RFC 4605
Internet Group Management Protocol (IGMP) / Multicast Listener Discovery (MLD)-Based Multicast Forwarding ("IGMP/MLD Proxying")
Title Block ✨
Okay bestie, this is the RFC 📜 with the official number RFC 4605, published August 2006 on the Standards Track 🦋. It's called Internet Group Management Protocol (IGMP) / Multicast Listener Discovery (MLD)-Based Multicast Forwarding ("IGMP/MLD Proxying") 💜.
The authors are a whole squad 🫶:
- B. Fenner from AT&T Research
- H. He from Nortel
- B. Haberman from JHU-APL
- H. Sandick from Little River Elementary School 🍓
The title block doesn't list anything this document obsoletes or updates, so it stands on its own 💅. It's also a Standards Track doc, which means it's a real spec people are meant to build against, not just a vibe 🔥.
Status of This Memo 🌸
This document is an Internet standards track protocol for the Internet community, and it's basically asking for your feedback and suggestions to make it better 💖. If you want to know where this protocol stands in the official standardization process, check the current edition of "Internet Official Protocol Standards" (STD 1) 📚. Distribution of this memo is unlimited, so share away 🦋.
Copyright Notice ⭐
Copyright (C) The Internet Society (2006). 🌈
Abstract 🧚
Okay so here's the tea ☕. In some network layouts, you don't even need a multicast routing protocol. A device can just learn who's signed up for which group, proxy that info upstream, and forward multicast packets based on it. Literally that's it 💅. This doc describes exactly how to do forwarding based only on IGMP or MLD membership info 🔥.
1. Introduction ✨
This document takes spanning tree multicast routing [MCAST] and applies it to an environment that only uses IGMP or MLD 💜. The topology has to be a tree, because we don't specify any protocol for building a spanning tree over anything more complicated 🌳. The root of the tree is assumed to be plugged into a wider multicast infrastructure 🔌.
1.1. Motivation 💖
So in a simple tree topology, you don't need a multicast routing protocol at all 🙈. You can just learn and proxy the group membership info and forward multicast packets based on that. A super typical example of this is an edge aggregation box, like a Digital Subscriber Line Access Multiplexer (DSLAM) 🎀. Most of the time, an edge box has one connection to the core network and lots of connections to customers 👑.
Using IGMP/MLD-based forwarding to replicate multicast traffic on things like edge boxes can seriously simplify how those devices are designed and built 😭. Skipping the fancier multicast routing protocols, like Protocol Independent Multicast (PIM) or Distance Vector Multicast Routing Protocol (DVMRP), cuts costs and operational overhead 💅. It also makes the proxy devices independent of whatever multicast routing protocol the core routers are running, so they can be deployed pretty much anywhere in a multicast network 🦋.
Robustness on an edge box usually comes from a hot spare connection to the core network 🛟. If the first connection dies, the box fails over to the second one 💀. IGMP/MLD-based forwarding can use that spare connection as its redundant or backup link to multicast routers ✨. And when the edge box fails over, the proxy upstream connection can also get updated to the new one 🫶.
1.2. Applicability Statement 🎀
Real talk: IGMP/MLD-based forwarding only works in a simple tree topology 🌳. You have to manually set up the tree by designating upstream and downstream interfaces on each proxy device 🛠️. Also, the IP addressing scheme on the proxying tree SHOULD be configured so a proxy device can win the IGMP/MLD Querier election and actually forward multicast traffic 👑. There are no other multicast routers in the tree besides the proxy devices, and the root is expected to be connected to a wider multicast infrastructure 🔌. This protocol is limited to a single administrative domain, so don't try to stretch it across several 🙅♀️.
If things get more complicated, like the topology isn't a tree, you need a sturdier failover mechanism, or more than one administrative domain is involved, then a multicast routing protocol should be used instead 💅.
1.3. Conventions 🌈
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖.
This document comes out of the Multicast & Anycast Group Membership (MAGMA) working group in the Internet Engineering Task Force 🧚. Comments are super welcome and should go to the working group's mailing list at magma@ietf.org and/or the authors 💌.
2. Definitions 📚
2.1. Upstream Interface ⬆️
This is a proxy device's interface pointing in the direction of the root of the tree 🌳. It's also called the "Host interface" 💜.
2.2. Downstream Interface ⬇️
Every interface on a proxy device that is not pointing toward the root of the tree counts as a downstream interface 🫶. These are also called the "Router interfaces" 🦋.
2.3. Group Mode 🎀
Okay, group modes are where it gets fun 🔥.
