Technical Tip: Multicast / IGMP behavior with FortiSwitch
| Description | This article explains how multicast works within a FortiSwitch without igmp-snooping enabled. |
| Scope | FortiSwitch. |
| Solution | To test the Multicast/IGMP traffic, the tool mcjoin will be used. This is available on GitHub: https://github.com/troglobit/mcjoin
The following architecture has been built in a lab environment:
 Host05 will act as client/receiver. On switch, port5, port6, and port7 have packet-sampler enabled with a rate of 1. These 3 ports have the same native VLAN (60).
Default behavior: Multicast / IGMP on Layer 2 acts like a broadcast.
Case Study: FortiSwitch with default configuration regarding IGMP.
On Host05:
From the CLI:
mcjoin
By default, mcjoin uses the multicast address 225.1.2.3. With this, a report is sent by the device to inform that the host wants to join the group 225.1.2.3. From a sniffer on the switch, it is possible to see this packet:
155.923872 sp5 in 802.1Q vlan#60 P0 -- 192.168.60.2 -> 225.1.2.3: ip-proto-2 8
Converting to Wireshark:
 On Host06:
From the CLI:
mcjoin -s -c 10 (-s allows sending the multicast traffic, -c 10 sends 10 packets.)
By default, mcjoin uses the multicast address 225.1.2.3.
On Host05: The progress bar at the top right-hand corner will display the number of packets sent. As 10 packets have been sent from host06, 10 packets should be received:
   On Host07: Even if the host did not send any report to receive the multicast traffic, this traffic reached host07:
root@host07:/home/fortinet# tcpdump -i eth1 -f "host 225.1.2.3" tcpdump: verbose output suppressed, use -v[v]... for full protocol decode This is expected, as it is the normal behavior for a switch without any configuration. The Multicast traffic is sent on all ports, as with broadcast traffic.
Related article: Technical Tip: Configure IGMP-snooping on FortiSwitch Managed by FortiGate (FortiLink) |
