Internet Group Management Protocol Information & Internet Group Management Protocol Links at HealthHaven.com

The Internet Protocol Suite
Application Layer
	BGP · DHCP · DNS · FTP · GTP · HTTP · IMAP · IRC · Megaco · MGCP · NNTP · NTP · POP · RIP · RPC · RTP · RTSP · SDP · SIP · SMTP · SNMP · SOAP · SSH · Telnet · TLS/SSL · XMPP · (more)
Transport Layer
	TCP · UDP · DCCP · SCTP · RSVP · ECN · (more)
Internet Layer
	IP (IPv4, IPv6) · ICMP · ICMPv6 · IGMP · IPsec · (more)
Link Layer
	ARP/InARP · NDP · OSPF · Tunnels (L2TP) · PPP · Media Access Control (Ethernet, DSL, ISDN, FDDI) · (more)
	This box: view • talk • edit

The Internet Group Management Protocol (IGMP) is a communications protocol used to manage the membership of Internet Protocol multicast groups. IGMP is used by IP hosts and adjacent multicast routers to establish multicast group memberships.

It is an integral part of the IP multicast specification, operating above the network layer, though it doesn't actually act as a transport protocol.^[1] It is analogous to ICMP for unicast connections. IGMP can be used for online streaming video and gaming, and allows more efficient use of resources when supporting these types of applications. IGMP does allow some attacks^[2]^[3]^[4]^[5], and firewalls commonly allow the user to disable it if not needed.

IGMP is only needed for IPv4 networks, as multicast is handled differently in IPv6 networks.

[edit] Architecture

A network designed to deliver a multicast service (like video) using IGMP might use this basic architecture:

IGMP is used both by the client computer and the adjacent network switches to connect the client to a local multicast router. Protocol Independent Multicast (PIM) is then used between the local and remote multicast routers, to direct multicast traffic from the video server to many multicast clients.

[edit] Standards

There are three versions of IGMP, as defined by "Request for Comments" (RFC) documents of the Internet Engineering Task Force (IETF). IGMP v1 is defined by RFC 1112, IGMP v2 is defined by RFC 2236 and IGMP v3 is defined by RFC 3376.

IGMPv3 improves over IGMPv2 mainly by adding the ability to listen to multicast originating from a set of IP addresses only.

[edit] IGMPv3 packet structure

Defined by RFC 3376

[edit] Membership Query Message

Membership Queries are sent by multicast routers to determine which multicast addresses are of interest to systems attached to its network. Routers periodically send General Queries to refresh the group membership state for all systems on its network. Group-Specific Queries are used to determine the reception state for a particular multicast address. Group-and-Source-Specific Queries allow the router to determine if any systems desire reception of messages sent to a multicast group from a source address specified in a list of unicast addresses.

bit offset	0-3	4	5-7	8-15	16-31
0	Type = 0x11			Max Resp Code	Checksum
32	Group Address
64	Resv	S	QRV	QQIC	Number of Sources (N)
96	Source Address [1]
128	Source Address [2]
	. . .
	Source Address [N]

Max Resp Code: This field specifies the maximum time (in 1/10 second) allowed before sending a responding report. If the number is below 128, the value is used directly. If the value is 128 or more, it is interpreted as an exponent with mantisse.
Checksum: This is the 16-bit one's complement of the one's complement sum of the entire IGMP message.
Group Address: This is the multicast address being queried when sending a Group-Specific or Group-and-Source-Specific Query. The field is zeroed when sending a General Query.
Resv: This field is reserved. It should be zeroed when sent and ignored when received.
S (Suppress Router-side Processing) Flag: When this flag is set, it indicates to receiving routers that they are to suppress the normal timer updates.
QRV (Querier's Robustness Variable): If this is non-zero, it contains the Robustness Variable value used by the sender of the Query. Routers should update their Robustness Variable to match the most recently received Query unless the value is zero.
QQIC (Querier's Query Interval Code): This code is used to specify the Query Interval value (in seconds) used by the querier. If the number is below 128, the value is used directly. If the value is 128 or more, it is interpreted as an exponent with mantisse.
Number of Sources (N): This field specifies the number of source addresses present in the Query. For General and Group-Specific Queries, this value is zero. For Group-and-Source-Specific Queries, this value is non-zero, but limited by the network's MTU.
Source Address [i]: The Source Address [i] fields are a vector of n IP unicast addresses, where n is the value in the Number of Sources (N) field.

[edit] IGMPv2 packet structure

Defined by RFC 2236

+	Bits 0 - 7								8 - 15								16 - 23								24 - 31
0	Type								Max Resp Time								Checksum
32	Group Address

Where:

Type is Membership Query (0x11), Membership Report (IGMPv1: 0x12, IGMPv2: 0x16), Leave Group (0x17) IGMPv3 adds type Membership Report (0x22)
Max Resp Time specifies the time limit for the corresponding report. The field has a resolution of 100 miliseconds. If the number is below 128, the value is used directly. If the value is 128 or more, it is interpreted as an exponent with mantisse - see the RFC.

[edit] Host and router implementations

The IGMP protocol is implemented as a host side and a router side. A host side reports its membership of a group to its local router, and a router side listens to reports from hosts and periodically sends out queries. The FreeBSD, Linux and Windows Operating Systems supports IGMP at the host side. For Linux, IGMPv3 was added in the 2.5 kernel series. For FreeBSD, IGMPv3 was added in version 8.0.

For the server side implementation, the Linux case uses a daemon such as mrouted to act as a IGMP Linux router. There are also entire routing suites (such as XORP), which turn an ordinary computer into a full-fledged multicast router.

[edit] See also

IGMP snooping

[edit] References

^ Network Sorcery - IGMP
^ Spoofed IGMP report denial of service vulnerability.
^ Fragmented IGMP packet may promote "Denial of Service" attack.
^ IGMP Security Problem Statement and Requirements.
^ Microsoft Security Bulletin MS06-007: Vulnerability in TCP/IP Could Allow Denial of Service (913446).

[edit] External links

[0] Network Sorcery - IGMP

[1] Spoofed IGMP report denial of service vulnerability.

[2] Fragmented IGMP packet may promote "Denial of Service" attack.

[3] IGMP Security Problem Statement and Requirements.

[4] Microsoft Security Bulletin MS06-007: Vulnerability in TCP/IP Could Allow Denial of Service (913446).

[1]

[2]

[3]

[4]

[5]

Contents