In IPv4 environments, each multicast group gets a mode based on what gets heard on the wire 👂. A group is in IGMP version 1 (IGMPv1) [RFC1112] mode if an IGMPv1 report is heard 🌸. A group is in IGMP version 2 (IGMPv2) [RFC2236] mode if an IGMPv2 report is heard but no IGMPv1 report is heard 💖. A group is in IGMP version 3 (IGMPv3) [RFC3376] mode if an IGMPv3 report is heard but no IGMPv1 or IGMPv2 report is heard 🧚.
In IPv6 environments, it works the same way for each multicast group 💅. A group is in MLD version 1 (MLDv1) [RFC2710] mode if an MLDv1 report is heard 🌈. MLDv1 is equivalent to IGMPv2 ✨. A group is in MLD version 2 (MLDv2) [MLDv2] mode if an MLDv2 report is heard but no MLDv1 report is heard 🦋. MLDv2 is equivalent to IGMPv3 👑.
2.4. Subscription 💌
When a group is in IGMPv1 or IGMPv2/MLDv1 mode, the subscription is just a group membership on an interface 🎀. When a group is in IGMPv3/MLDv2 mode, the subscription is an IGMPv3/MLDv2 state entry instead 🔥. That's a tuple of (multicast address, group timer, filter-mode, source-element list) living on an interface 💜.
2.5. Membership Database 🗂️
This is the database each proxy device keeps, where it merges the membership info from all of its downstream interfaces 🫶. It's made up of membership records shaped like this:
(multicast-address, filter-mode, source-list)For what the fields "filter-mode" and "source-list" actually mean, check the IGMPv3/MLDv2 [RFC3376, MLDv2] specs 📖. How the membership database behaves is defined in section 4.1 💅.
3. Abstract Protocol Definition ✨
okay so picture a proxy device doing IGMP/MLD-based forwarding 🎀. it has a single upstream interface and one or more downstream interfaces, and the labels are set by hand because there's no protocol that figures out which interface is which 💅. on the downstream side it runs the router part of IGMP [RFC1112, RFC2236, RFC3376] or MLD [RFC2710, MLDv2], and on the upstream side it acts like a host for IGMP/MLD. the vibe is clear: it MUST NOT do the router part on its upstream interface, period 🙅♀️
the proxy keeps a database that's basically the merge of every subscription on every downstream interface 🧚. for the full scoop on how that database gets built and kept up to date, go check Section 4 bc it's giving detail 📖
the proxy answers queries by sending IGMP/MLD membership reports on the upstream interface 💌. when the database changes, it sends unsolicited reports or leaves too, so upstream always knows what's up 🦋
when a packet shows up for a multicast group (or a channel in Source-Specific Multicast (SSM)) 👀, the proxy builds a list. the list has the upstream interface plus any downstream interface that has a subscription for that packet AND where the proxy is the IGMP/MLD Querier. the list can be built on the fly or cached 🌸. then the proxy removes the interface the packet came in on and forwards it to everything left, and that can include the upstream interface too 🔥
now the querier thing is lowkey the most important part 😭. a proxy has to be the querier in order to forward packets, and that restricts the IP addressing scheme you can use. the IGMP/MLD forwarding devices have to hold the lowest IP addresses of any potential IGMP/MLD Querier on the link so they win the querier election 🏆. the rule is simple: the Querier with the lowest IP address wins. (the election rule itself lives in the IGMP/MLD specs as part of normal IGMP/MLD behavior 📚.) so in a forwarding-only setup, if a non-proxy device wins the querier election, no packets will flow 💀
here's the example figure 🎀:
LAN 1 --------------------------------------
Upstream | | Upstream
A(non-proxy) B(proxy)
Downstream |(lowest IP) | Downstream
LAN 2 --------------------------------------device A has the lowest IP address on LAN 2 but it's NOT a proxy 🙈. by the querier election rule, A wins on LAN 2 since it's got the lowest IP. so device B won't forward traffic to LAN 2 because it isn't the querier there. not the vibe 😭
the reason we do this is to avoid local loops and redundant traffic on links that more than one IGMP/MLD-based forwarder considers downstream 🔁. the rule "piggy-backs" forwarder election on top of the querier election 🎀. using the querier election to pick the forwarding proxy gets you similar results on the local link as the PIM Assert mechanism does 💅. on a link with only one IGMP/MLD-based forwarding device, this rule MAY be disabled (the device MAY be configured to forward packets to an interface where it is not the querier) ✨. BUT the default configuration MUST include the querier rule, for redundancy purposes and stuff, like in this figure 🦋:
LAN 1 --------------------------------------
Upstream | | Upstream
A B
Downstream | | Downstream
LAN 2 --------------------------------------LAN 2 can have two proxy devices, A and B 👯. in that setup one proxy has to be picked to forward the packets. this document requires that the forwarder must be the IGMP/MLD querier 🫶. so proxy A only forwards packets to LAN 2 if A is the querier. in the figure above, if A is the only proxy, A can be configured to forward even when B is the querier ✨
heads up though, this does NOT protect you from an "upstream loop" ⚠️. check this one out:
LAN 1 --------------------------------------
Upstream | | Downstream
A B
Downstream | | Upstream
LAN 2 --------------------------------------B will unconditionally forward packets from LAN 1 to LAN 2, and A will unconditionally forward packets from LAN 2 to LAN 1 😱. that's an upstream loop. a multicast routing protocol that uses a tree building algorithm is required to resolve loops like this 🌀
3.1. Topology Restrictions
this spec only works in a simple tree topology 🌳. the tree has to be configured manually by designating upstream and downstream interfaces on each proxy device, and the root of the tree is expected to connect to a wider multicast infrastructure 🌐
3.2. Supporting Senders
so for senders inside the proxy tree to send, all the traffic gets forwarded toward the root 🧭. the multicast routers connected to the wider infrastructure should be configured to treat every system inside the proxy tree as if it were directly connected 💖. for Protocol Independent Multicast - Sparse Mode (PIM-SM) [PIM-SM], those routers should Register-encapsulate traffic from new sources inside the proxy tree, just like they would for directly-connected sources 🎀
this info is probably going to be configured manually, bc IGMP/MLD-based forwarding gives the upstream routers no way to know what networks are behind the proxy tree 😭. if the proxy topology lines up with some routing topology, though, this info MAY be learned from the routing protocol running on that topology 🧠. like, a router could be set up to treat multicast packets from every prefix learned from routing protocol X via interface Y as if they came from a directly connected system 🦋
4. Proxy Device Behavior ✨
this section goes deeper into what an IGMP/MLD-based multicast forwarding device actually does 🔍
4.1. Membership Database
the proxy runs the router part of IGMP/MLD on each downstream interface 💅. for each interface, the IGMP/MLD version is configured explicitly, and it defaults to the highest version the system supports 🌈
the output of that protocol is a set of subscriptions, and that set is kept separately on each downstream interface 📦. then the subscriptions from all downstream interfaces get merged into the membership database 🫧
the membership database is a bunch of membership records that look like this:
(multicast-address, filter-mode, source-list)each record is the result of merging all the subscriptions for that record's multicast-address on the downstream interfaces 🧩. if some subscriptions are IGMPv1 or IGMPv2/MLDv1 subscriptions, they get converted to IGMPv3/MLDv2 subscriptions 🔄. the IGMPv3/MLDv2 subscriptions and the converted ones are preprocessed first. that means removing the timers, and if the filter mode is EXCLUDE, removing every source whose source timer is > 0 ⏰. then the preprocessed subscriptions get merged using the merging rules for multiple memberships on a single interface (from Section 3.2 of the IGMPv3 specification [RFC3376] and Section 4.2 of the MLDv2 specification [MLDv2]) to make the final membership record 🎀
here's an example 👀. there are two downstream interfaces, I1 and I2, both with subscriptions for multicast address G. I1 has an IGMPv2/MLDv1 subscription that's just (G). I2 has an IGMPv3/MLDv2 subscription with membership information (G, INCLUDE, (S1, S2)). I1's subscription gets converted into an IGMPv3/MLDv2 subscription with membership information (G, EXCLUDE, NULL). then both subscriptions get preprocessed and merged, and the final membership record is (G, EXCLUDE, NULL) 💅
the proxy performs the host part of IGMP/MLD on the upstream interface 🙌. if there's an IGMPv1 or IGMPv2/MLDv1 querier on the upstream network, the proxy runs IGMPv1 or IGMPv2/MLDv1 on the upstream interface to match. otherwise it runs IGMPv3/MLDv2 🔁
if the proxy runs IGMPv3/MLDv2 on the upstream interface, then whenever the database's composition changes, that change gets reported upstream as if the proxy were a host doing the action 📢. if the proxy runs IGMPv1 or IGMPv2/MLDv1 upstream, then changes only get reported when membership records are created or deleted. everything else gets ignored 🙈. and when the proxy reports using IGMPv1 or IGMPv2/MLDv1, only the multicast address field of the membership record gets used 💖
4.2. Forwarding Packets
a proxy forwards packets it receives on its upstream interface to each downstream interface, based on that downstream interface's subscriptions and on whether the proxy is the IGMP/MLD Querier on each interface 🚀. packets the proxy receives on any downstream interface get forwarded to the upstream interface, plus to every other downstream interface (except the incoming one), again based on those interfaces' subscriptions and on whether the proxy is the querier on each one 🫶
the proxy MAY use a forwarding cache so it doesn't have to make this decision for every single packet ⚡. BUT it MUST update that cache using these rules any time any of the info used to build it changes 🔄. no stale caches, bestie 💅
4.3. SSM Considerations
to support Source-Specific Multicast (SSM), the proxy should be compliant with the spec about using IGMPv3 for SSM [SSM] 📜. the proxy should be compliant with both the IGMP Host Requirement and the IGMP Router Requirement for SSM, since it does the IGMP Host portion on the upstream interface and the IGMP Router portion on each downstream interface 🎀
an interface can be configured to run IGMPv1 or IGMPv2 🙈. in that case, SSM semantics won't be maintained on that interface 😭. still, a proxy that supports this document should ignore those IGMPv1 or IGMPv2 subscriptions sent to SSM addresses 🚫. and the really important part: packets with source-specific addresses SHOULD NOT be forwarded to interfaces with IGMPv2 or IGMPv1 subscriptions for those addresses 💀🔥
5. Security Considerations 🔐
okay bestie, this one is a little scary 😭 Only the Querier actually forwards packets, so if the IGMP/MLD Querier election picks a router that isn't a forwarder, it's a full black hole 🕳️. And an attacker on a downstream LAN can literally make itself the Querier, which means zero packets get forwarded. Not iconic at all 💀.
