RFC 9776
Internet Group Management Protocol, Version 3
RFC 9776: Internet Group Management Protocol, Version 3 🦋
Okay bestie, the title block is the vibe check ✨ This one is RFC 9776, written by B. Haberman, Ed. at JHU APL and published in March 2025. It's a Standards Track document, so it's a real Internet Standard and it's filed as STD: 100 🎀. The ISSN is 2070-1721. It obsoletes RFC 3376 (so the old version is retired, bye 👋) and updates RFC 2236 (IGMPv2 gets some new rules too).
Abstract 🌸
Okay so IGMP is the protocol IPv4 systems use to tell their neighboring multicast routers which multicast groups they're in, aka their group memberships 🧚 IGMP Version 3 (IGMPv3) levels this up with source filtering. That means a system can say "I only want packets from these specific sources," or "I want everything except these sources," for a given multicast address. Multicast routing protocols can use that info so they don't send packets from certain sources to networks where nobody wants them. Efficient and iconic 💅
This document specifies IGMPv3. It's a revised version of RFC 3376 with clarifications and errata fixes, and it stays backward compatible with RFC 3376 🫶
This document updates RFC 2236 and obsoletes RFC 3376.
Status of This Memo 💜
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG) 👑 If you want more on Internet Standards, check out Section 2 of RFC 7841.
Want the current status, any errata, or a way to send feedback? Head to https://www.rfc-editor.org/info/rfc9776 ✨
Copyright Notice 🌈
Copyright (c) 2025 IETF Trust and the people listed as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the publication date. Read these carefully, because they spell out your rights and restrictions for this document 📜 Code Components pulled out of this document have to include the Revised BSD License text described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Revised BSD License says.
This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people who control the copyright in some of that material might not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. So unless you get a proper license from whoever controls that copyright, this document can't be modified outside the IETF Standards Process, and derivative works can't be made outside it either. The only exceptions are formatting it for publication as an RFC or translating it into languages other than English 🌸
Table of Contents 🎀
1. Introduction
1.1. Conventions Used in This Document
2. The Service Interface for Requesting IP Multicast Reception
3. Multicast Reception State Maintained by Systems
3.1. Socket State
3.2. Interface State
4. Message Formats
4.1. Membership Query Message
4.1.1. Max Response Code
4.1.2. Checksum
4.1.3. Group Address
4.1.4. Flags
4.1.5. S Flag (Suppress Router-Side Processing)
4.1.6. QRV (Querier's Robustness Variable)
4.1.7. QQIC (Querier's Query Interval Code)
4.1.8. Number of Sources (N)
4.1.9. Source Address [i]
4.1.10. Additional Data
4.1.11. Query Variants
4.1.12. IP Destination Addresses for Queries
4.2. IGMPv3 Membership Report Message
4.2.1. Reserved
4.2.2. Checksum
4.2.3. Flags
4.2.4. Number of Group Records (M)
4.2.5. Group Record
4.2.6. Record Type
4.2.7. Aux Data Len
4.2.8. Number of Sources (N)
4.2.9. Multicast Address
4.2.10. Source Address [i]
4.2.11. Auxiliary Data
4.2.12. Additional Data
4.2.13. Group Record Types
4.2.14. IP Source Addresses for Reports
4.2.15. IP Destination Addresses for Reports
4.2.16. Notation for Group Records
4.2.17. Membership Report Size
5. Description of the Protocol for Group Members
5.1. Action on Change of Interface State
5.2. Action on Reception of a Query
6. Description of the Protocol for Multicast Routers
6.1. Conditions for IGMP Queries
6.2. IGMP State Maintained by Multicast Routers
6.2.1. Definition of Router Filter Mode
6.2.2. Definition of Group Timers
6.2.3. Definition of Source Timers
6.3. IGMPv3 Source-Specific Forwarding Rules
6.4. Action on Reception of Reports
6.4.1. Reception of Current-State Records
6.4.2. Reception of Filter-Mode-Change and Source-List-Change
Records
6.5. Switching Router Filter Modes
6.6. Action on Reception of Queries
6.6.1. Timer Updates
6.6.2. Querier Election
6.6.3. Building and Sending Specific Queries
7. Interoperation With Older Versions of IGMP
7.1. Query Version Distinctions
7.2. Group Member Behavior
7.2.1. In the Presence of Older Version Queriers
7.2.2. In the Presence of Older Version Group Members
7.3. Multicast Router Behavior
7.3.1. In the Presence of Older Version Queriers
7.3.2. In the Presence of Older Version Group Members
8. List of Timers, Counters, and Their Default Values
8.1. Robustness Variable
8.2. Query Interval
8.3. Query Response Interval
8.4. Group Membership Interval
8.5. Other Querier Present Interval
8.6. Startup Query Interval
8.7. Startup Query Count
8.8. Last Member Query Interval
8.9. Last Member Query Count
8.10. Last Member Query Time
8.11. Unsolicited Report Interval
8.12. Older Version Querier Present Interval
8.13. Older Host Present Interval
8.14. Configuring Timers
8.14.1. Robustness Variable
8.14.2. Query Interval
8.14.3. Max Response Time
9. Security Considerations
9.1. Query Message
9.2. Current-State Report Messages
9.3. State-Change Report Messages
9.4. IPsec Usage
10. IANA Considerations
11. References
11.1. Normative References
11.2. Informative References
Appendix A. Design Rationale
A.1. The Need for State-Change Messages
A.2. Host Suppression
A.3. Switching Router Filter Modes from EXCLUDE to INCLUDE
Appendix B. Summary of Changes from IGMPv2
Appendix C. Summary of Changes from RFC 3376
Acknowledgments
Contributors
Author's Address1. Introduction 💖
Okay so IGMP is used by IPv4 systems (that's hosts and routers) to report their IP multicast group memberships to any neighboring multicast routers 🧚 Here's a fun twist: a multicast router can also be a member of one or more multicast groups. When that happens, it runs both the multicast router part of the protocol (to collect the membership info its multicast routing protocol needs) and the group member part (to tell itself and its neighboring routers about its own memberships) 🔥
IGMP also handles other multicast management jobs, using message types that aren't for group membership reporting. This document only covers the group membership reporting functions and messages, so that's our focus ✨
This document specifies Version 3 of IGMP. Version 1, described in [RFC1112], was the first widely deployed version and the first one to become an Internet Standard 👑 Version 2, described in [RFC2236], added support for low leave latency. That means cutting down the time a multicast router takes to figure out that no members of a particular group are left on an attached network 💅 Version 3 adds source filtering, which lets a system report interest in packets only from specific source addresses. That's needed for Source-Specific Multicast (SSM) [RFC3569]. It can also report interest in everything except specific source addresses, sent to a particular multicast address. Version 3 is designed to play nicely with Versions 1 and 2 🫶
This document uses "SSM-aware" to mean systems that support SSM as defined in [RFC4607] 🦋
This document updates [RFC2236] because a proper implementation of IGMPv3 needs to handle IGMPv2 Report and Leave messages 🌸
This document obsoletes [RFC3376] because it brings clarifications and errata fixes for [RFC3376]. All the detailed changes are listed in Appendix C 💜
1.1. Conventions Used in This Document 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 💅
2. The Service Interface for Requesting IP Multicast Reception ✨
okay so, inside an IP system there's (at least conceptually) a service interface 🎀 that upper-layer protocols or application programs use to ask the IP layer to switch reception of packets sent to specific IP multicast addresses on or off 💅. To get the full glow-up from IGMPv3 ✨, a system's IP service interface must support this operation:
IPMulticastListen ( socket, interface, multicast-address,
filter-mode, source-list )where:
- "socket" is an implementation-specific parameter that tells apart the different requesting entities (like programs or processes) inside the system 🧚. The socket parameter of BSD Unix system calls is a specific example.
- "interface" is a local identifier for the network interface where reception of the specified multicast address gets enabled or disabled 🦋. Interfaces may be physical (like an Ethernet interface) or virtual (like the endpoint of a Frame Relay virtual circuit or the endpoint of an IP-in-IP "tunnel"). An implementation may let a special "unspecified" value get passed as the interface parameter, and then the request applies to the "primary" or "default" interface of the system (maybe set up by system configuration) 🌸. If you want reception of the same multicast address on more than one interface, IPMulticastListen gets invoked separately for each interface you want, no shortcuts 🙈.
- "multicast-address" is the IP multicast address, or group, that the request is about 💜. If you want reception of more than one multicast address on a given interface, IPMulticastListen gets invoked separately for each one.
- "filter-mode" can be either INCLUDE or EXCLUDE 🔥. In INCLUDE mode, reception of packets sent to the specified multicast address is only requested from the IP source addresses listed in the source-list parameter. In EXCLUDE mode, reception of packets sent to the given multicast address is requested from all IP source addresses except the ones listed in the source-list parameter. Main character energy either way 👑.
- "source-list" is an unordered list of zero or more IP unicast addresses that multicast reception is wanted from or not wanted from, depending on the filter-mode 🍓. An implementation MAY impose a limit on the size of source-lists, but that limit MUST NOT be less than 64 addresses per list. When an operation makes the source-list size limit get exceeded, the service interface MUST return an error. no exceptions, bestie 😭.
For any given combination of socket, interface, and multicast address, only a single filter-mode and source-list can be in effect at one time 🫶. BUT (lol) either the filter-mode or the source-list, or both, can get changed by later IPMulticastListen requests that specify the same socket, interface, and multicast address ✨. Each new request completely replaces any earlier request for that socket, interface, and multicast address. Fresh start every time 💅.
Older versions of IGMP didn't support source filters and had a simpler service interface 🌈. It was just Join and Leave operations to turn reception of a given multicast address (from all sources) on or off on a given interface. The equivalent operations in the new service interface look like this:
The Join operation is equivalent to:
IPMulticastListen ( socket, interface, multicast-address,
EXCLUDE, {} )and the Leave operation is equivalent to:
IPMulticastListen ( socket, interface, multicast-address,
INCLUDE, {} )where {} is an empty source-list 🍓.
An example of an API that gives you the capabilities outlined in this service interface is in [RFC3678] 🎀.
3. Multicast Reception State Maintained by Systems
3.1. Socket State
For each socket that IPMulticastListen has been invoked on, the system keeps track of the desired multicast reception state for that socket 🧚. That state conceptually consists of a set of records that look like this:
(interface, multicast-address, filter-mode, source-list)The socket state evolves every time IPMulticastListen is invoked on the socket, like so:
- If the requested filter-mode is INCLUDE and the requested source-list is empty, then the entry for the requested interface and multicast address gets deleted (if it's there). If there's no such entry, the request is ignored 🙈.
- If the requested filter-mode is EXCLUDE or the requested source-list is non-empty, then the entry for the requested interface and multicast address, if it's there, gets changed to hold the requested filter-mode and source-list 🦋. If there's no such entry, a new one gets created using the parameters from the request ✨.
3.2. Interface State
Besides the per-socket multicast reception state, a system must also maintain or compute multicast reception state for each of its interfaces 💜. That state conceptually consists of a set of records that look like this:
(multicast-address, filter-mode, source-list)There's at most one record per multicast-address for a given interface 🌸. This per-interface state is derived from the per-socket state, but it can be different from the per-socket state when different sockets have different filter-modes and/or source-lists for the same multicast address and interface 👑. For example, say one application or process invokes this on socket s1:
IPMulticastListen ( s1, i, m, INCLUDE, {a, b, c} )requesting reception on interface i of packets sent to multicast address m, only if they come from source a, b, or c. Then another application or process invokes this on socket s2:
IPMulticastListen ( s2, i, m, INCLUDE, {b, c, d} )requesting reception on the same interface i of packets sent to the same multicast address m, only if they come from sources b, c, or d 🔥. To make both sockets happy, interface i has to receive packets sent to m from any one of the sources a, b, c, or d. So in this example, the reception state of interface i for multicast address m has filter-mode INCLUDE and source-list {a, b, c, d} 🫶.
After the IP layer accepts a multicast packet from an interface, its delivery to the application or process listening on a particular socket depends on that socket's multicast reception state 🦋. It can also depend on other conditions, like which transport-layer port the socket is bound to 🍓. So in the example above, if a packet shows up on interface i, destined for multicast address m, with source address a, it gets delivered on socket s1 but not on socket s2 💅. Also note that IGMP Queries and Reports are not subject to source filtering, and hosts and routers must always process them ✨.
Filtering packets based on a socket's multicast reception state is a feature of this service interface 🎀. The previous service interface [RFC1112] didn't do any filtering based on multicast join state. Instead, a join on a socket just made the host join a group on the given interface, and packets for that group could be delivered to all sockets, whether they had joined or not 🙈.
Here are the general rules for deriving the per-interface state from the per-socket state 🧠. For each distinct (interface, multicast-address) pair that shows up in any socket state, a per-interface record is created for that multicast address on that interface. Then, looking at all the socket records with the same (interface, multicast-address) pair:
- If any such record has a filter-mode of EXCLUDE, then the filter-mode of the interface record is EXCLUDE, and the source-list of the interface record is the intersection of the source-lists of all socket records in EXCLUDE mode, minus those source addresses that appear in any socket record in INCLUDE mode 💖. For example, if the socket records for multicast address m on interface i are:
from socket s1: ( i, m, EXCLUDE, {a, b, c, d} )
from socket s2: ( i, m, EXCLUDE, {b, c, d, e} )
from socket s3: ( i, m, INCLUDE, {d, e, f} )then the corresponding interface record on interface i is:
( m, EXCLUDE, {b, c} )If a fourth socket gets added, like:
from socket s4: ( i, m, EXCLUDE, {} )then the interface record becomes:
( m, EXCLUDE, {} )- If all such records have a filter-mode of INCLUDE, then the filter-mode of the interface record is INCLUDE, and the source-list of the interface record is the union of the source-lists of all the socket records 🌈. For example, if the socket records for multicast address m on interface i are:
from socket s1: ( i, m, INCLUDE, {a, b, c} )
from socket s2: ( i, m, INCLUDE, {b, c, d} )
from socket s3: ( i, m, INCLUDE, {e, f} )then the corresponding interface record on interface i is:
( m, INCLUDE, {a, b, c, d, e, f} )An implementation MUST NOT use an EXCLUDE interface record to represent a group when all sockets for this group are in INCLUDE state. If system resource limits get hit while an interface state source-list is being calculated, an error MUST be returned to the application that requested the operation 🚨.
The rules above for deriving the interface state get (re-)evaluated whenever an IPMulticastListen invocation changes the socket state by adding, deleting, or modifying a per-socket state record 🔄. Just know that a change in socket state doesn't always mean a change in interface state 🤷♀️.
4. Message Formats ✨
okay so IGMP messages get wrapped up inside IPv4 datagrams, and the IP protocol number is 2 💖 every IGMP message in this doc is sent with an IP Time-to-Live of 1, IP Precedence of Internetwork Control (e.g., Type of Service 0xc0), and it carries an IP Router Alert option [RFC2113] in its IP header 🦋 IGMP message types get registered per [BCP57] 📝
there are two IGMP message types that matter for the IGMPv3 protocol in this doc 👑
+===================+==========================+
| Type Number (hex) | Message Name |
+===================+==========================+
| 0x11 | Membership Query |
+-------------------+--------------------------+
| 0x22 | IGMPv3 Membership Report |
+-------------------+--------------------------+Table 1: New Messages Introduced by IGMPv3
an implementation of IGMPv3 MUST also support these three message types too 🫶 they're there so it can talk to older versions of IGMP (see Section 7) 🕰️
+===================+==========================+===========+
| Type Number (hex) | Message Name | Reference |
+===================+==========================+===========+
| 0x12 | IGMPv1 Membership Report | [RFC1112] |
+-------------------+--------------------------+-----------+
| 0x16 | IGMPv2 Membership Report | [RFC2236] |
+-------------------+--------------------------+-----------+
| 0x17 | IGMPv2 Leave Group | [RFC2236] |
+-------------------+--------------------------+-----------+Table 2: Legacy IGMP Messages
unrecognized message types MUST be silently ignored 🙈 other message types might get used by newer versions or extensions of IGMP, by multicast routing protocols, or for other uses 🌈
in this doc, unless it says otherwise, the capitalized words "Query" and "Report" mean IGMP Membership Queries and IGMPv3 Membership Reports, respectively 💅
4.1. Membership Query Message
Membership Queries are sent by IP multicast routers to ask about the multicast reception state of neighboring interfaces 🔍 here's what a Query looks like:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0x11 | Max Resp Code | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Group Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags |S| QRV | QQIC | Number of Sources (N) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address [1] |
+- -+
| Source Address [2] |
+- . -+
. . .
. . .
+- -+
| Source Address [N] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1: IGMPv3 Query Message
4.1.1. Max Response Code
the Max Resp Code field sets the max time allowed before sending a responding report ⏰ the actual time, called the "Max Response Time", is counted in units of 1/10 second and gets worked out from the Max Resp Code like this:
- If Max Resp Code < 128, Max Response Time = Max Resp Code
- If Max Resp Code >= 128, Max Resp Code represents a floating-point value as follows:
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|1| exp | mant |
+-+-+-+-+-+-+-+-+Max Response Time = (mant | 0x10) << (exp + 3)
Figure 2: Max Resp Code Representation
small Max Response Time values let IGMPv3 routers tune the "leave latency" (the time between the moment the last host leaves a group and the moment the routing protocol is notified that there are no more members) 🎀 bigger values, especially in the exponential range, let you tune how bursty IGMP traffic is on a network 💥
4.1.2. Checksum
the Checksum field is the 16-bit one's complement of the one's complement sum of the whole IGMP message (the entire IP payload) 🧮 to compute it, the Checksum field gets set to zero first 🫧 when receiving packets, the checksum MUST be verified before processing a packet [RFC1071] 🔐
4.1.3. Group Address
the Group Address field is set to zero when sending a General Query 🌍 when sending a Group-Specific Query or a Group-and-Source Specific Query, it gets set to the IP multicast address being queried (see Section 4.1.11, below) 🎯
4.1.4. Flags
the Flags field is a bitstring managed by the "IGMP Type Numbers" registry defined in [BCP57] 🏷️
4.1.5. S Flag (Suppress Router-Side Processing)
when it's set to one, the S flag tells any receiving multicast routers to suppress the normal timer updates they do when they get a Query 🤫 it does NOT suppress the Querier election, though, or the normal "host-side" processing of a Query that a router might have to do because it's a group member itself 👀
4.1.6. QRV (Querier's Robustness Variable)
if it's non-zero, the QRV field holds the [Robustness Variable] value the querier used, which means the sender of the Query 💪 if the querier's [Robustness Variable] is bigger than 7 (the max value of the QRV field), the QRV gets set to zero 😳 routers adopt the QRV value from the most recently received Query as their own [Robustness Variable] value, unless that most recently received QRV was zero. in that case, the receivers use the default [Robustness Variable] value from Section 8.1 or a statically configured value 🧸
4.1.7. QQIC (Querier's Query Interval Code)
the QQIC field says which [Query Interval] the querier is using 🕑 the actual interval, called the "Querier's Query Interval (QQI)", is counted in seconds and gets derived from the QQIC like this:
- If QQIC < 128, QQI = QQIC
- If QQIC >= 128, QQIC represents a floating-point value as follows:
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|1| exp | mant |
+-+-+-+-+-+-+-+-+QQI = (mant | 0x10) << (exp + 3)
Figure 3: QQIC Representation
multicast routers that aren't the current querier adopt the QQI value from the most recently received Query as their own [Query Interval] value 🌸 unless that most recently received QQI was zero, in which case the receiving routers use the default [Query Interval] value from Section 8.2 🌷
4.1.8. Number of Sources (N)
the Number of Sources (N) field says how many source addresses are in the Query 🔢 it's zero in a General Query or a Group Specific Query, and non-zero in a Group-and-Source Specific Query 💜 this number is limited by the MTU of the network the Query gets sent over 📏 for example, on an Ethernet with an MTU of 1500 octets, the IP header including the Router Alert option eats 24 octets, and the IGMP fields up to and including the Number of Sources (N) field eat 12 octets. that leaves 1464 octets for source addresses, which caps the number of source addresses at 366 (1464/4) 🍓
4.1.9. Source Address [i]
the Source Address [i] fields are a vector of n IP unicast addresses, where n is the value in the Number of Sources (N) field 🧚
4.1.10. Additional Data
if the Packet Length field in the IP header of a received Query says there are extra octets of data beyond the fields described here, IGMPv3 implementations MUST include those octets when computing the received IGMP Checksum, but they MUST otherwise ignore those extra octets 🕵️ when sending a Query, an IGMPv3 implementation MUST NOT include octets beyond the fields described here 🚫
heads up bestie: the extra octets get counted for the checksum but then ignored everywhere else, so don't go rogue with them 😭
4.1.11. Query Variants
there are three variants of the Query Message 🎭
- A General Query is sent by a multicast router to learn the complete multicast reception state of the neighboring interfaces (that is, the interfaces attached to the network on which the Query is transmitted). In a General Query, both the Group Address field and the Number of Sources (N) field are zero.
- A Group Specific Query is sent by a multicast router to learn the reception state, with respect to a single multicast address, of the neighboring interfaces. In a Group Specific Query, the Group Address field contains the multicast address of interest, and the Number of Sources (N) field contains zero.
- A Group-and-Source Specific Query is sent by a multicast router to learn if any neighboring interface desires reception of packets sent to a specified multicast address, from any of a specified list of sources. In a Group-and-Source Specific Query, the Group Address field contains the multicast address of interest, and the Source Address [i] fields contain the source address(es) of interest.
4.1.12. IP Destination Addresses for Queries
in IGMPv3, General Queries get sent with an IP destination address of 224.0.0.1, the all-systems multicast address 📡 Group Specific and Group-and-Source Specific Queries get sent with an IP destination address equal to the multicast address of interest 🎯 but a system MUST accept and process any Query whose IP Destination Address field contains any of the addresses (unicast or multicast) assigned to the interface the Query arrives on 🫶✨
4.2. IGMPv3 Membership Report Message ✨
okay so IGMPv3 Membership Reports are how IP systems tell their neighbouring routers what multicast stuff they're listening to 📡, or how that listening state is changing on their interfaces 🦋. here's the full layout of a report 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = 0x22 | Reserved | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | Number of Group Records (M) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Group Record [1] .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Group Record [2] .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| . |
. . .
| . |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Group Record [M] .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 4: IGMPv3 Report Message
and each Group Record has its own internal format 💅:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Record Type | Aux Data Len | Number of Sources (N) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Multicast Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address [1] |
+- -+
| Source Address [2] |
+- -+
. . .
. . .
. . .
+- -+
| Source Address [N] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Auxiliary Data .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 5: IGMPv3 Report Group Record
4.2.1. Reserved 🧸
the Reserved field gets set to zero when it's sent, and it gets ignored when it's received. easy peasy.
4.2.2. Checksum 🔍
the Checksum field is the 16-bit one's complement of the one's complement sum of the whole IGMP message (that's the entire IP payload). when you're computing it, the Checksum field gets set to zero first. when packets come in, the checksum MUST be verified before a message gets processed. no skipping this one, bestie 🙅♀️
4.2.3. Flags 🚩
the Flags field is a bitstring that's managed by the "IGMP Type Numbers" registry defined in [BCP57].
4.2.4. Number of Group Records (M) 🔢
the Number of Group Records (M) field tells you how many Group Records are sitting in this Report.
4.2.5. Group Record 🎀
each Group Record is a little block of fields with info about the sender's membership in a single multicast group, on the interface the Report was sent from. cute and specific 🥰
4.2.6. Record Type 🍓
see Section 4.2.13, below.
4.2.7. Aux Data Len 📏
the Aux Data Len field holds the length of the Auxiliary Data field in this Group Record, measured in 32-bit words. it may contain zero, which means there's no auxiliary data at all.
4.2.8. Number of Sources (N) 🌊
the Number of Sources (N) field specifies how many source addresses are present in this Group Record.
4.2.9. Multicast Address 📣
the Multicast Address field contains the IP multicast address that this Group Record is about.
4.2.10. Source Address [i] 🧚
the Source Address [i] fields are a vector of n IP unicast addresses, where n is whatever value is in this record's Number of Sources (N) field. so the count decides how many addresses you get 🔥
4.2.11. Auxiliary Data 🙅♀️
the Auxiliary Data field, if it's there at all, carries extra info about this Group Record. but here's the tea: IGMPv3, the protocol this document defines, doesn't define any auxiliary data. so IGMPv3 implementations MUST NOT include any auxiliary data in a transmitted Group Record (which means they MUST set the Aux Data Len field to zero), and they MUST ignore any auxiliary data that shows up in a received Group Record. the meaning and internal encoding of this field are up to any future version or extension of IGMP that decides to use it 🔮
4.2.12. Additional Data 🫶
if the Packet Length field in the IP header of a received Report says there are extra octets sitting past the last Group Record, IGMPv3 implementations MUST include those octets when they compute the received IGMP Checksum, but they MUST otherwise ignore those extra octets. and when you're sending a Report, an IGMPv3 implementation MUST NOT include any octets beyond the last Group Record. no sneaking extras in 🤫
4.2.13. Group Record Types 💜
there are a bunch of different Group Record types that can show up in a Report message, and they fall into three main flavours:
- A Current-State Record is sent by a system in response to a Query received on an interface. it reports the current reception state of that interface, for one multicast address at a time. its Record Type can be one of these two values:
- 1.
MODE_IS_INCLUDE- the interface has a filter-mode of INCLUDE for the specified multicast address. theSource Address [i]fields in this Group Record hold the interface's source-list for that address, but only if the list isn't empty. - 2.
MODE_IS_EXCLUDE- the interface has a filter-mode of EXCLUDE for the specified multicast address. theSource Address [i]fields in this Group Record hold the interface's source-list for that address, but only if the list isn't empty. an SSM-aware host SHOULD NOT send aMODE_IS_EXCLUDErecord type for multicast addresses that fall within the SSM address range, because SSM-aware routers will ignore them [RFC4604].
- 1.
- A Filter-Mode-Change Record is sent by a system whenever a local invocation of
IPMulticastListencauses a change of the filter-mode (so, going from INCLUDE to EXCLUDE, or from EXCLUDE to INCLUDE) of the interface-level state entry for a particular multicast address. the Record is included in a Report sent from the interface where the change happened. its Record Type can be one of these two values:- 3.
CHANGE_TO_INCLUDE_MODE- the interface has switched to INCLUDE filter-mode for the specified multicast address. theSource Address [i]fields in this Group Record hold the interface's new source-list for that address, but only if it isn't empty. - 4.
CHANGE_TO_EXCLUDE_MODE- the interface has switched to EXCLUDE filter-mode for the specified multicast address. theSource Address [i]fields in this Group Record hold the interface's new source-list for that address, but only if it isn't empty. an SSM-aware host SHOULD NOT send aCHANGE_TO_EXCLUDE_MODErecord type for multicast addresses that fall within the SSM address range.
- 3.
- A Source-List-Change Record is sent by a system whenever a local invocation of
IPMulticastListenchanges the source-list without also changing the filter-mode of the interface-level state entry for a particular multicast address. the Record is included in a Report sent from the interface where the change happened. its Record Type can be one of these two values:- 5.
ALLOW_NEW_SOURCES- theSource Address [i]fields in this Group Record hold a list of the extra sources the system wants to receive packets from, for the specified multicast address. if the change was to an INCLUDE source-list, these are the addresses that got added to the list. if the change was to an EXCLUDE source-list, these are the addresses that got deleted from the list. - 6.
BLOCK_OLD_SOURCES- theSource Address [i]fields in this Group Record hold a list of the sources the system no longer wants to receive packets from, for the specified multicast address. if the change was to an INCLUDE source-list, these are the addresses that got deleted from the list. if the change was to an EXCLUDE source-list, these are the addresses that got added to the list.
- 5.
if a change of source-list ends up both allowing new sources and blocking old ones, then two Group Records get sent for the same multicast address: one of type ALLOW_NEW_SOURCES and one of type BLOCK_OLD_SOURCES. two records, one vibe each 👯♀️
we use the term "State-Change Record" to mean either a Filter-Mode-Change Record or a Source-List-Change Record. easy shorthand ✨
Unrecognized Record Type values MUST be silently ignored. no drama, no error, just vibes 🌸
4.2.14. IP Source Addresses for Reports 🌈
an IGMP report is sent with a valid unicast IPv4 source address for the destination subnet. the 0.0.0.0 source address may be used by a system that hasn't acquired an IP address yet. heads up though: the 0.0.0.0 source address may be used at the same time by multiple systems on a LAN, so it's not unique 👀. routers MUST accept a report with a source address of 0.0.0.0, no matter what. 🙌
4.2.15. IP Destination Addresses for Reports ✨
okay bestie, v3 Reports get sent to IP destination 224.0.0.22 🦋 because that's where every IGMPv3-capable multicast router is listening. A system running in v1 or v2 compatibility mode sends its v1 or v2 Reports to whatever multicast group is named in the Group Address field of the Report 💅. And here's the important bit: a system MUST accept and process any v1 or v2 Report whose IP Destination Address field holds any address (unicast or multicast) assigned to the interface the Report arrives on 🔥. No skipping that one, periodt!
4.2.16. Notation for Group Records 🌸
For the rest of this doc, we're using a little shorthand to describe the contents of a Group Record for one particular multicast address 🧚:
IS_IN ( x )- Type MODE_IS_INCLUDE, source addresses xIS_EX ( x )- Type MODE_IS_EXCLUDE, source addresses xTO_IN ( x )- Type CHANGE_TO_INCLUDE_MODE, source addresses xTO_EX ( x )- Type CHANGE_TO_EXCLUDE_MODE, source addresses xALLOW ( x )- Type ALLOW_NEW_SOURCES, source addresses xBLOCK ( x )- Type BLOCK_OLD_SOURCES, source addresses x
So, where x can be either:
- a capital letter (e.g., "A") standing in for the set of source addresses, or
- a set expression (e.g., "A+B"), where "A+B" means the union of sets A and B, "A*B" means the intersection of sets A and B, and "A-B" means removing all elements of set B from set A 🍓.
4.2.17. Membership Report Size 💜
So, if the set of Group Records you need to report won't fit inside a single Report message (the MTU of the network it's going out on decides what "fit" means 👀), the Group Records just get sent across as many Report messages as it takes to report the whole set. Easy peasy 🎀.
It gets a little trickier if one single Group Record has SO many source addresses that it won't fit in one Report message. If its Type is not MODE_IS_EXCLUDE or CHANGE_TO_EXCLUDE_MODE, it gets split into multiple Group Records, each with a different subset of the source addresses, and each one goes out in its own Report message 💖. If its Type IS MODE_IS_EXCLUDE or CHANGE_TO_EXCLUDE_MODE, then only one Group Record gets sent, packed with as many source addresses as will fit, and the rest just aren't reported 😭. Which sources make the cut is arbitrary, but it's preferable to report the same set of sources in each subsequent report, rather than switching up the sources every single time 🫶.
5. Description of the Protocol for Group Members ✨
IGMP is an asymmetric protocol, which means it has separate behaviours for group members (hosts or routers that want to receive multicast packets) and for multicast routers 🌈. This section covers the part of IGMPv3 that applies to all group members. (Quick note: a multicast router that's also a group member does both parts of IGMPv3, receiving and responding to its own IGMP message transmissions as well as those of its neighbours. The multicast router part of IGMPv3 is in Section 6 💅.)
A system runs the protocol described in this section over all interfaces where multicast reception is supported, even if more than one of those interfaces is connected to the same network 🦋.
For interoperability with multicast routers running older versions of IGMP, systems keep a MulticastRouterVersion variable for each interface where multicast reception is supported. This section describes how group member systems behave on interfaces where MulticastRouterVersion = 3. The algorithm for working out MulticastRouterVersion, plus the behaviour for versions other than 3, lives in Section 7 🧠.
The all-systems multicast address, 224.0.0.1, is a special case 👑. On all systems (all hosts and routers, including multicast routers), reception of packets destined to the all-systems multicast address from all sources is permanently enabled on every interface where multicast reception is supported. No IGMP messages are ever sent about the all-systems multicast address 🙈.
There are two kinds of events that kick off IGMPv3 protocol actions on an interface:
- A change of the interface reception state, caused by a local invocation of
IPMulticastListen. - The reception of a Query.
(Any received IGMP messages of types other than Query are silently ignored, except where they're needed for interoperation with earlier versions of IGMP 🤫.)
The following subsections describe what to do for each of these two cases. In those descriptions, timer and counter names show up in square brackets. The default values for those timers and counters are in Section 8 ⭐.
5.1. Action on Change of Interface State 🎀
An invocation of IPMulticastListen may change the multicast reception state of an interface, following the rules in Section 3.2. Each change like that affects the per-interface entry for one single multicast address 💅.
When the interface state changes, the system immediately transmits a State-Change Report from that interface 🚀. The type and contents of the Group Record(s) in that Report come from comparing the filter-mode and source-list for the affected multicast address before and after the change, according to Table 3. If no interface state existed for that multicast address before the change (say the change created a brand new per-interface record), or if no state exists after the change (say the change deleted a per-interface record), then the "non-existent" state is treated as having a filter-mode of INCLUDE and an empty source-list 🧚.
+=============+=============+==========================+
| Old State | New State | State-Change Record Sent |
+=============+=============+==========================+
| INCLUDE (A) | INCLUDE (B) | ALLOW (B-A), BLOCK (A-B) |
+-------------+-------------+--------------------------+
| EXCLUDE (A) | EXCLUDE (B) | ALLOW (A-B), BLOCK (B-A) |
+-------------+-------------+--------------------------+
| INCLUDE (A) | EXCLUDE (B) | TO_EX (B) |
+-------------+-------------+--------------------------+
| EXCLUDE (A) | INCLUDE (B) | TO_IN (B) |
+-------------+-------------+--------------------------+
Table 3: Transmitted Group Records for State ChangesIf the computed source-list for either an ALLOW or a BLOCK State-Change Record is empty, that record gets left out of the Report message 🙅♀️.
To cover the chance that the State-Change Report gets missed by one or more multicast routers, it's retransmitted [Robustness Variable] - 1 more times, at intervals picked at random from the range (0, [Unsolicited Report Interval]) 🔁.
If more changes hit the same interface state entry before all the retransmissions of the State-Change Report for the first change are done, each of those extra changes triggers the immediate transmission of a State-Change Report 💨.
The contents of the new transmitted report are worked out like this. Same as with the first report, the interface state for the affected group before and after the latest change gets compared, and the report records showing the difference are built according to Table 3. These records don't get sent in a message on their own though. Instead they're merged with the contents of the pending report to make the new State-Change report 🍒. The rules for merging the difference report with the pending report are described below.
Sending the merged State-Change Report ends the retransmissions of the earlier State-Change Reports for that same multicast address, and this merged one becomes the first of the [Robustness Variable] transmissions of State-Change Reports 🌈.
Every time a source gets included in the difference report calculated above, retransmission state for that source has to be kept until [Robustness Variable] State-Change Reports have been sent by the host. That's how we make sure a series of successive state changes doesn't break the protocol's robustness 🛡️.
If the interface reception-state change that triggers the new report is a filter-mode change, then the next [Robustness Variable] State-Change Reports will include a Filter-Mode-Change Record. This holds even if any number of source-list changes happen during that stretch 🦋. The host has to keep retransmission state for the group until those [Robustness Variable] State-Change Reports have been sent. Once [Robustness Variable] State-Change Reports with Filter-Mode-Change Records have gone out after the last filter-mode change, and if source-list changes to the interface reception have scheduled extra reports, then the next State-Change Report will include Source-List-Change Records 💫.
Every time a State-Change Report is transmitted, the contents get decided like this. If the report should contain a Filter-Mode-Change Record, and the interface's current filter-mode is INCLUDE, a TO_IN record goes in the report; otherwise a TO_EX record goes in. If instead the report should contain a Source-List-Change Record, an ALLOW and a BLOCK record go in. The contents of these records are built according to Table 4 🎯.
+========+==============================+
| Record | Sources Included |
+========+==============================+
| TO_IN | All in the current interface |
| | state that must be forwarded |
+--------+------------------------------+
| TO_EX | All in the current interface |
| | state that must be blocked |
+--------+------------------------------+
| ALLOW | All with retransmission |
| | state that must be forwarded |
+--------+------------------------------+
| BLOCK | All with retransmission |
| | state that must be blocked |
+--------+------------------------------+
Table 4: Change Record ConstructionIf the computed source-list for either an ALLOW or a BLOCK record is empty, that record gets left out of the State-Change Report 🙃.
Note: When the first State-Change Report is sent, the non-existent pending report to merge with can be treated as a Source-Change Report with empty ALLOW and BLOCK records (no sources have retransmission state). 🌸
5.2. Action on Reception of a Query ✨
Okay so when a system gets a Query, it does not respond right away 🙈. It waits a random amount of time instead, capped by the Max Response Time, which comes from the Max Resp Code in the Query Message it received 💅. A system can get a bunch of Queries on different interfaces, and they can be different kinds (General Queries, Group Specific Queries, and Group-and-Source Specific Queries). Each kind might need its own delayed response 🦋.
Before scheduling a response to a Query, the system must first consider previously scheduled pending responses, because in lots of cases it can schedule one combined response 🧚. So the system must be able to maintain the following state:
- A timer per interface for scheduling responses to General Queries.
- A per-group and Interface Timer for scheduling responses to Group Specific and Group-and-Source Specific Queries.
- A per-group and interface list of sources to be reported in the response to a Group-and-Source Specific Query.
When a Query with the Router Alert option arrives on an interface, and the system has state to report, a delay for a response gets randomly picked in the range (0, [Max Response Time]). Max Response Time is derived from Max Resp Code in the received Query Message 🌸. Next, these rules decide whether a Report needs to be scheduled and what type of Report it should be. The rules get checked in order, and only the first matching rule gets applied 👑.
- If there is a pending response to a previous General Query scheduled sooner than the selected delay, no additional response needs to be scheduled. 💅
- If the received Query is a General Query, the Interface Timer is used to schedule a response to the General Query after the selected delay. Any previously pending response to a General Query is canceled. 🙅♀️
- If the received Query is a Group Specific Query or a Group-and-Source Specific Query and there is no pending response to a previous Query for this group, then the Group Timer is used to schedule a report. If the received Query is a Group-and-Source Specific Query, the list of queried sources is recorded to be used when generating a response. 📝
- If there already is a pending response to a previous Query scheduled for this group, and either the new Query is a Group Specific Query or the recorded source-list associated with the group is empty, then the group source-list is cleared and a single response is scheduled using the Group Timer. The new response is scheduled to be sent at the earliest of the remaining time for the pending report and the selected delay. ⏰
- If the received Query is a Group-and-Source Specific Query and there is a pending response for this group with a non-empty source-list, then the group source-list is augmented to contain the list of sources in the new Query and a single response is scheduled using the Group Timer. The new response is scheduled to be sent at the earliest of the remaining time for the pending report and the selected delay. 🫶
When the timer in a pending response record expires, the system transmits, on the associated interface, one or more Report messages carrying one or more Current-State Records (see Section 4.2.13). Here's how it goes 💖:
- If the expired timer is the Interface Timer (i.e., it is a pending response to a General Query), then one Current-State Record is sent for each multicast address for which the specified interface has reception state, as described in Section 3.2. The Current-State Record carries the multicast address and its associated filter-mode (
MODE_IS_INCLUDEorMODE_IS_EXCLUDE) and source-list. Multiple Current-State Records are packed into individual Report messages, to the extent possible.
This naive algorithm may result in bursts of packets when a system is a member of a large number of groups 😭. Instead of using a single Interface Timer, implementations are recommended to spread transmission of such Report messages over the interval (0, [Max Response Time]). Note that any such implementation MUST avoid the "ack-implosion" problem, i.e., MUST NOT send a Report immediately on reception of a General Query. That's a hard no 🚫.
- If the expired timer is a Group Timer and the list of recorded sources for that group is empty (i.e., it is a pending response to a Group Specific Query), then if and only if the interface has reception state for that group address, a single Current-State Record is sent for that address. The Current-State Record carries the multicast address and its associated filter-mode (
MODE_IS_INCLUDEorMODE_IS_EXCLUDE) and source-list. 🎀 - If the expired timer is a Group Timer and the list of recorded sources for that group is non-empty (i.e., it is a pending response to a Group-and-Source Specific Query), then if and only if the interface has reception state for that group address, the contents of the responding Current-State Record is determined from the interface state and the pending response record, as specified in Table 5. 🌈
+=====================+=========================+===============+
| Per-Interface State | Set of Sources in the | Current-State |
| | Pending Response Record | Record |
+=====================+=========================+===============+
| INCLUDE (A) | B | IS_IN (A*B) |
+---------------------+-------------------------+---------------+
| EXCLUDE (A) | B | IS_IN (B-A) |
+---------------------+-------------------------+---------------+
Table 5: Current-State Record ConstructionIf the resulting Current-State Record has an empty set of source addresses, then no response is sent. 🙅♀️
Finally, after any required Report messages have been generated, the source-lists associated with any reported groups get cleared. Clean slate, bestie 🧹✨.
6. Description of the Protocol for Multicast Routers 🦋
Okay, so IGMP exists so each multicast router can learn, for each of its directly attached networks, which multicast addresses the systems on those networks are interested in 🌸. IGMPv3 goes a step further and lets a multicast router also learn which sources are of interest to its neighbors, for packets sent to any particular multicast address 👀. All that info gets handed to whichever multicast routing protocol the router is running, so multicast packets actually reach every network with interested receivers. It's giving teamwork 🫶.
This section covers the part of IGMPv3 that multicast routers do. Multicast routers can also become members of multicast groups themselves, so they also do the group member part of IGMPv3, which is described in Section 5 💜.
A multicast router runs the protocol in this section over each of its directly attached networks. If a multicast router has more than one interface to the same network, it only needs to run this protocol over one of those interfaces 🍓. On each interface where this protocol runs, the router MUST enable reception of multicast address 224.0.0.22 from all sources (and MUST perform the group member part of IGMPv3 for that address on that interface). That's non-negotiable, periodt 💅.
Multicast routers only need to know that at least one system on an attached network is interested in packets to a particular multicast address from a particular source. A multicast router is not required to keep track of the interests of each individual neighboring system. (However, see Appendix A.2, item 1 for discussion.) 🧐
IGMPv3 is backward compatible with previous versions of the IGMP protocol 🤝. To stay backward compatible with older IGMP systems, IGMPv3 multicast routers MUST also implement versions 1 and 2 of the protocol (see Section 7) ✨.
6.1. Conditions for IGMP Queries
Multicast routers send General Queries periodically to ask an attached network for group membership info 📡. These Queries build and refresh the group membership state of systems on attached networks. Systems answer them by reporting their group membership state (and their desired set of sources) with Current-State Records in IGMPv3 Membership Reports 💌.
As a group member, a system can say it wants or doesn't want traffic from particular sources 🎧. When its desired reception state changes, it reports those changes using Filter-Mode-Change Records or Source-List-Change Records. These records show an explicit state change in a group at a system, either in the Group Record's source-list or its filter-mode. When a system stops being a member of a group, or stops wanting traffic from a particular source, a multicast router must query for other members of the group or listeners of the source before deleting the group (or source) and pruning its traffic. No ghosting allowed 👻.
To let all systems on a network respond to membership changes, multicast routers send specific queries 🔍. A Group Specific Query is sent to check that no systems want reception of the specified group, or to "rebuild" the desired reception state for a particular group. Group Specific Queries get sent when a router receives a State-Change Record saying a system is leaving a group 👋.
A Group-and-Source Specific Query checks whether any systems on a network want traffic from a set of sources. These queries list sources for a particular group that have been asked to stop being forwarded. A multicast router sends this query to find out if any systems want packets to the specified group address from the specified source addresses 🕵️♀️. Group-and-Source Specific Queries are only sent in response to State-Change Records, and never in response to Current-State Records. Section 4.1.11 describes each query in more detail 📚.
6.2. IGMP State Maintained by Multicast Routers
Multicast routers running IGMPv3 keep state per group per attached network 🗂️. This group state has a filter-mode, a list of sources, and various timers. For each attached network running IGMP, a multicast router records the desired reception state for that network. Conceptually, that state is a set of records of the form:
(multicast address, Group Timer, Router Filter Mode, (source records))Each source record is of the form:
(source address, Source Timer)If all sources within a given group are desired, an empty source record list is kept with filter-mode set to EXCLUDE. This means hosts on this network want all sources for this group to be forwarded. This is the IGMPv3 equivalent to an IGMPv1 or IGMPv2 group join 🎉.
6.2.1. Definition of Router Filter Mode ✨
okay so bestie, IGMPv3 routers are lowkey obsessed with saving memory 💅 so they keep ONE filter-mode per group per attached network. 🦋 That filter-mode squishes everyone's wants for a group down into the smallest set where every system's membership still gets met 🫶 The filter-mode can change when certain Group Records show up or when some timer conditions happen. ⏰ In the next sections, when we say Router Filter Mode, we mean that filter-mode for one particular group inside one router. 🎀 Section 6.4 walks through how the Router Filter Mode changes for each Group Record that comes in.
Conceptually, when a Group Record arrives, the router updates its Router Filter Mode for that group so it covers every requested source using the least amount of state possible. 🧠 As a general rule, once a Group Record with a filter-mode of EXCLUDE comes in, the Router Filter Mode for that group becomes EXCLUDE. 🌸
When the Router Filter Mode for a group is EXCLUDE, the source record list has two kinds of sources. 🌈 The first kind is the set that shows up where the desired reception state conflicts, and this set has to be forwarded by some router on the network. 💜 The second kind is the set of sources that hosts asked NOT to be forwarded. 🙈 Appendix A explains why it's worth keeping these two sets separate while in EXCLUDE mode. 📚
When the Router Filter Mode for a group is INCLUDE, the source record list is just the sources desired for that group. ✨ This is the total desired set of sources for the group, and every source in that list must be forwarded by some router on the network. 🔥
Here's the tricky bit 👀 A reported Group Record with a filter-mode of EXCLUDE pushes a router's filter-mode for that group into EXCLUDE, so there has to be a way to switch it back to INCLUDE. 🔄 If every system with a Group Record in EXCLUDE filter-mode stops reporting, it's desirable for the Router Filter Mode for that group to go back to INCLUDE. 🌷 That switch happens when the Group Timer expires, and Section 6.5 explains it in full detail. 💖
6.2.2. Definition of Group Timers 🎀
The Group Timer only gets used when a group is in EXCLUDE mode. 🌸 It tracks the time until the group's filter-mode expires and switches to INCLUDE mode. ⏳ We define a Group Timer as a decrementing timer with a lower bound of zero, and there's one kept per group per attached network. 🧁 Group timers get updated based on which types of Group Records come in. 💅
When a Group Timer expires while the Router Filter Mode for the group is EXCLUDE, that means there are no listeners on the attached network in EXCLUDE mode. 😭 At that point, the router moves to INCLUDE filter-mode. 🦋 Section 6.5 covers what happens when a Group Timer expires while in EXCLUDE mode.
Table 6 gives you the quick summary of what the Group Timer does. 📋 Section 6.4 has the details on how the Group Timer gets set for each type of Group Record received. 🫶
+=============+=======+=========================================+
| Group | Group | Actions/Comments |
| Filter-Mode | Timer | |
| | Value | |
+=============+=======+=========================================+
| INCLUDE | Timer | All members in INCLUDE mode. |
| | >= 0 | |
+-------------+-------+-----------------------------------------+
| EXCLUDE | Timer | At least one member in EXCLUDE mode. |
| | > 0 | |
+-------------+-------+-----------------------------------------+
| EXCLUDE | Timer | No more listeners to group. If all |
| | == 0 | source timers have expired, then delete |
| | | Group Record. If there are still |
| | | source record timers running, switch to |
| | | INCLUDE filter-mode using those source |
| | | records with running timers as the |
| | | INCLUDE source record state. |
+-------------+-------+-----------------------------------------+Table 6: Group Timer Actions
6.2.3. Definition of Source Timers 🦋
A Source Timer is kept per source record, and it's a decrementing timer with a lower bound of zero. ⏱️ Source timers get updated based on the type and filter-mode of the Group Record received. 💜 They are always updated (for a particular group) whenever that source shows up in a received record for the group. 🌈 Section 6.4 describes how source timers are set for each type of Group Record received.
A source record with a running timer, while the Router Filter Mode for the group is INCLUDE, means that one or more systems (in INCLUDE filter-mode) currently want to receive that source. 🫶 If a Source Timer expires while the Router Filter Mode for the group is INCLUDE, the router decides that traffic from that source isn't wanted on the attached network anymore and deletes the matching source record. 🗑️
Source timers get treated differently when the Router Filter Mode for a group is EXCLUDE. 🙈 If a source record has a running timer while the Router Filter Mode for the group is EXCLUDE, it means at least one system wants that source. 💅 So it should be forwarded by a router on the network. 🔥 Appendix A explains why state is kept for sources that have been requested to be forwarded while in EXCLUDE state. 📚
If a Source Timer expires while the Router Filter Mode for the group is EXCLUDE, the router tells the routing protocol that no receiver on the network is interested in traffic from that source anymore. 📢
When the Router Filter Mode for a group is EXCLUDE, source records only get deleted when the Group Timer expires. ⏰ Section 6.3 describes the actions that should be taken depending on the value of a Source Timer. 🌸
6.3. IGMPv3 Source-Specific Forwarding Rules 💅
When a multicast router gets a datagram from a source destined to a particular group, it has to decide whether to forward that datagram onto an attached network. 🦋 The multicast routing protocol in use is in charge of that decision, and it should use the IGMPv3 information to make sure all the sources and groups wanted on a subnetwork get forwarded to that subnetwork. 🫶 IGMPv3 information does NOT override multicast routing information. 🙅♀️ For example, if the IGMPv3 filter-mode group for G is EXCLUDE, a router may still forward packets from excluded sources to a transit subnet. 💫
To sum it all up, Table 7 lays out the forwarding suggestions IGMP makes to the routing protocol for traffic from a source destined to a group. 📋 It also summarizes the actions taken when a Source Timer expires, based on the Router Filter Mode of the group. ⏳
+=============+==========+=======================================+
| Group | Group | Action |
| Filter-Mode | Timer | |
| | Value | |
+=============+==========+=======================================+
| INCLUDE | TIMER > | Suggest to forward traffic from |
| | 0 | source. |
+-------------+----------+---------------------------------------+
| INCLUDE | TIMER == | Suggest to stop forwarding traffic |
| | 0 | from source and remove source record. |
| | | If there are no more source records |
| | | for the group, delete Group Record. |
+-------------+----------+---------------------------------------+
| INCLUDE | No | Suggest to not forward source. |
| | Source | |
| | Elements | |
+-------------+----------+---------------------------------------+
| EXCLUDE | TIMER > | Suggest to forward traffic from |
| | 0 | source. |
+-------------+----------+---------------------------------------+
| EXCLUDE | TIMER == | Suggest to not forward traffic from |
| | 0 | source (DO NOT remove record). |
+-------------+----------+---------------------------------------+
| EXCLUDE | No | Suggest to forward traffic from |
| | Source | source. |
| | Elements | |
+-------------+----------+---------------------------------------+Table 7: IGMP Forwarding Recommendations
6.4. Action on Reception of Reports 🫶
SSM-aware routers SHOULD ignore records that contain multicast addresses in the SSM address range if the record type is MODE_IS_EXCLUDE or CHANGE_TO_EXCLUDE_MODE. 🙈 SSM-aware routers SHOULD ignore IGMPv1/IGMPv2 Report and IGMPv2 DONE messages that contain multicast addresses in the SSM address range, SHOULD NOT use such Reports to establish IP forwarding state, and MAY log an error if it receives such a message. 🚨
6.4.1. Reception of Current-State Records ✨
okay so when a router gets Current-State Records, it updates both its group timers and its source timers 💅 Sometimes getting a certain type of Group Record flips the Router Filter Mode for that group, which is so dramatic 🎭 Table 8 is your cheat sheet for what happens to state and timers when these records show up.
The source-timer notation is a little chaotic, but it's worth it 🧠 We write ( A, B ) for the total number of sources for a particular group, where:
- A = set of source records whose source timers > 0 (Sources that at least one host has requested to be forwarded)
- B = set of source records whose source timers = 0 (Sources that IGMP will suggest to the routing protocol not to forward)
There are only two sets when a router's filter-mode for a group is EXCLUDE 🦋 When the filter-mode is INCLUDE, there's a single set that holds the sources someone asked to be forwarded, so it looks like (A).
In Tables 8 and 9 we use abbreviations for a few variables, and they're all explained in detail in Section 8 📚 GMI is the Group Membership Interval, which is the time after which group memberships time out. LMQT is the Last Member Query Time, which is the total time spent after [Last Member Query Count] retransmissions. LMQT is basically the leave latency, meaning the gap between sending a membership change and the moment the routing protocol actually gets the new info 🌸
In the "Actions" column of the router state tables, the notation means this:
A=Jmeans the source timers for the set A of source records get set to J.Delete Ameans the set A of source records gets deleted.Group Timer=Jmeans the Group Timer for the group gets set to J.
+=========+========+===========+=================+
| Router | Report | New | Actions |
| State | Rec'd | Router | |
| | | State | |
+=========+========+===========+=================+
| INCLUDE | IS_IN | INCLUDE | (B)=GMI |
| (A) | (B) | (A+B) | |
+---------+--------+-----------+-----------------+
| INCLUDE | IS_EX | EXCLUDE | (B-A)=0 |
| (A) | (B) | (A*B,B-A) | Delete (A-B) |
| | | | Group Timer=GMI |
+---------+--------+-----------+-----------------+
| EXCLUDE | IS_IN | EXCLUDE | (A)=GMI |
| (X,Y) | (A) | (X+A,Y-A) | |
+---------+--------+-----------+-----------------+
| EXCLUDE | IS_EX | EXCLUDE | (A-X-Y)=GMI |
| (X,Y) | (A) | (A-Y,Y*A) | Delete (X-A) |
| | | | Delete (Y-A) |
| | | | Group Timer=GMI |
+---------+--------+-----------+-----------------+
Table 8: Actions on Current-State Report Reception6.4.2. Reception of Filter-Mode-Change and Source-List-Change Records 🔄
When something changes in the global state of a group, the system sends either a Source-List-Change Record or a Filter-Mode-Change Record for that group 💌 Just like with Current-State Records, routers must act on these and possibly update their own state so it matches the new desired membership state of the network.
Routers must query the sources that are being asked to stop forwarding to a group 🕵️♀️ When a router queries, or receives a query for, a specific set of sources, it lowers its source timers for those sources to a small interval of [Last Member Query Time] seconds. If Group Records come back in response to those queries, showing interest in receiving traffic from the queried sources, the matching timers get updated.
Same energy for groups 🫶 When a router queries a specific group, it lowers its Group Timer for that group to a small interval of [Last Member Query Time] seconds. If any Group Records expressing EXCLUDE mode interest in the group show up within that interval, the Group Timer gets updated, and the suggestion to the routing protocol to forward the group stands without any interruption.
During a query period (that's [Last Member Query Time] seconds), the IGMP component in the router keeps suggesting to the routing protocol that it forwards traffic from the groups or sources it's querying 🌈 The router doesn't prune the group or sources from the network until [Last Member Query Time] seconds have passed without a record showing interest in the queried group or sources. Only then may it prune.
Table 9 shows the changes in group state, plus the action or actions taken when a Filter-Mode-Change or Source-List-Change Record comes in. It also shows the queries the querier sends when a particular report is received 👑
For the queries, the notation goes like this: 'Q(G)' is a Group Specific Query to G, and 'Q(G,A)' is a Group-and-Source Specific Query to G with source-list A. If source-list A ends up null because of an action (like A*B), then no query gets sent for that operation 💀
To keep the protocol robust, the queries sent by actions in Table 9 need to be transmitted [Last Member Query Count] times, once every [Last Member Query Interval] ✨
If new queries get scheduled while there are already pending queries to be retransmitted for the same group, the new and pending queries have to be merged. Also, received host reports for a group with pending queries may change what those queries contain. Section 6.6.3 describes how to build and maintain the state of pending queries 🧚
+=========+========+=============+=====================+
| Router | Report | New Router | Actions |
| State | Rec'd | State | |
+=========+========+=============+=====================+
| INCLUDE | ALLOW | INCLUDE | (B)=GMI |
| (A) | (B) | (A+B) | |
+---------+--------+-------------+---------------------+
| INCLUDE | BLOCK | INCLUDE (A) | Send Q(G,A*B) |
| (A) | (B) | | |
+---------+--------+-------------+---------------------+
| INCLUDE | TO_EX | EXCLUDE | (B-A)=0 |
| (A) | (B) | (A*B,B-A) | Delete (A-B) |
| | | | Send Q(G,A*B) |
| | | | Group Timer=GMI |
+---------+--------+-------------+---------------------+
| INCLUDE | TO_IN | INCLUDE | (B)=GMI |
| (A) | (B) | (A+B) | Send Q(G,A-B) |
+---------+--------+-------------+---------------------+
| EXCLUDE | ALLOW | EXCLUDE | (A)=GMI |
| (X,Y) | (A) | (X+A,Y-A) | |
+---------+--------+-------------+---------------------+
| EXCLUDE | BLOCK | EXCLUDE | (A-X-Y)=Group Timer |
| (X,Y) | (A) | (X+(A-Y),Y) | Send Q(G,A-Y) |
+---------+--------+-------------+---------------------+
| EXCLUDE | TO_EX | EXCLUDE | (A-X-Y)=Group Timer |
| (X,Y) | (A) | (A-Y,Y*A) | Delete (X-A) |
| | | | Delete (Y-A) |
| | | | Send Q(G,A-Y) |
| | | | Group Timer=GMI |
+---------+--------+-------------+---------------------+
| EXCLUDE | TO_IN | EXCLUDE | (A)=GMI |
| (X,Y) | (A) | (X+A,Y-A) | Send Q(G,X-A) |
| | | | Send Q(G) |
+---------+--------+-------------+---------------------+
Table 9: Actions on Change Record Reception6.5. Switching Router Filter Modes 🦋
The Group Timer is the mechanism used to move the Router Filter Mode from EXCLUDE to INCLUDE 🎀
When a Group Timer expires while the Router Filter Mode is EXCLUDE, the router assumes there are no systems with a filter-mode of EXCLUDE on the attached network. So when a router's filter-mode for a group is EXCLUDE and the Group Timer expires, the Router Filter Mode for that group transitions to INCLUDE 💫
For the switch to INCLUDE, a router uses the source records that have running source timers as its state. If any source records have source timers greater than zero (meaning they were requested to be forwarded), the router switches to filter-mode INCLUDE using those records. Source records whose timers are zero (left over from the previous EXCLUDE mode) get deleted 🗑️
Here's an example: if a router's state for a group is EXCLUDE(X,Y) and that group's Group Timer expires, the router switches to filter-mode INCLUDE with state INCLUDE(X) 🍓
6.6. Action on Reception of Queries 🔍
6.6.1. Timer Updates ⏰
When a router sends or receives a query with a clear Suppress Router-Side Processing flag, it must update its timers so they reflect the correct timeout values for the group or sources being queried 🙈 Table 10 shows the timer actions when sending or receiving a Group Specific or Group-and-Source Specific Query with the S flag not set.
+========+===================================================+
| Query | Action |
+========+===================================================+
| Q(G,A) | Source Timer for sources in A are lowered to LMQT |
+--------+---------------------------------------------------+
| Q(G) | Group Timer is lowered to LMQT |
+--------+---------------------------------------------------+
Table 10: Timer Updates on QueryWhen a router sends or receives a query with the S flag set, it does not update its timers 🌙
6.6.2. Querier Election 👑
IGMPv3 elects a single querier per subnet using the same Querier election mechanism as IGMPv2, which is by IP address 🏆 When a router receives a General Query with a lower IP address, it sets the Other-Querier-Present Timer to [Other Querier Present Interval] and stops sending general queries on the network if it was the previously elected querier. After its Other-Querier-Present Timer expires, it should begin sending General Queries.
If a router receives a General Query from an older version, it MUST use the oldest version of IGMP on the network 🚨 For a detailed look at compatibility between IGMP versions, see Section 7.
6.6.3. Building and Sending Specific Queries 📨
6.6.3.1. Building and Sending Group Specific Queries 🧁
When a table action "Send Q(G)" is encountered, the Group Timer must be lowered to LMQT. The router must then immediately send a Group Specific Query, and also schedule [Last Member Query Count] - 1 query retransmission(s) to be sent every [Last Member Query Interval] over [Last Member Query Time].
When transmitting a Group Specific Query, if the Group Timer is larger than LMQT, the "Suppress Router-Side Processing" bit is set in the Query Message 🫶
6.6.3.2. Building and Sending Group-and-Source Specific Queries ✨
Okay so, when a querier hits the table action "Send Q(G,X)" in Table 9 (Section 6.4.2), it has to do two things for each source in X of group G whose Source Timer is larger than LMQT 💅:
- Set the number of retransmissions for each source to [Last Member Query Count].
- Lower the Source Timer to LMQT.
Then the router has to immediately send a Group-and-Source Specific Query, and also schedule [Last Member Query Count] - 1 query retransmission(s) to go out every [Last Member Query Interval] over [Last Member Query Time]. 🫶 The contents of these queries get calculated like this:
When building a Group-and-Source Specific Query for group G, the router sends two separate Query Messages for that group. The first one has the "Suppress Router-Side Processing" bit set, and it includes all the sources with retransmission state and timers greater than LMQT. The second one has the "Suppress Router-Side Processing" bit clear, and it includes all the sources with retransmission state and timers lower or equal to LMQT. If either of the two calculated messages doesn't contain any sources, then its transmission gets suppressed 🙈
Note: If a Group Specific Query is scheduled to be transmitted at the same time as a Group-and-Source Specific Query for the same group, then transmission of the Group-and-Source Specific Query Message with the "Suppress Router-Side Processing" bit set may be suppressed. 🌸
7. Interoperation With Older Versions of IGMP
Here's the vibe: IGMPv3 hosts and routers still interoperate with hosts and routers that haven't been upgraded to IGMPv3 yet 🦋 This compatibility works because hosts and routers take the right actions based on which versions of IGMP are running on the hosts and routers in a network. Main character energy for backwards compat 👑
7.1. Query Version Distinctions
To figure out the IGMP version of a Membership Query Message, look at it like this:
IGMPv1 Query: length = 8 octets AND Max Resp Code field is zeroIGMPv2 Query: length = 8 octets AND Max Resp Code field is non-zeroIGMPv3 Query: length >= 12 octets
Query Messages that don't match any of the above conditions (for example, a Query of length 10 octets) MUST be silently ignored. 🙅♀️
7.2. Group Member Behavior
7.2.1. In the Presence of Older Version Queriers
Okay, so to stay compatible with older version routers, IGMPv3 hosts MUST operate in v1 and v2 compatibility modes 🎀 IGMPv3 hosts MUST keep state per local interface about the compatibility mode of each attached network. A host's compatibility mode comes from the Host Compatibility Mode variable, which can be in one of three states: IGMPv1, IGMPv2, or IGMPv3. This variable is kept per interface, and it depends on the version of General Queries received on that interface, as well as the Older-Version-Querier-Present Timer for the interface.
To switch gracefully between versions of IGMP, hosts keep both an IGMPv1-Querier-Present Timer and an IGMPv2-Querier-Present Timer per interface. The IGMPv1-Querier-Present Timer gets set to [Older Version Querier Present Interval] seconds whenever an IGMPv1 Membership Query is received. The IGMPv2-Querier-Present Timer gets set to [Older Version Querier Present Interval] seconds whenever an IGMPv2 General Query is received. ✨
A host's Host Compatibility Mode on an interface changes whenever an older version query (older than the current compatibility mode) comes in, or when certain timer conditions happen 🌈 When the IGMPv1-Querier-Present Timer expires, the host switches to the Host Compatibility Mode of IGMPv2 if it has a running IGMPv2 Querier Present timer. If it doesn't have a running IGMPv2 Querier Present timer, then it switches to the Host Compatibility of IGMPv3. When the IGMPv2 Querier Present timer expires, the host switches to the Host Compatibility Mode of IGMPv3.
The Host Compatibility Mode variable is based on whether an older version General Query was received in the last [Older Version Querier Present Interval] seconds. The Host Compatibility Mode variable value MUST NOT be changed by an older version Group Specific Query. The Host Compatibility Mode is set depending on the following, as shown in Table 11 🧚
+=========================+========================================+
| Host Compatibility Mode | Timer State |
+=========================+========================================+
| IGMPv3 (default) | IGMPv2 Querier Present not running and |
| | IGMPv1 Querier Present not running |
+-------------------------+----------------------------------------+
| IGMPv2 | IGMPv2 Querier Present running and |
| | IGMPv1 Querier Present not running |
+-------------------------+----------------------------------------+
| IGMPv1 | IGMPv1 Querier Present running |
+-------------------------+----------------------------------------+
Table 11: Host Compatibility Mode SettingsIf a host receives a query that causes its Querier Present timers to be updated, and correspondingly its compatibility mode, it should switch compatibility modes immediately. ⚡
When Host Compatibility Mode is IGMPv3, a host acts using the IGMPv3 protocol on that interface. When Host Compatibility Mode is IGMPv2, a host acts in IGMPv2 compatibility mode, using only the IGMPv2 protocol, on that interface. When Host Compatibility Mode is IGMPv1, a host acts in IGMPv1 compatibility mode, using only the IGMPv1 protocol on that interface. 💜
An IGMPv1 router sends General Queries with the Max Resp Code set to 0. This MUST be interpreted as a value of 100 (10 seconds). 🍓
An IGMPv2 router sends General Queries with the Max Resp Code set to the desired Max Response Time. In other words, the full range of this field is linear, and the exponential algorithm described in Section 4.1.1 is not used. 📏
Whenever a host changes its compatibility mode, it cancels all its pending response and retransmission timers. 🧹
An SSM-aware host that receives an IGMPv1 Query, an IGMPv2 General Query, or an IGMPv2 Group Specific Query for a multicast address in the SSM address range SHOULD log an error. It is RECOMMENDED that implementations provide a configuration option to disable use of the Host Compatibility Mode, so networks can operate only in SSM mode. This configuration option SHOULD be disabled by default. 🔥
7.2.2. In the Presence of Older Version Group Members
An IGMPv3 host might end up on a network with hosts that haven't been upgraded to IGMPv3 yet 🦋 A host MAY allow its IGMPv3 Membership Record to be suppressed by either an IGMPv1 Membership Report or an IGMPv2 Membership Report. SSM-aware hosts MUST NOT allow their IGMPv3 Membership Record to be suppressed. 🙈
7.3. Multicast Router Behavior
7.3.1. In the Presence of Older Version Queriers
IGMPv3 routers may end up on a network where at least one router hasn't been upgraded to IGMPv3 yet. The following requirements apply 💅
- If any older versions of IGMP are present on routers, the querier MUST use the lowest version of IGMP present on the network. This has to be administratively assured. Routers that want to be compatible with IGMPv1 and IGMPv2 MUST have a configuration option to act in IGMPv1 or IGMPv2 compatibility modes. When in IGMPv1 mode, routers MUST send Periodic Queries with a Max Resp Code of 0 and truncated at the Group Address field (i.e., 8 bytes long), and they MUST ignore Leave Group messages. They SHOULD also warn about receiving an IGMPv2 or IGMPv3 query, although such warnings MUST be rate-limited. When in IGMPv2 mode, routers MUST send Periodic Queries truncated at the Group Address field (i.e., 8 bytes long), and they SHOULD also warn about receiving an IGMPv3 query (such warnings MUST be rate-limited). They also MUST fill in the Max Response Time in the Max Resp Code field, i.e., the exponential algorithm described in Section 4.1.1 is not used.
- If a router is not explicitly configured to use IGMPv1 or IGMPv2 and receives an IGMPv1 Query or IGMPv2 General Query, it SHOULD log a warning. These warnings MUST be rate-limited. ⚠️
- It is RECOMMENDED that implementations provide a configuration option to disable use of compatibility mode, so networks can operate only in SSM mode. This configuration option SHOULD be disabled by default. 🌟
7.3.2. In the Presence of Older Version Group Members ✨
Okay bestie, so IGMPv3 routers can end up on a network with hosts that haven't upgraded to IGMPv3 yet 😭. To stay compatible with those older hosts, IGMPv3 routers MUST operate in v1 and v2 compatibility modes 🫶. Routers keep a compatibility mode for each Group Record, and it's set by a variable called the Group Compatibility Mode. That variable can be in one of three states: IGMPv1, IGMPv2, or IGMPv3 💅. It's tracked per Group Record and depends on which versions of Membership Reports came in for that group, plus the Older-Version-Host-Present Timer for the group 🦋.
To switch between versions smoothly, routers keep an IGMPv1-Host-Present Timer and an IGMPv2-Host-Present Timer for each Group Record 🌸. The IGMPv1-Host-Present Timer gets set to [Older Version Host Present Interval] seconds every time an IGMPv1 Membership Report comes in. The IGMPv2-Host-Present Timer gets set to [Older Version Host Present Interval] seconds every time an IGMPv2 Membership Report comes in 🎀.
The Group Compatibility Mode of a Group Record changes whenever an older version report shows up (older than the current mode) or when certain timer conditions happen ⏰. When the IGMPv1-Host-Present Timer expires, the router switches to IGMPv2 mode if its IGMPv2 Host Present timer is still running. If that timer isn't running, it switches to IGMPv3 mode instead. When the IGMPv2-Host-Present Timer expires and the IGMPv1-Host-Present Timer isn't running, the router switches to IGMPv3 mode 💜.
Heads up, though: when a group switches back to IGMPv3 mode, it takes some time to get its source-specific state info back 😬. That info gets learned during the next General Query. Sources that should be blocked won't actually get blocked until [Group Membership Interval] after that 💀.
The Group Compatibility Mode variable is based on whether an older version report was received in the last [Older Version Host Present Interval] seconds. The mode gets set based on the table below 💖.
+==========================+=====================================+
| Group Compatibility Mode | Timer State |
+==========================+=====================================+
| IGMPv3 (default) | IGMPv2 Host Present not running and |
| | IGMPv1 Host Present not running |
+--------------------------+-------------------------------------+
| IGMPv2 | IGMPv2 Host Present running and |
| | IGMPv1 Host Present not running |
+--------------------------+-------------------------------------+
| IGMPv1 | IGMPv1 Host Present running |
+--------------------------+-------------------------------------+
Table 12: Group Compatibility Mode SettingsIf a router gets a report that updates its older Host Present timers, and that also changes its compatibility mode, it SHOULD switch compatibility modes right away ⚡.
When Group Compatibility Mode is IGMPv3, the router just acts using the IGMPv3 protocol for that group 🧚.
When Group Compatibility Mode is IGMPv2, the router internally translates these IGMPv2 messages for that group into their IGMPv3 equivalents 🔁.
+================+===================+
| IGMPv2 Message | IGMPv3 Equivalent |
+================+===================+
| Report | IS_EX( {} ) |
+----------------+-------------------+
| Leave | TO_IN( {} ) |
+----------------+-------------------+
Table 13: IGMPv2 Compatibility
Mode Message TranslationIGMPv3 BLOCK messages get ignored, and so do source-lists in TO_EX() messages. That means any TO_EX() message is treated as TO_EX( {} ) 🙈.
When Group Compatibility Mode is IGMPv1, the router internally translates these IGMPv1 and IGMPv2 messages for that group into their IGMPv3 equivalents 🌈.
+================+===================+
| IGMPv2 Message | IGMPv3 Equivalent |
+================+===================+
| v1 Report | IS_EX( {} ) |
+----------------+-------------------+
| v2 Report | IS_EX( {} ) |
+----------------+-------------------+
Table 14: IGMPv1 Compatibility
Mode Message TranslationIn IGMPv1 mode, the router ignores IGMPv3 BLOCK messages and source-lists in TO_EX() messages, same as in IGMPv2 mode. On top of that, IGMPv2 Leave messages and IGMPv3 TO_IN() messages are also ignored 🫠.
8. List of Timers, Counters, and Their Default Values 🍓
Most timers and counters can be configured 🛠️. If you use non-default settings, they MUST be consistent across all systems on a single link 🔗. Also, parentheses group expressions so the algebra stays clear 🧮.
8.1. Robustness Variable
The Robustness Variable lets you tune for how much packet loss you expect on a network 📉. If the network is expected to be lossy, you can increase the Robustness Variable. IGMP is robust to (Robustness Variable - 1) packet losses 💪. The Robustness Variable MUST NOT be zero and SHOULD NOT be one. Default: 2.
8.2. Query Interval
The Query Interval is the time between General Queries sent by the Querier. Default: 125 seconds ⏳.
Tuning the Query Interval lets an admin control how many IGMP messages hit the network. Bigger values mean IGMP Queries get sent less often 🐢.
8.3. Query Response Interval
The Query Response Interval uses the Max Response Time to work out the Max Resp Code that goes into the periodic General Queries. Default: 100 (10 seconds) ⏱️.
By changing the [Query Response Interval], an admin can tune how bursty IGMP messages are on the network. Bigger values make the traffic less bursty, since host responses get spread over a longer interval 🌊. The number of seconds in the [Query Response Interval] must be less than the [Query Interval].
8.4. Group Membership Interval
The Group Membership Interval is how long a multicast router has to wait before it decides there are no more members of a group, or of a particular source, on a network 👀.
This value MUST be ([Robustness Variable] times [Query Interval]) plus (2 * [Query Response Interval]) 🧠.
8.5. Other Querier Present Interval
The Other Querier Present Interval is how long a multicast router has to wait before it decides that another multicast router is no longer the one that should be the querier 🕵️♀️. This value MUST be ([Robustness Variable] times [Query Interval]) plus (0.5 times [Query Response Interval]).
8.6. Startup Query Interval
The Startup Query Interval is the time between General Queries that a Querier sends when it starts up 🚀. Default: 1/4 times [Query Interval].
8.7. Startup Query Count
The Startup Query Count is how many Queries get sent on startup, spaced out by the Startup Query Interval 🔢. Default: [Robustness Variable].
8.8. Last Member Query Interval
The Last Member Query Interval (LMQI) is the Max Response Time used to work out the Max Resp Code that goes into Group Specific Queries sent in response to Leave Group messages 🚪. It's also the Max Response Time used when calculating the Max Resp Code for Group-and-Source Specific Query Messages. Default: 10 (1 second).
Heads up: for LMQI values above 12.8 seconds, only a limited set of values can be represented, matching sequential values of Max Resp Code 🤓. When you convert a configured time into a Max Resp Code value, it is recommended to use the exact value if possible. If the requested value can't be represented exactly, use the next lower value instead.
This value can be tuned to change the leave latency of the network. A smaller value means it takes less time to detect that the last member of a group or source has left 🏃♀️.
8.9. Last Member Query Count
The Last Member Query Count is the number of Group Specific Queries sent before the router assumes there are no local members left 🧾. It's also the number of Group-and-Source Specific Queries sent before the router assumes there are no listeners for a particular source. Default: [Robustness Variable].
8.10. Last Member Query Time
The Last Member Query Time is the time value you get by multiplying [Last Member Query Interval] by [Last Member Query Count] ➕. It isn't a tunable value itself, but you can change it by tuning its components 🎛️.
8.11. Unsolicited Report Interval
The Unsolicited Report Interval is the time between repeats of a host's first report that it has joined a group 📣. Default: 1 second.
8.12. Older Version Querier Present Interval
The Older Version Querier Present Interval is the timeout for moving a host back to IGMPv3 mode once an older version query shows up 🔙. When an older version query comes in, hosts set their Older-Version-Querier-Present Timer to [Older Version Querier Present Interval].
It is RECOMMENDED to use the default values when calculating this interval, since hosts don't know the values configured on the querying routers 🤷♀️. This value SHOULD be [Robustness Variable] times [Query Interval] plus (10 times the Max Response Time in the last received Query Message).
8.13. Older Host Present Interval
The Older Host Present Interval is the timeout for moving a group back to IGMPv3 mode once an older version report has been sent for that group 🔄. When an older version report comes in, routers set their Older-Host-Present Timer to [Older Host Present Interval].
This value MUST be ([Robustness Variable] times [Query Interval]) plus [Query Response Interval] 💅.
8.14. Configuring Timers
This section is here to give network admins advice on tuning these settings for their network 📝. Ambitious router implementations might even tune these settings dynamically, based on how the network's characteristics change over time 🤖.
8.14.1. Robustness Variable
The Robustness Variable tunes IGMP to the packet losses you expect on a link 🧵. IGMPv3 is robust to ([Robustness Variable] - 1) packet losses. For example, if the Robustness Variable is set to the default value of 2, IGMPv3 handles a single packet loss but might not work perfectly if more losses happen 😅. On lossy subnetworks, the Robustness Variable should be increased to cover the expected level of packet loss. But increasing it also increases the leave latency of the subnetwork 🐌. (Leave latency is the time between when the last member stops listening to a source or group and when the traffic stops flowing.)
8.14.2. Query Interval
The overall level of periodic IGMP traffic is inversely proportional to the Query Interval 📊. A longer Query Interval means less IGMP traffic overall 🌙. The Query Interval MUST be equal to or longer than the Max Response Time inserted in General Query Messages ✨.
8.14.3. Max Response Time ✨
okay so the burstiness of IGMP traffic is inversely proportional to the Max Response Time 🌊 a longer Max Response Time spreads Report messages over a longer interval. BUT (and this is the tea 🍵) a longer Max Response Time in Group Specific and Source-and-Group Specific Queries makes the leave latency longer too. The leave latency is the time between when the last member stops listening to a source or group and when the traffic stops flowing 🙈
The expected rate of Report messages can be calculated by dividing the expected number of Reporters by the Max Response Time. The Max Response Time can even be dynamically calculated per Query by using the expected number of Reporters for that Query, like this:
+======================+============================================+
| Query Type | Expected Number of Reporters |
+======================+============================================+
| General Query | All systems on the subnetwork |
+----------------------+--------------------------------------------+
| Group Specific | All systems that had expressed interest in |
| Query | the group on the subnetwork |
+----------------------+--------------------------------------------+
| Source-and-Group | All systems on the subnetwork that had |
| Specific Query | expressed interest in the source and group |
+----------------------+--------------------------------------------+Table 15: Expected Number of IGMP Reporters 📊
A router is not required to calculate these populations or tune the Max Response Time dynamically. These are simply guidelines, bestie 🫶
9. Security Considerations 🔐
Okay, real talk, this section is SERIOUS 😭 IGMP does not provide any form of confidentiality. That means any device on a link can passively receive any IGMP message on the link. That kind of access can lead to privacy concerns around potentially sensitive multicast groups, or to the ability to identify and map the devices on a link 👀
We consider the ramifications of a forged message of each type, and we describe the usage of an IPsec Authentication Header (AH) to authenticate messages if you want it 🛡️
9.1. Query Message
A forged Query Message from a machine with a lower IP address than the current Querier will cause Querier duties to be assigned to the forger 💀 If the forger then sends no more Query Messages, other routers' Other-Querier-Present Timer will time out, and one of them will resume the role of Querier. During this time, if the forger ignores Leave messages, traffic might flow to groups with no members for up to [Group Membership Interval]. Not it 🙅♀️
A Denial-of-Service (DoS) attack on a host could be staged through forged Group-and-Source Specific Queries. The attacker can find out about the membership of a specific host with a General Query. After that, it could send a large number of Group-and-Source Specific Queries, each with a large source-list and the Maximum Response Time set to a large value. The host will have to store and maintain the sources specified in all of those Queries for as long as it takes to send the delayed response. This would consume both memory and CPU cycles, because the host has to augment the recorded sources with the source-lists included in the successive Queries 🔥
To protect against such a DoS attack, a host stack implementation could restrict the number of Group-and-Source Specific Queries per group membership within this interval, and/or record only a limited number of sources 🧱
Forged Query Messages from the local network can be easily traced. There are three measures necessary to defend against externally forged Queries:
- Routers SHOULD NOT forward Queries. This is easier for a router to accomplish if the Query carries the Router Alert option.
- Hosts SHOULD ignore v2 or v3 Queries without the Router Alert option.
- Hosts SHOULD ignore v1, v2, or v3 General Queries sent to a multicast address other than 224.0.0.1, the all-systems address.
9.2. Current-State Report Messages
A forged Report message may cause multicast routers to think there are members of a group on a network when there are not 🤡 Forged Report messages from the local network are meaningless, though, because joining a group on a host is generally an unprivileged operation. So a local user can trivially get the same result without forging any messages. Forged Report messages from external sources are more troublesome, and there are two defenses against externally forged Reports:
- Ignore the Report if you cannot identify the source address of the packet as belonging to a network assigned to the interface on which the packet was received. This solution means that Reports sent by mobile hosts without addresses on the local network will be ignored. Report messages with a source address of 0.0.0.0 SHOULD be accepted on any interface.
- Ignore Report messages without Router Alert options [RFC2113], and require routers to not forward Report messages. (The requirement is not a requirement of generalized filtering in the forwarding path, as the packets already have Router Alert options in them.) This solution breaks backwards compatibility with implementations of IGMPv1 or earlier versions of IGMPv2 that did not require a Router Alert 💔
A forged v1 Report message may put a router into "v1 members present" state for a particular group, meaning that the router will ignore Leave messages. This can cause traffic to flow to groups with no members for up to [Group Membership Interval]. It can be solved by giving routers a configuration switch to ignore v1 messages completely. That breaks automatic compatibility with v1 hosts, so it should only be used in situations where "fast leave" is critical ⚡
A forged v2 Report message may put a router into "v2 members present" state for a particular group, meaning that the router will ignore IGMPv3 source-specific state messages. This can cause traffic to flow from unwanted sources for up to [Group Membership Interval]. It can be solved by giving routers a configuration switch to ignore v2 messages completely. That breaks automatic compatibility with v2 hosts, so it should only be used in situations where source include and exclude is critical 🎀
9.3. State-Change Report Messages
A forged State-Change Report message will cause the Querier to send out Group Specific or Source-and-Group Specific Queries for the group in question. This causes extra processing on each router and on each member of the group, but it cannot cause loss of desired traffic 🙌 There are two defenses against externally forged State-Change Report messages:
- Ignore the State-Change Report message if you cannot identify the source address of the packet as belonging to a subnet assigned to the interface on which the packet was received. This solution means that State-Change Report messages sent by mobile hosts without addresses on the local subnet will be ignored. State-Change Report messages with a source address of 0.0.0.0 SHOULD be accepted on any interface.
- Ignore State-Change Report messages without Router Alert options [RFC2113], and require routers to not forward State-Change Report messages. (The requirement is not a requirement of generalized filtering in the forwarding path, as the packets already have Router Alert options in them.)
9.4. IPsec Usage
In addition to these measures, IPsec in AH mode [RFC4302] may be used to protect against remote attacks, by ensuring that IGMPv3 messages came from a system on the LAN (or, more specifically, from a system with the proper key) 🔑 When using IPsec, the messages sent to 224.0.0.1 and 224.0.0.22 should be authenticated using AH. When it comes to keying, there are two possibilities:
- Use a symmetric signature algorithm with a single key for the LAN (or a key for each group). This allows validation that a packet was sent by a system with the key. The limitation is that any system with the key can forge a message, so it is not possible to authenticate the individual sender precisely. It also requires disabling IPsec's Replay Protection 🥲
- When appropriate key management standards have been developed, use an asymmetric signature algorithm. All systems need to know the public key of all routers, and all routers need to know the public key of all systems. This requires a large amount of key management, but it has the advantage that senders can be authenticated individually. So, e.g., a host cannot forge a message that only routers should be allowed to send 🔐
This solution only directly applies to Query and Leave messages in IGMPv1 and IGMPv2, because Reports are sent to the group being reported. It is also not feasible to agree on a key for host-to-router communication for arbitrary multicast groups 🌸
10. IANA Considerations 🧾
All IGMP types described in this document are managed via [BCP57].
IANA has replaced each reference to [RFC3376] with a reference to this document in both the "IGMP Type Numbers" and "IPFIX Information Elements" registries ✨
11. References 📚
11.1. Normative References
[BCP57] Best Current Practice 57,
<https://www.rfc-editor.org/info/bcp57>.
At the time of writing, this BCP comprises the following:
Haberman, B., Ed., "IANA Considerations for Internet Group
Management Protocols", BCP 57, RFC 9778,
DOI 10.17487/RFC9778, March 2025,
<https://www.rfc-editor.org/info/rfc9778>.
[RFC1112] Deering, S., "Host extensions for IP multicasting", STD 5,
RFC 1112, DOI 10.17487/RFC1112, August 1989,
<https://www.rfc-editor.org/info/rfc1112>.
[RFC2113] Katz, D., "IP Router Alert Option", RFC 2113,
DOI 10.17487/RFC2113, February 1997,
<https://www.rfc-editor.org/info/rfc2113>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC2236] Fenner, W., "Internet Group Management Protocol, Version
2", RFC 2236, DOI 10.17487/RFC2236, November 1997,
<https://www.rfc-editor.org/info/rfc2236>.
[RFC4302] Kent, S., "IP Authentication Header", RFC 4302,
DOI 10.17487/RFC4302, December 2005,
<https://www.rfc-editor.org/info/rfc4302>.
[RFC4604] Holbrook, H., Cain, B., and B. Haberman, "Using Internet
Group Management Protocol Version 3 (IGMPv3) and Multicast
Listener Discovery Protocol Version 2 (MLDv2) for Source-
Specific Multicast", RFC 4604, DOI 10.17487/RFC4604,
August 2006, <https://www.rfc-editor.org/info/rfc4604>.
[RFC4607] Holbrook, H. and B. Cain, "Source-Specific Multicast for
IP", RFC 4607, DOI 10.17487/RFC4607, August 2006,
<https://www.rfc-editor.org/info/rfc4607>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.11.2. Informative References 📚✨
okay these are the bonus reads, bestie 🫶 you don't need them to implement the spec, but they give you the backstory
- [RFC1071] Braden, R., Borman, D., and C. Partridge, "Computing the Internet checksum", RFC 1071, DOI 10.17487/RFC1071, September 1988, <https://www.rfc-editor.org/info/rfc1071>.
- [RFC3376] Cain, B., Deering, S., Kouvelas, I., Fenner, B., and A. Thyagarajan, "Internet Group Management Protocol, Version 3", RFC 3376, DOI 10.17487/RFC3376, October 2002, <https://www.rfc-editor.org/info/rfc3376>.
- [RFC3569] Bhattacharyya, S., Ed., "An Overview of Source-Specific Multicast (SSM)", RFC 3569, DOI 10.17487/RFC3569, July 2003, <https://www.rfc-editor.org/info/rfc3569>.
- [RFC3678] Thaler, D., Fenner, B., and B. Quinn, "Socket Interface Extensions for Multicast Source Filters", RFC 3678, DOI 10.17487/RFC3678, January 2004, <https://www.rfc-editor.org/info/rfc3678>.
Appendix A. Design Rationale 🧠💅
this appendix is the why behind all the vibes
A.1. The Need for State-Change Messages 💌
IGMPv3 gives us two flavours of Membership Reports: Current-State and State-Change. This section explains why we need both types, ngl it's a whole thing 😭
Routers need to tell apart the Membership Reports sent in response to Queries from the ones sent because an interface's state changed. Reports sent in response to Membership Queries are mainly for refreshing the state the router already has, so they typically don't cause transitions in state at the router. Reports sent in response to changes in interface state make the router take some action on the received report (see Section 6.4).
If the router couldn't tell them apart, it would have to treat every Membership Report as a possible change in state. That could mean more processing at the router, plus more IGMP traffic on the network 😵💫
A.2. Host Suppression 🙈
In IGMPv1 and IGMPv2, a host would cancel its pending Membership Reports if it spotted a similar report from another member on the network. IGMPv3 removed this suppression of host Membership Reports, and here's the tea on why 🍓
- Routers may want to track per-host membership status on an interface. This allows routers to implement fast leaves (e.g., for layered multicast congestion control schemes) as well as track membership status for possible accounting purposes.
- Membership Report suppression does not work well on bridged LANs. Many bridges and Layer 2 / Layer 3 switches that implement IGMP snooping do not forward IGMP messages across LAN segments in order to prevent Membership Report suppression. Removing Membership Report suppression eases the job of these IGMP snooping devices.
- By eliminating Membership Report suppression, hosts have fewer messages to process; this leads to a simpler state machine implementation.
- In IGMPv3, a single Membership Report now bundles multiple multicast Group Records to decrease the number of packets sent. In comparison, the previous versions of IGMP required that each multicast group be reported in a separate message.
A.3. Switching Router Filter Modes from EXCLUDE to INCLUDE 🔀
if hosts exist in both EXCLUDE and INCLUDE modes for a single multicast group in a network, the router must be in EXCLUDE mode as well (see Section 6.2.1). In EXCLUDE mode, a router forwards traffic from all sources unless that source exists in the exclusion source-list. If all hosts in EXCLUDE mode cease to exist, it would be desirable for the router to switch back to INCLUDE mode seamlessly, without interrupting the flow of traffic to existing receivers ✨
one way to make that happen is for routers to keep track of all sources desired by hosts in INCLUDE mode, even though the router itself is in EXCLUDE mode. If the Group Timer now expires in EXCLUDE mode, it implies there are no hosts in EXCLUDE mode on the network (otherwise, a Membership Report from that host would have refreshed the Group Timer). The router can then switch to INCLUDE mode seamlessly, using the list of sources currently being forwarded in its source-list. main character router energy 👑
Appendix B. Summary of Changes from IGMPv2 📋
okay so the big new feature of IGMPv3 is source filtering 🎀 but there are a bunch of other changes from [RFC2236] too:
- State is maintained as Group + List-of-Sources, not simply Group as in IGMPv2.
- Interoperability with IGMPv1 and IGMPv2 systems is defined as operations on the IGMPv3 state.
- The IP service interface has changed, to allow specification of source-lists.
- The Querier includes its Robustness Variable and Query Interval in Query packets to allow synchronization of these variables on non-Queriers.
- The Max Response Time in Query Messages has an exponential range, changing the maximum from 25.5 seconds to about 53 minutes, for use on links with a huge number of systems.
- Hosts retransmit state-change messages for increased robustness.
- Additional data sections are defined, to allow later extensions.
- Report packets are sent to 224.0.0.22, to assist Layer 2 switches in snooping.
- Report packets can contain multiple Group Records, to allow reporting of full current state using fewer packets.
- Hosts no longer perform suppression, to simplify implementations and permit explicit membership tracking.
- A new S flag in Query Messages fixes robustness issues, which were also present in IGMPv2.
Appendix C. Summary of Changes from RFC 3376 🌈
here's the list of changes made since [RFC3376] was published, bestie 💜
- Modified the definition of Older Version Querier Present Interval to address Erratum 4375.
- Modified the metadata to fix the Obsoletes vs. Updates relationship with [RFC2236] per Erratum 1501.
- Updated the introductory text to describe the Updates relationship with [RFC2236] per Erratum 7339.
- Updated the definition of Group Membership Interval to address Erratum 6725.
- Updated the text relating to the Router Filter Mode to address Erratum 5562.
- Clarified the use of General Queries in the Querier election process.
Acknowledgments 🫶
we would like to thank Ran Atkinson, Luis Costa, Toerless Eckert, Dino Farinacci, Serge Fdida, Wilbert de Graaf, Sumit Gupta, Mark Handley, Bob Quinn, Michael Speer, Dave Thaler, and Rolland Vida for comments and suggestions on [RFC3376]. the real MVPs 🌸
Stig Venaas, Hitoshi Asaeda, and Mike McBride have provided valuable feedback on this specification, and we thank them for their input 🧚
Contributors 💖
Brad Cain, Steve Deering, Isidor Kouvelas, Bill Fenner, and Ajit Thyagarajan are the authors of [RFC3376], which forms the bulk of the content contained herein. legends, all of them 👑
Anuj Budhiraja, Toerless Eckert, Olufemi Komolafe, and Tim Winters have contributed valuable content to this specification 🎀
Author's Address 📮
Brian Haberman (editor) Johns Hopkins University Applied Physics Lab Email: brian@innovationslab.net
📦 where this page comes from
- ietf: rfc9776 2025-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms