maintained 🎀
Router State Report Rec'd New Router State Actions
------------ ------------ ---------------- -------
INCLUDE (A) ALLOW (B) INCLUDE (A+B) (B)=GMI
INCLUDE (A) BLOCK (B) INCLUDE (A) Send Q(G,A*B)
INCLUDE (A) TO_EX (B) EXCLUDE (A*B,B-A) (B-A)=0
Delete (A-B)
Send Q(G,A*B)
Group Timer=GMI
INCLUDE (A) TO_IN (B) INCLUDE (A+B) (B)=GMI
Send Q(G,A-B)
EXCLUDE (X,Y) ALLOW (A) EXCLUDE (X+A,Y-A) (A)=GMI
EXCLUDE (X,Y) BLOCK (A) EXCLUDE (X+(A-Y),Y) (A-X-Y)=Group Timer
Send Q(G,A-Y)
EXCLUDE (X,Y) TO_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y)=Group Timer
Delete (X-A)
Delete (Y-A)
Send Q(G,A-Y)
Group Timer=GMI
EXCLUDE (X,Y) TO_IN (A) EXCLUDE (X+A,Y-A) (A)=GMI
Send Q(G,X-A)
Send Q(G)6.5. Switching Router Filter-Modes 🦋
the group timer is the mechanism that moves a router filter-mode from EXCLUDE over to INCLUDE 💅
when a group timer expires while the router filter-mode is EXCLUDE, the router assumes there are no systems with a filter-mode of EXCLUDE left on the attached network 😭 so the router filter-mode for that group flips to INCLUDE.
the router uses source records with running source timers as its state for the switch to INCLUDE mode. if any source records have source timers greater than zero (meaning they've been requested to be forwarded), the router switches to INCLUDE mode using those records. source records whose timers are zero (left over from the previous EXCLUDE mode) get deleted 🗑️
example time 🎀 if a router's state for a group is EXCLUDE(X,Y) and that group's timer expires, the router switches to INCLUDE mode with state INCLUDE(X) ✨
6.6. Action on Reception of Queries 👑
6.6.1. Timer Updates
when a router sends or receives a query with the Suppress Router-Side Processing flag clear, it must update its timers so they reflect the correct timeout values for the group or sources being queried 🔥 the table below shows the timer actions for sending or receiving a Group-Specific or Group-and-Source Specific Query when the Suppress Router-Side Processing flag is not set:
Query Action
----- ------
Q(G,A) Source Timer for sources in A are lowered to LMQT
Q(G) Group Timer is lowered to LMQTand if a router sends or receives a query with the Suppress Router-Side Processing flag set, it won't update its timers 🙈
6.6.2. Querier Election
IGMPv3 elects a single querier per subnet using the same querier election mechanism as IGMPv2, which is by IP address 🫶 when a router receives a query from a lower IP address, it sets the Other-Querier-Present timer to Other Querier Present Interval, and it stops sending queries on the network if it was the previously elected querier 💅 after its Other-Querier Present timer expires, it should begin sending General Queries.
if a router receives an older version query, it MUST use the oldest version of IGMP on the network 😭 for a detailed look at compatibility issues between IGMP versions, see section 7 💖
6.6.3. Building and Sending Specific Queries
6.6.3.1. Building and Sending Group Specific Queries 🎀
okay so when a table action "Send Q(G)" shows up, the group timer must be lowered to LMQT 💅. Then the router has to immediately send a group specific query, and it also schedules [Last Member Query Count - 1] query retransmissions. Those go out every [Last Member Query Interval] over [Last Member Query Time] ✨.
When the router sends a group specific query and the group timer is larger than LMQT, the "Suppress Router-Side Processing" bit gets set in the query message 🦋.
6.6.3.2. Building and Sending Group and Source Specific Queries 💖
when a table action "Send Q(G,X)" is encountered by a querier in the table in section 6.4.2, you have to do the following for each source in X of group G whose source timer is larger than LMQT 🫶:
- Set the number of retransmissions for each source to [Last Member Query Count].
- Lower the source timer to LMQT.
Then the router must immediately send a group and source specific query, and schedule [Last Member Query Count - 1] query retransmissions to go out every [Last Member Query Interval] over [Last Member Query Time]. The contents of these queries get calculated like this 🧚.
When you build a group and source specific query for a group G, two separate query messages get sent for that group. The first one has the "Suppress Router-Side Processing" bit set and includes all the sources with retransmission state and timers greater than LMQT. The second one has the "Suppress Router-Side Processing" bit clear and includes all the sources with retransmission state and timers lower or equal to LMQT. If either of the two calculated messages doesn't contain any sources, its transmission gets suppressed 🙈.
Note: If a group specific query is scheduled to go out at the same time as a group and source specific query for the same group, then sending the group and source specific message with the "Suppress Router-Side Processing" bit set may be suppressed 💀.
7. Interoperation With Older Versions of IGMP ✨
IGMP version 3 hosts and routers play nicely with hosts and routers that haven't been upgraded to IGMPv3 yet 🌈. This compatibility works because hosts and routers take the right actions depending on which IGMP versions are running across the network 🫶.
7.1. Query Version Distinctions 🍓
The IGMP version of a Membership Query message gets figured out like this:
IGMPv1 Query: length = 8 octets AND Max Resp Code field is zero
IGMPv2 Query: length = 8 octets AND Max Resp Code field is
non-zero
IGMPv3 Query: length >= 12 octetsQuery messages that don't match any of the above conditions (e.g., a Query of length 10 octets) MUST be silently ignored 🙈.
7.2. Group Member Behavior 🌸
7.2.1. In the Presence of Older Version Queriers 💅
Okay so to stay compatible with older version routers, IGMPv3 hosts MUST operate in version 1 and version 2 compatibility modes 👑. IGMPv3 hosts MUST keep state per local interface about the compatibility mode of each attached network. A host's compatibility mode is decided by the Host Compatibility Mode variable, which can be in one of three states: IGMPv1, IGMPv2 or IGMPv3. This variable is kept per interface and depends on the version of General Queries heard on that interface, plus the Older Version Querier Present timers for the interface 🦋.
To switch gracefully between IGMP versions, hosts keep both an IGMPv1 Querier Present timer and an IGMPv2 Querier Present timer per interface. IGMPv1 Querier Present gets set to Older Version Querier Present Timeout seconds whenever an IGMPv1 Membership Query comes in. IGMPv2 Querier Present gets set to Older Version Querier Present Timeout seconds whenever an IGMPv2 General Query comes in ✨.
The Host Compatibility Mode of an interface changes whenever an older version query (older than the current compatibility mode) is heard, or when certain timer conditions happen. When the IGMPv1 Querier Present timer expires, a host switches to Host Compatibility mode of IGMPv2 if it has a running IGMPv2 Querier Present timer. If it doesn't have a running IGMPv2 Querier Present timer, it switches to Host Compatibility of IGMPv3. When the IGMPv2 Querier Present timer expires, a host switches to Host Compatibility mode of IGMPv3 🎀.
The Host Compatibility Mode variable is based on whether an older version General Query was heard in the last Older Version Querier Present Timeout seconds. The Host Compatibility Mode gets set depending on the following 💜:
Host Compatibility Mode Timer State
----------------------- -----------
IGMPv3 (default) IGMPv2 Querier Present not running
and IGMPv1 Querier Present not running
IGMPv2 IGMPv2 Querier Present running
and IGMPv1 Querier Present not running
IGMPv1 IGMPv1 Querier Present runningIf a host gets a query that updates its Querier Present timers and, as a result, its compatibility mode, it should switch compatibility modes immediately ⭐.
When Host Compatibility Mode is IGMPv3, a host acts using the IGMPv3 protocol on that interface. When Host Compatibility Mode is IGMPv2, a host acts in IGMPv2 compatibility mode, using only the IGMPv2 protocol, on that interface. When Host Compatibility Mode is IGMPv1, a host acts in IGMPv1 compatibility mode, using only the IGMPv1 protocol on that interface 🧚.
An IGMPv1 router sends General Queries with the Max Resp Code set to 0. This MUST be interpreted as a value of 100 (10 seconds) 🌈.
An IGMPv2 router sends General Queries with the Max Resp Code set to the desired Max Resp Time. In other words, the full range of this field is linear, and the exponential algorithm described in section 4.1.1 is not used 🍓.
Whenever a host changes its compatibility mode, it cancels all its pending response and retransmission timers 🫶.
7.2.2. In the Presence of Older Version Group Members 🦋
An IGMPv3 host might be placed on a network with hosts that haven't been upgraded to IGMPv3 yet. An IGMPv3 host MAY let its IGMPv3 Membership Record get suppressed by either a Version 1 Membership Report or a Version 2 Membership Report 🌸.
7.3. Multicast Router Behavior 💅
7.3.1. In the Presence of Older Version Queriers ✨
IGMPv3 routers might be placed on a network where at least one router hasn't been upgraded to IGMPv3 yet. These requirements apply 🫶:
- If any older versions of IGMP are present on routers, the querier MUST use the lowest version of IGMP present on the network. This must be administratively assured. Routers that want to stay compatible with IGMPv1 and IGMPv2 MUST have a configuration option to act in IGMPv1 or IGMPv2 compatibility modes. When in IGMPv1 mode, routers MUST send Periodic Queries with a Max Resp Code of 0 and truncated at the Group Address field (i.e., 8 bytes long), and MUST ignore Leave Group messages. They SHOULD also warn about receiving an IGMPv2 or IGMPv3 query, although such warnings MUST be rate-limited. When in IGMPv2 mode, routers MUST send Periodic Queries truncated at the Group Address field (i.e., 8 bytes long), and SHOULD also warn about receiving an IGMPv3 query (such warnings MUST be rate-limited). They also MUST fill in the Max Resp Time in the Max Resp Code field, i.e., the exponential algorithm described in section 4.1.1 is not used 🔥.
- If a router isn't explicitly configured to use IGMPv1 or IGMPv2 and hears an IGMPv1 Query or IGMPv2 General Query, it SHOULD log a warning. These warnings MUST be rate-limited 👑.
7.3.2. In the Presence of Older Version Group Members ✨
okay bestie, so IGMPv3 routers might end up on a network with hosts that haven't been upgraded to IGMPv3 yet 😭. To stay compatible with those older hosts, IGMPv3 routers MUST operate in version 1 and version 2 compatibility modes 🫶. They keep a compatibility mode per group record. A group's compatibility mode comes from the Group Compatibility Mode variable, which can be in one of three states: IGMPv1, IGMPv2 or IGMPv3. That variable is kept per group record and depends on the version of Membership Reports heard for that group, plus the Older Version Host Present timer for the group 💅.
To switch gracefully between versions, routers keep an IGMPv1 Host Present timer and an IGMPv2 Host Present timer for each group record 🦋. The IGMPv1 Host Present timer gets set to Older Version Host Present Timeout seconds whenever an IGMPv1 Membership Report is received. The IGMPv2 Host Present timer gets set to Older Version Host Present Timeout seconds whenever an IGMPv2 Membership Report is received.
The Group Compatibility Mode of a group record changes whenever an older version report (older than the current compatibility mode) is heard, or when certain timer conditions happen. When the IGMPv1 Host Present timer expires, the router switches to Group Compatibility mode of IGMPv2 if it has a running IGMPv2 Host Present timer. If it doesn't have one running, it switches to Group Compatibility of IGMPv3. When the IGMPv2 Host Present timer expires and the IGMPv1 Host Present timer isn't running, the router switches to Group Compatibility mode of IGMPv3 🌈.
Now, real talk, there's a catch 💀. When a group switches back to IGMPv3 mode, it takes some time to regain source-specific state information. Source-specific info gets learned during the next General Query, but sources that should be blocked won't get blocked until [Group Membership Interval] after that. Not me getting weird vibes from that 🙈.
The Group Compatibility Mode variable is based on whether an older version report was heard in the last Older Version Host Present Timeout seconds. The Group Compatibility Mode gets set depending on the following:
Group Compatibility Mode Timer State
------------------------ -----------
IGMPv3 (default) IGMPv2 Host Present not running
and IGMPv1 Host Present not running
IGMPv2 IGMPv2 Host Present running
and IGMPv1 Host Present not running
IGMPv1 IGMPv1 Host Present runningIf a router gets a report that causes its older Host Present timers to be updated, and therefore its compatibility mode too, it SHOULD switch compatibility modes immediately ⚡.
When Group Compatibility Mode is IGMPv3, a router acts using the IGMPv3 protocol for that group 👑.
When Group Compatibility Mode is IGMPv2, a router internally translates the following IGMPv2 messages for that group into their IGMPv3 equivalents:
IGMPv2 Message IGMPv3 Equivalent
-------------- -----------------
Report IS_EX( {} )
Leave TO_IN( {} )IGMPv3 BLOCK messages get ignored, and so do source-lists in TO_EX() messages. In other words, any TO_EX() message is treated as TO_EX( {} ) 🙃.
When Group Compatibility Mode is IGMPv1, a router internally translates the following IGMPv1 and IGMPv2 messages for that group into their IGMPv3 equivalents:
IGMP Message IGMPv3 Equivalent
------------ -----------------
v1 Report IS_EX( {} )
v2 Report IS_EX( {} )On top of ignoring IGMPv3 BLOCK messages and source-lists in TO_EX() messages, just like in IGMPv2 Group Compatibility Mode, IGMPv1 mode also ignores IGMPv2 Leave messages and IGMPv3 TO_IN() messages 🧚.
8. List of Timers, Counters and Their Default Values 💖
Most of these timers are configurable. If non-default settings are used, they MUST be consistent among all systems on a single link 🎀. Note that parentheses are used to group expressions to make the algebra clear 🧮.
8.1. Robustness Variable
The Robustness Variable lets you tune for the packet loss you expect on a network. If a network is expected to be lossy, the Robustness Variable may be increased. IGMP is robust to (Robustness Variable - 1) packet losses. The Robustness Variable MUST NOT be zero, and SHOULD NOT be one. Default: 2 💜
8.2. Query Interval
The Query Interval is the interval between General Queries sent by the Querier. Default: 125 seconds ⏰.
By varying the [Query Interval], an administrator can tune the number of IGMP messages on the network. Larger values mean IGMP Queries get sent less often.
8.3. Query Response Interval
The Max Response Time used to calculate the Max Resp Code inserted into the periodic General Queries. Default: 100 (10 seconds) ⏳.
By varying the [Query Response Interval], an administrator can tune how bursty IGMP messages are on the network. Larger values make the traffic less bursty, since host responses get spread out over a larger interval. The number of seconds represented by the [Query Response Interval] must be less than the [Query Interval] 🌸.
8.4. Group Membership Interval
The Group Membership Interval is the amount of time that must pass before a multicast router decides there are no more members of a group or a particular source on a network 🔍.
This value MUST be ((the Robustness Variable) times (the Query Interval)) plus (one Query Response Interval) 🫶.
8.5. Other Querier Present Interval
The Other Querier Present Interval is the length of time that must pass before a multicast router decides that there's no longer another multicast router that should be the querier 👀.
This value MUST be ((the Robustness Variable) times (the Query Interval)) plus (one half of one Query Response Interval) 💅.
8.6. Startup Query Interval
The Startup Query Interval is the interval between General Queries sent by a Querier on startup. Default: 1/4 the Query Interval 🚀.
8.7. Startup Query Count
The Startup Query Count is the number of Queries sent out on startup, separated by the Startup Query Interval. Default: the Robustness Variable 🔁.
8.8. Last Member Query Interval
The Last Member Query Interval is the Max Response Time used to calculate the Max Resp Code inserted into Group-Specific Queries sent in response to Leave Group messages. It's also the Max Response Time used in calculating the Max Resp Code for Group-and-Source-Specific Query messages. Default: 10 (1 second) 🍓.
Note that for values of LMQI greater than 12.8 seconds, only a limited set of values can be represented, corresponding to sequential values of Max Resp Code. When converting a configured time to a Max Resp Code value, it is recommended to use the exact value if possible, or the next lower value if the requested value isn't exactly representable 🧠.
This value can be tuned to change the "leave latency" of the network. A reduced value means a shorter time to detect the loss of the last member of a group or source 🏃♀️.
8.9. Last Member Query Count
The Last Member Query Count is the number of Group-Specific Queries sent before the router assumes there are no local members. The Last Member Query Count is also the number of Group-and-Source-Specific Queries sent before the router assumes there are no listeners for a particular source. Default: the Robustness Variable 💫.
8.10. Last Member Query Time
The Last Member Query Time is the time value represented by the Last Member Query Interval, multiplied by the Last Member Query Count. It isn't a tunable value, but you can tune it by changing its components 🎯.
8.11. Unsolicited Report Interval
The Unsolicited Report Interval is the time between repetitions of a host's initial report of membership in a group. Default: 1 second 🌟.
8.12. Older Version Querier Present Timeout
The Older Version Querier Interval is the time-out for transitioning a host back to IGMPv3 mode once an older version query is heard. When an older version query is received, hosts set their Older Version Querier Present Timer to Older Version Querier Interval 🕰️.
This value MUST be ((the Robustness Variable) times (the Query Interval in the last Query received)) plus (one Query Response Interval) 💖.
8.13. Older Host Present Interval
The Older Host Present Interval is the time-out for transitioning a group back to IGMPv3 mode once an older version report is sent for that group. When an older version report is received, routers set their Older Host Present Timer to Older Host Present Interval 🦋.
This value MUST be ((the Robustness Variable) times (the Query Interval)) plus (one Query Response Interval) 🌈.
8.14. Configuring Timers
This section is meant to give network administrators advice on how to tune these settings for their network. Ambitious router implementations might tune these settings dynamically based on changing characteristics of the network 🛠️.
8.14.1. Robustness Variable
The Robustness Variable tunes IGMP to the losses expected on a link. IGMPv3 is robust to (Robustness Variable - 1) packet losses. For example, if the Robustness Variable is set to the default value of 2, IGMPv3 is robust to a single packet loss but may operate imperfectly if more losses occur. On lossy subnetworks, the Robustness Variable should be increased to allow for the expected level of packet loss. However, increasing the Robustness Variable increases the leave latency of the subnetwork. (The leave latency is the time between when the last member stops listening to a source or group and when the traffic stops flowing.) 🙃
8.14.2. Query Interval
The overall level of periodic IGMP traffic is inversely proportional to the Query Interval. A longer Query Interval results in a lower overall level of IGMP traffic. The Query Interval MUST be equal to or longer than the Max Response Time inserted in General Query messages 🕊️.
8.14.3. Max Response Time
The burstiness of IGMP traffic is inversely proportional to the Max Response Time. A longer Max Response Time spreads Report messages over a longer interval. However, a longer Max Response Time in Group-Specific and Source-and-Group-Specific Queries extends the leave latency. (The leave latency is the time between when the last member stops listening to a source or group and when the traffic stops flowing.) The expected rate of Report messages can be calculated by dividing the expected number of Reporters by the Max Response Time. The Max Response Time may be calculated dynamically per Query, using the expected number of Reporters for that Query as follows 📊:
Query Type Expected number of Reporters
---------- ----------------------------
General Query All systems on subnetwork
Group-Specific Query All systems that had expressed interest
in the group on the subnetwork
Source-and-Group- All systems on the subnetwork that had
Specific Query expressed interest in the source and groupA router isn't required to calculate these populations or tune the Max Response Time dynamically. These are simply guidelines 🌷.
9. Security Considerations 💀
We consider the ramifications of a forged message of each type, and describe the usage of IPSEC AH to authenticate messages if desired 🔐. Bestie, forged messages are the real villain here, so don't skip the IPSEC AH part 😤.
9.1. Query Message ✨
okay bestie, a forged Query message from a machine with a lower IP address than the current Querier will hand Querier duties over to the forger 💀. if the forger then sends no more Query messages, the other routers' Other Querier Present timer will time out and one of them will resume being Querier 🫶. during that gap, if the forger ignores Leave Messages, traffic might flow to groups with no members for up to [Group Membership Interval] 😬
a DoS attack on a host could be staged with forged Group-and-Source-Specific Queries 🙈. the attacker can find out about a specific host's membership with a general query. then it could send a huge pile of Group-and-Source-Specific queries, each with a big source list and the Maximum Response Time set to a big value. the host has to store and maintain the sources from all of those queries for as long as it takes to send the delayed response. that eats memory and CPU cycles, because it keeps augmenting the recorded sources with the source lists from each successive query 💀
to protect against this DoS attack, a host stack implementation could restrict the number of Group-and-Source-Specific Queries per group membership within this interval, and/or record only a limited number of sources 🌸
forged Query messages from the local network are super easy to trace 🔍 there are three measures necessary to defend against externally forged Queries:
- Routers SHOULD NOT forward Queries. This is easier for a router to do if the Query carries the Router-Alert option.
- Hosts SHOULD ignore v2 or v3 Queries without the Router-Alert option.
- Hosts SHOULD ignore v1, v2 or v3 General Queries sent to a multicast address other than 224.0.0.1, the all-systems address.
9.2. Current-State Report messages 💅
a forged Report message may cause multicast routers to think there are members of a group on a network when there aren't 👀 forged Report messages from the local network are meaningless, ngl, since joining a group on a host is generally an unprivileged operation. a local user can trivially get the same result without forging anything 🙄 forged Report messages from external sources are more troublesome, though. there are two defenses against externally forged Reports:
- Ignore the Report if you cannot identify the source address of the packet as belonging to a network assigned to the interface on which the packet was received. This solution means that Reports sent by mobile hosts without addresses on the local network will be ignored. Report messages with a source address of
0.0.0.0SHOULD be accepted on any interface. - Ignore Report messages without Router Alert options [RFC-2113], and require that routers not forward Report messages. (The requirement is not a requirement of generalized filtering in the forwarding path, since the packets already have Router Alert options in them.) This solution breaks backwards compatibility with implementations of IGMPv1 or earlier versions of IGMPv2 which did not require Router Alert 😭
a forged Version 1 Report Message may put a router into "version 1 members present" state for a particular group, meaning the router will ignore Leave messages 🥺 that can make traffic flow to groups with no members for up to [Group Membership Interval]. this can be solved by giving routers a configuration switch to ignore Version 1 messages completely. that breaks automatic compatibility with Version 1 hosts, so it should only be used in situations where "fast leave" is critical ⚡
a forged Version 2 Report Message may put a router into "version 2 members present" state for a particular group, meaning the router will ignore IGMPv3 source-specific state messages 🫠 that can cause traffic to flow from unwanted sources for up to [Group Membership Interval]. this can be solved by giving routers a configuration switch to ignore Version 2 messages completely. that breaks automatic compatibility with Version 2 hosts, so it should only be used in situations where source include and exclude is critical 👑
9.3. State-Change Report Messages 🦋
a forged State-Change Report message will cause the Querier to send out Group-Specific or Source-and-Group-Specific Queries for the group in question. that causes extra processing on each router and on each member of the group, but it can not cause loss of desired traffic 🧚 there are two defenses against externally forged State-Change Report messages:
- Ignore the State-Change Report message if you cannot identify the source address of the packet as belonging to a subnet assigned to the interface on which the packet was received. This solution means that State-Change Report messages sent by mobile hosts without addresses on the local subnet will be ignored. State-Change Report messages with a source address of
0.0.0.0SHOULD be accepted on any interface. - Ignore State-Change Report messages without Router Alert options [RFC-2113], and require that routers not forward State-Change Report messages. (The requirement is not a requirement of generalized filtering in the forwarding path, since the packets already have Router Alert options in them.)
9.4. IPSEC Usage 🔐
in addition to these measures, IPSEC in Authentication Header mode [AH] may be used to protect against remote attacks by making sure IGMPv3 messages came from a system on the LAN (or, more specifically, a system with the proper key) 🔑 when using IPSEC, the messages sent to 224.0.0.1 and 224.0.0.22 should be authenticated using AH. when it comes to keying, there are two possibilities:
- Use a symmetric signature algorithm with a single key for the LAN (or a key for each group). This allows validation that a packet was sent by a system with the key. The limitation is that any system with the key can forge a message, so it's not possible to authenticate the individual sender precisely. It also requires disabling IPSec's Replay Protection 🙃
- When appropriate key management standards have been developed, use an asymmetric signature algorithm. All systems need to know the public key of all routers, and all routers need to know the public key of all systems. This takes a large amount of key management, but the advantage is that senders can be authenticated individually, so e.g., a host cannot forge a message that only routers should be allowed to send 💜
this solution only directly applies to Query and Leave messages in IGMPv1 and IGMPv2, since Reports are sent to the group being reported and it is not feasible to agree on a key for host-to-router communication for arbitrary multicast groups 🥹
10. IANA Considerations 🎀
all IGMP types described in this document are already assigned in [IANA-REG]. ✅
11. Acknowledgments 🫶
we would like to thank Ran Atkinson, Luis Costa, Toerless Eckert, Dino Farinacci, Serge Fdida, Wilbert de Graaf, Sumit Gupta, Mark Handley, Bob Quinn, Michael Speer, Dave Thaler and Rolland Vida for comments and suggestions on this document 💖
portions of the text of this document were copied from [RFC-1112] and [RFC-2236] 📝
12. Normative References 📚
- [AH] Kent, S. and R. Atkinson, "IP Authentication Header", RFC 2402, November 1998.
- [IANA-REG] http://www.iana.org/assignments/igmp-type-numbers
- [RFC-1112] Deering, S., "Host Extensions for IP Multicasting", STD 5, RFC 1112, August 1989.
- [RFC-2113] Katz, D., "IP Router Alert Option," RFC 2113, February, 1997.
- [RFC-2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC-2236] Fenner, W., "Internet Group Management Protocol, Version 2", RFC 2236, November 1997.
- [RFC-3228] Fenner, B., "IANA Considerations for IPv4 Internet Group Management Protocol (IGMP)", BCP 57, RFC 3228, February 2002.
13. Informative References 🧠
- [RFC-1071] Braden, R., Borman, D. and C. Partridge, "Computing the Internet checksum", RFC 1071, September 1988.
- [FILTER-API] Thaler, D., B. Fenner, and B. Quinn, "Socket Interface Extensions for Multicast Source Filters", Work in Progress.
- [SSM] Bhattacharyya, S., et. al., "An Overview of Source-Specific Multicast (SSM)", Work in Progress.
- [MLD] Deering, S., Fenner, W. and B. Haberman, "Multicast Listener Discovery (MLD) for IPv6", RFC 2710, October 1999.
- [MLDV2] Vida, R., L. Costa, S. Fdida, S. Deering, B. Fenner, I. Kouvelas, and B. Haberman, "Multicast Listener Discovery Version 2 (MLDv2) for IPv6", Work in Progress.
Appendix A. Design Rationale 🌈
A.1. The Need for State-Change Messages 💭
IGMPv3 specifies two types of Membership Reports: Current-State and State Change. this section describes why both of these types of Reports are needed 🎯
routers need to tell apart Membership Reports that were sent in response to Queries from those sent because of a change in interface state 🕵️♀️ Membership reports sent in response to Membership Queries are used mainly to refresh the existing state at the router, and they typically do not cause transitions in state at the router. Membership Reports sent in response to changes in interface state require the router to take some action in response to the received report (see Section 6.4).
the inability to tell the two types of reports apart would force a router to treat all Membership Reports as potential changes in state. that could mean more processing at the router and more IGMP traffic on the network 😵💫
A.2. Host Suppression 🙅♀️
in IGMPv1 and IGMPv2, a host would cancel sending a pending membership report if a similar report was observed from another member on the network. in IGMPv3, this suppression of host membership reports has been removed 🗑️ here's the reasoning behind that decision:
- Routers may want to track per-host membership status on an interface. This allows routers to implement fast leaves (e.g., for layered multicast congestion control schemes) as well as track membership status for possible accounting purposes 📊
- Membership Report suppression does not work well on bridged LANs. Many bridges and Layer2/Layer3 switches that implement IGMP snooping do not forward IGMP messages across LAN segments in order to prevent membership report suppression. Removing membership report suppression eases the job of these IGMP snooping devices 🌉
- By eliminating membership report suppression, hosts have fewer messages to process. This leads to a simpler state machine implementation 🧩
- In IGMPv3, a single membership report now bundles multiple multicast group records to decrease the number of packets sent. In comparison, the previous versions of IGMP required that each multicast group be reported in a separate message 📦
A.3 Switching Router Filter Modes from EXCLUDE to INCLUDE ✨
okay so, if there are hosts in both EXCLUDE and INCLUDE mode for a single multicast group in a network, the router must be in EXCLUDE mode too (check section 6.2.1 🎀). in EXCLUDE mode, the router forwards traffic from every source unless that source is in the exclusion source list 💅. now, if every EXCLUDE host ghosts the network, it would be super desirable for the router to flip back to INCLUDE mode seamlessly, so traffic keeps flowing to existing receivers without a hiccup 🦋
one way to pull this off is for routers to keep track of every source wanted by hosts in INCLUDE mode, even while the router itself is sitting in EXCLUDE mode 🧚. if the group timer expires while the router is in EXCLUDE mode, that tells you there are no EXCLUDE-mode hosts left on the network, because otherwise a membership report from that host would have refreshed the group timer 🙄. so the router can switch to INCLUDE mode seamlessly, using the list of sources it's currently forwarding as its source list. iconic 👑
Appendix B. Summary of Changes from IGMPv2 🍓
okay so the big headline feature of IGMPv3 is source filtering, obviously 😭 but here's the rest of the glow-up from RFC 2236:
- State is maintained as Group + List-of-Sources, not simply Group as in IGMPv2 💖
- Interoperability with IGMPv1 and IGMPv2 systems is defined as operations on the IGMPv3 state 🫶
- The IP Service Interface has changed to allow specification of source-lists ✨
- The Querier includes its Robustness Variable and Query Interval in Query packets, so these variables can be synchronized on non-Queriers 🎀
- The Max Response Time in Query messages has an exponential range, which takes the maximum from 25.5 seconds to about 53 minutes. that's for links with huge numbers of systems, bestie 🌈
- Hosts retransmit state-change messages for increased robustness 💪
- Additional data sections are defined to allow later extensions 🧚
- Report packets are sent to 224.0.0.22, to help layer-2 switches do "snooping" 👀
- Report packets can contain multiple group records, so full current state can be reported using fewer packets 🦋
- Hosts no longer perform suppression. this simplifies implementations and permits explicit membership tracking, which is so clean 🧼
- The new Suppress Router-Side Processing (S) flag in Query messages fixes robustness issues that were also present in IGMPv2. no more drama 💅
Authors' Addresses 💌
Brad Cain
Cereva Networks
Steve Deering
Cisco Systems, Inc.
170 Tasman Drive
San Jose, CA 95134-1706
Phone: +1-408-527-8213
EMail: deering@cisco.com
Bill Fenner
AT&T Labs - Research
75 Willow Rd.
Menlo Park, CA 94025
Phone: +1-650-330-7893
EMail: fenner@research.att.com
Isidor Kouvelas
Cisco Systems, Inc.
170 Tasman Drive
San Jose, CA 95134-1706
Phone: +1-408-525-0727
EMail: kouvelas@cisco.com
Ajit Thyagarajan
Ericsson IP InfrastructureFull Copyright Statement ⚖️
Copyright (C) The Internet Society (2002). All Rights Reserved.
bestie, the legal bit is important, so here it is in full 🫶. this document and translations of it may be copied and furnished to others. derivative works that comment on or otherwise explain it, or help with its implementation, may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, as long as the above copyright notice and this paragraph are included on all such copies and derivative works. however, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations. the exceptions are when it's needed for developing Internet standards, in which case the procedures for copyrights defined in the Internet Standards process must be followed, or when it's required to translate it into languages other than English 🌸.
the limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns 💜.
this document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 🙏
funding for the RFC Editor function is currently provided by the Internet Society 💖.
📦 where this page comes from
- ietf: rfc3376 2002-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms