up vote 1 down vote favorite
1
share [g+] share [fb]

From the multicast howto:

IP_ADD_MEMBERSHIP.

Recall that you need to tell the kernel which multicast groups you are interested
in. If no process is interested in a group, packets destined to it that arrive to
the host are discarded.

If you don't do that, you won't see those packets with tcpdump.

  • Is it possible to subscribe to all multicast traffic so I can do a tcpdump for all existing traffic? I would think IGMP doesn't allow this, so probably not.. but maybe you can configure a switch to still send all multicast traffic. Is that possible?
  • Is it possible to do subscription (for a specific IP) with a command line tool? (note: I know how to do this in C.. but would prefer to use an existing tool and not compile a separate program for this)
link|improve this question
50% accept rate
feedback

1 Answer

up vote 1 down vote

It depends on your multicast infrastructure: For instance, you could have many multicast routers, and various rules set on your switches (making subscriptions static, or dynamic, or even banned on certain ports/nodes).

But, if you want to subscribe to a multicast group... Just subscribe. Send an IGMP JOIN packet across some infrastructure, which obviously has IGMP snooping enabled. You can generate an IGMP packet with a variety of tools.

Taking a step to a higher level, use iperf to subscribe to any multicast group. If your network infrastructure isn't too complex, and if you are "allowed" to subscribe to any multicast group, then use the following:

iperf -s -u -B 239.100.100.100 Where 239.100.100.100 is your multicast group address.

tcpdump simultaneously to get a detailed report.

Note that I believe iperf only supports IGMP v1 and v2. If you want to craft an IGMP v3 JOIN packet, it shouldn't be too hard to write a program, as you stated. But there would be a lot more tools out there that would probably do the same.

link|improve this answer
"You can generate an IGMP packet with a variety of tools.". What are these tools? I obviously don't want to manually assemble a packet.. iperf looks nice. What else can you use? – yi_H Oct 28 '11 at 13:21
Also, as I said, if possible, I want to get all available multicast traffic. There are a lot of traffic and I don't know all the addresses. – yi_H Oct 28 '11 at 13:24
Other tools like the large count of packet generation tools, where you craft the packet with a nice front end for instance. iperf would serve much better, but doesn't support IGMP v3 (I don't think). You can't just "get all multicast traffic." That's the exact opposite purpose of multicast. What you're asking for now sounds like more of a job for port mirroring/spanning on a switch trunk port/point, where you know the multicast traffic traverses. Sniff at the target port, filtering for multicast packets, and you've got your answer. – mbrownnyc Oct 28 '11 at 13:32
And, by the way, you might be able to leverage the API your apps are using to send and receive multicast to compile a membership list in a centralized location that you could, in turn, subscribe to at the higher level (other than physical, layer 2 as the suggestion to mirror traffic). – mbrownnyc Oct 28 '11 at 13:53
.. so I set up the switch so it forwards all the multicast traffic.. now it arrives at my linux box, where the kernel will drop all those packets because apps haven't subscribed for the specific multicast addresses.. or have I misunderstood something? – yi_H Oct 28 '11 at 15:10
show 11 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.