IP Multicast Basics: Groups, IGMP, PIM Sparse Mode, RP

The one-sentence mental model

Multicast = one-to-many delivery. Sender doesn’t know or care who’s listening. Anyone who wants the stream joins the group. The network makes copies only where needed, so N receivers on N branches only cost the source one packet at the source and copies happen at branch points.

The address space

• Multicast group range: 224.0.0.0/4 (224.0.0.0 to 239.255.255.255)
• Link-local reserved: 224.0.0.0/24: never forwarded off the local segment (used by OSPF 224.0.0.5/6, HSRP 224.0.0.2, all-hosts 224.0.0.1)
• SSM: 232.0.0.0/8: Source-Specific Multicast
• GLOP: 233.0.0.0/8: static allocations based on AS number
• Administratively scoped: 239.0.0.0/8: private, don’t advertise outside your admin domain

Each IPv4 multicast group maps to a specific Layer-2 MAC: 01:00:5e: + lower 23 bits of the IP group. Because 5 bits of the group address are not mapped, 32 IP groups share each multicast MAC.

The two protocols

IGMP: Host to router

IGMP (Internet Group Management Protocol) runs between hosts and their last-hop router. Only appears on the LAN segment where receivers live.

• IGMPv2 (most common): host sends a Report to join, Leave to leave. Router periodically sends General Queries.
• IGMPv3: adds source-specific filtering (“I want group X, but only from source S”).

Timers: router queries every 60s (default), assumes group is empty if no report for a couple of query intervals.

PIM: Router to router

PIM (Protocol Independent Multicast) builds the distribution tree between routers. “Independent” because it uses the existing unicast routing table for RPF (Reverse Path Forwarding) checks. Doesn’t run its own routing.

Two main modes:

• PIM Dense Mode: flood-and-prune. Assumes receivers everywhere, prunes back branches with no interest. Wasteful. Rarely used.
• PIM Sparse Mode: assume receivers few. Explicit join required. The default modern choice.

Sparse Mode + Rendezvous Point (RP)

In Sparse Mode:

1. All routers pre-configured with a Rendezvous Point (RP) IP address.
2. Sender’s first-hop router registers the source with the RP (unicast tunnel).
3. Interested last-hop routers send a Join toward the RP, building a shared tree (RPT / *,G tree) from RP to receivers.
4. Traffic flows from source → RP → shared tree → receivers.
5. Once traffic is flowing, last-hop routers may switch to a source-specific tree (SPT / S,G tree): direct source-to-receiver path via SPT-switchover.

RP configuration options

• Static RP: every router configured with the same RP IP. Simple, no automation. ip pim rp-address 10.0.0.1
• Auto-RP (Cisco proprietary): RPs advertise themselves; a Mapping Agent elects and advertises the mapping.
• BSR (Bootstrap Router): IETF-standard, similar to Auto-RP but interoperable across vendors.
• Anycast RP: same RP IP on multiple physical routers via anycast + MSDP to keep them synced. Redundant RP without failover delay.

IGMP Snooping: the switch’s job

By default a switch treats multicast frames as unknown-unicast and floods them out every port in the VLAN. On a modern switch you turn on IGMP snooping so the switch listens to IGMP Reports and Leaves, builds a table of which ports have receivers, and forwards multicast only to those ports.

! Global: on by default on modern Cat9K
ip igmp snooping

! Per-VLAN
ip igmp snooping vlan 10

Without snooping, one IPTV stream floods to every port on the VLAN. With it, only interested clients receive.

Sample IOS-XE config (Sparse Mode, static RP)

! On every multicast router:
ip multicast-routing distributed

interface GigabitEthernet0/1
  ip pim sparse-mode

! Same on every interface that needs to carry multicast

ip pim rp-address 10.0.0.1

Verify:

show ip mroute                    ! multicast routing table (*,G) and (S,G)
show ip pim neighbor              ! PIM adjacencies
show ip pim rp mapping            ! which RP is being used
show ip igmp groups               ! last-hop LAN joins

Common exam / real-world mistakes

1. Forgetting ip multicast-routing. Without it globally, PIM commands are accepted but nothing works. First thing to check.
2. PIM disabled on the WAN interface between two multicast domains. Multicast requires PIM on every hop end-to-end.
3. Wrong RP address on some routers. All routers must agree on RP. Static config with typos is common.
4. Skipping IGMP snooping on the switch. Multicast works but performance is terrible. Every port floods.
5. Blocking multicast in ACLs. ACLs must permit the specific group addresses and the source IPs.
6. Assuming multicast crosses NAT. It generally doesn’t: NAT devices don’t handle multicast state well. Design around it.

Common groups you’ll see

• 224.0.0.5: OSPF All-SPF-Routers
• 224.0.0.6: OSPF All-DR-Routers
• 224.0.0.2: HSRP
• 224.0.0.9: RIPv2
• 224.0.0.10: EIGRP
• 224.0.0.13: All-PIM-Routers
• 239.255.255.250: SSDP / UPnP discovery

Cheat strip

Address space   224.0.0.0/4 (224-239.x)
                224.0.0.0/24 = link-local, never routed
                239.0.0.0/8  = admin-scoped private

Host↔router     IGMPv2 join/leave (or v3 with source-specific)
Router↔router   PIM Sparse Mode + RP

RP options      static | Auto-RP | BSR | Anycast RP + MSDP
Trees           RPT (shared, via RP) → SPT switchover (source-specific)

IGMP snooping   switch tracks joined ports, prevents VLAN flood

Enable          ip multicast-routing (global)
                ip pim sparse-mode (every interface)
                ip pim rp-address X.X.X.X (RP config)

Verify          show ip mroute
                show ip pim rp mapping
                show ip igmp groups