IP Multicast Routing Concepts

Can you imagine a video conference taking place on a primarily T1 based WAN? Multiple copies of the same video stream being unicast from the host to each participant. Multiple people at each location streaming the same video conference would destroy your bandwidth and quickly become a QoS nightmare. Such a solution has serious scalability limitations. IP Multicast can provide a solution where only one copy of each packet is sent down a single connection.

Multicast receivers join a group, denoted by a Class D IP address (inside 224.0.0.0/4). The source sends traffic to the Class D address and packets are forwarded only to intended destinations. Multicast is delivered best effort at the IP layer, and multicast applications almost always run on UDP, since TCP can’t do one-to-many. As with any UDP traffic, a client may receive duplicate packets or packets delivered out of order. To keep the distribution tree loop free, every PIM router (Cisco or otherwise) performs a Reverse Path Forwarding (RPF) check, which determines if a multicast packet is entering a router on the appropriate interface. During an RPF check the router examines the source address of an incoming packet and checks it against the unicast routing table to see which interface would be used to get back to the source network. If the incoming multicast packet is not using that interface, the RPF check fails and the packet is discarded.

Internet Group Management Protocol

The protocol used to join multicast groups is the Internet Group Management Protocol, or IGMP. Routers use IGMP to learn which groups have members on their attached segments, and the multicast routing protocol (PIM) uses that to build the multicast routing table. Currently there are three versions of IGMP out in the wild, however only two are widely deployed.

• IGMPv1: When a PC wants to join a multicast group, it sends an IGMP Report message to the group address it wants to join, letting the router know that it wants to receive traffic for that group. The router also sends a general IGMP Query on the segment periodically (every 60 seconds by default on Cisco) to find out which groups still have members. Queries are sent to 224.0.0.1, which addresses all IP multicast hosts.
• IGMPv2: The two largest differences here are that IGMPv2 enabled routers can send queries to a specific group, and that Leave messages are supported. Since the receiver is allowed to send a Leave message, the router can stop forwarding the group onto that segment far earlier.

In situations where there may be more than one multicast router in a broadcast domain, for example in an Ethernet segment, one router must be designated as the querier for that segment. With IGMPv2, the querier is the router that has the lowest IP unicast address (IGMPv1 left that choice to the multicast routing protocol). To determine which router on a multi-access network is the querier you can issue the command: show ip igmp interface [interface] - The following command displays the multicast groups that your router is aware of: show ip igmp group

Multicast Switching

Without help, L2 switches flood multicast frames to all interfaces (except the one on which it was received). This is obviously not the preferred behavior as it is a huge waste of resources. Instead, the switch should be aware of what interfaces are part of each multicast group. IGMP snooping is a feature that allows Catalyst switches to determine which interfaces are connected to receivers for specific multicast groups by eavesdropping on the IGMP traffic being exchanged. On Catalyst switches it’s enabled globally and on every VLAN by default, so you can confirm it with: show ip igmp snooping - If someone has turned it off, the global command ip igmp snooping turns it back on, and ip igmp snooping vlan [vlan-id] enables it per VLAN. Snooping depends on hearing IGMP queries, so make sure the VLAN has a querier.

Distribution Trees

A member of a multicast group receives the packets destined for that group, thus the sender does not need to be a member of the group for which it is sending packets out to. Multicast traffic flows from a source to a destination over a distribution tree. There are two types of distribution trees:

• Source Distribution Tree: A source distribution tree creates an optimal path between each source router and each last-hop router (a last-hop router is the last router in the path to the client). Source distribution trees place routes in the multicast routing table denoted by the (S,G) or (Source,Group) marking.
• Shared Distribution Tree: Shared distribution trees create a tree from a centralized point in the network known as a rendezvous point or RP to all last-hop routers. Shared trees place multicast routes denoted by the (*,G) or (Any Source,Group). This (*,G) route is created along the path from the RP to the last-hop routers. The advantage here is less memory consumption, at the cost of increased delay.

Multicast Routing Protocols

Cisco routers use the Protocol Independent Multicast (PIM) protocol to construct IP multicast distribution trees. PIM can run over any IP network regardless of the routing protocol. There are two widely used varieties of PIM that I will cover. PIM Sparse mode (PIM-SM) starts receivers on a shared tree through a rendezvous point and normally switches them to source trees, while PIM Dense mode (PIM-DM) uses only source trees. To explain the differences, I want to walk you through the formation of each distribution tree.

PIM-DM

1. Multicast source comes up, floods network with multicast traffic
2. If more than one router is inside the same broadcast domain (Ethernet segment) assert messages are used to determine the PIM forwarder. The router with the best route back to the source wins, compared first by administrative distance, then by metric, with the highest IP address breaking a tie.
3. Routers that do not have multicast receivers for the group send prune messages to their upstream router requesting to be cut off from the flood of traffic. If there is another router in the same broadcast segment with active receivers it will send a join override message and the original prune message will be ignored.
4. If a receiver comes up behind a router that was previously pruned from the distribution tree, that router can rejoin the tree by sending a graft message.
5. Prune state doesn’t last forever. When it times out (roughly every 3 minutes on Cisco), the traffic floods down the pruned branches again and the routers prune all over again. The State Refresh extension exists to suppress that reflood.

PIM-SM

Since the flood and prune method of PIM-DM is not one that scales well at all, most engineers will agree that PIM-SM is a far better solution.

1. A receiver sends an IGMP report message to its router indicating that it wants to join a multicast group. This router sends a PIM join message toward the RP, which creates (*,G) state along the shared tree path to the RP.
2. A source comes up and starts sending. The source doesn’t know anything about PIM. Its router (we’ll call this the first-hop router) encapsulates those multicast packets inside unicast register messages and sends them to the RP. When the RP receives a register, it sends an (S,G) join hop by hop toward the source, which builds a source tree between the first-hop router and the RP and creates (S,G) entries along the path. The first-hop router keeps encapsulating until that tree is up.
3. Once the RP receives the first multicast packet natively along the source tree, it sends a register stop message to the first-hop router. This tells the first-hop router to stop encapsulating packets inside register messages.
4. At this point in time there are two trees. A source tree from the first-hop router to the RP, and a shared tree from the RP to the last hop router. Since this may not be the optimal path, we still have work to do!
5. The last-hop router learns the source’s address from the first packet that arrives down the shared tree, and sends a PIM (S,G) join toward the source, hop by hop, following its unicast route back to the source. This builds the shortest path tree, (S,G), from the first-hop router to the last-hop router. By default Cisco makes this switch on the very first packet (ip pim spt-threshold infinity keeps receivers on the shared tree instead).
6. The last-hop router sends an (S,G,rpt) prune, sometimes called an RP-bit prune, up the shared tree toward the RP, since it gets its multicast traffic elsewhere.
   • If the RP has no other receivers for that source, it sends an (S,G) prune back toward the first-hop router.
   • At this point traffic is flowing in an optimal path between the first-hop and last-hop router. The process of switching between the path from the RP to the direct path is called the Shortest Path Tree (SPT) Switchover.