However, there are some operational ways to dodge this, and they're giving practical energy ✨. It's pretty common for operators to number their routers starting from the bottom of the subnet. So an operator SHOULD assign the subnet's lowest IP address(es) to a proxy (proxies) so that the proxy (proxies) wins the querier election 🧚.
IGMP/MLD-based forwarding does NOT have the "upstream loop" detection mechanism from Section 3. So to avoid the chaos an "upstream loop" causes, it MUST be administratively assured that such loops don't exist when you deploy IGMP/MLD Proxying. No loops, no exceptions, periodt 🙅♀️.
Also, the group membership info the proxy sends upstream is the combined total of all its downstream membership info 🫧. That means any access control the upstream router applies to group membership can't be applied to one single subscriber. The access control hits every interested host behind the proxy equally. So it's all or nothing, bestie 🤷♀️.
6. Acknowledgements 🫶
Big thank you to Erik Nordmark, Dave Thaler, Pekka Savola, Karen Kimball, and others 💜 for reviewing the spec and dropping their comments. The authors really appreciated the support ✨.
7. Normative References 📚
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3376] Cain, B., Deering, S., Kouvelas, I., Fenner, B., and A.
Thyagarajan, "Internet Group Management Protocol, Version
3", RFC 3376, October 2002.
[RFC2236] Fenner, W., "Internet Group Management Protocol, Version
2", RFC 2236, November 1997.
[RFC1112] Deering, S., "Host extensions for IP multicasting", STD 5,
RFC 1112, August 1989.
[RFC2710] Deering, S., Fenner, W., and B. Haberman, "Multicast
Listener Discovery (MLD) for IPv6", RFC 2710, October
1999.
[MLDv2] Vida, R. and L. Costa, "Multicast Listener Discovery
Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.
[SSM] Holbrook, H., Cain, B., and B. Haberman, "Using Internet
Group Management Protocol Version 3 (IGMPv3) and Multicast
Listener Discovery Protocol Version 2 (MLDv2) for Source-
Specific Multicast", RFC 4604, August 2006.8. Informative References 💡
[MCAST] Deering, S., "Multicast Routing in a Datagram
Internetwork", Ph.D. Thesis, Stanford University, December
1991.
[PIM-SM] Fenner, B., Handley, M., Holbrook, H., and I. Kouvelis,
"Protocol Independent Multicast - Sparse Mode (PIM-SM):
Protocol Specification (Revised)", RFC 4601, August 2006.Authors' Addresses 🖊️
Bill Fenner
AT&T Labs - Research
1 River Oaks Place
San Jose, CA 95134
Phone: +1 408 493-8505
EMail: fenner@research.att.com
Haixiang He
Nortel
600 Technology Park Drive
Billerica, MA 01821
EMail: haixiang@nortel.com
Brian Haberman
Johns Hopkins University Applied Physics Lab
11100 Johns Hopkins Road
Laurel, MD 20723-6099
EMail: brian@innovationslab.net
Hal Sandick
Little River Elementary School
2315 Snow Hill Road
Durham, NC 27712
EMail: sandick@nc.rr.comFull Copyright Statement ⚖️
Copyright (C) The Internet Society (2006). 🌸
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🦋
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 💌
Acknowledgement 💜
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). ✨
📦 where this page comes from
- ietf: rfc4605 2006-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms