Example 2e: Cisco Catalyst 3750 (12.2(25)SE) snooping IGMP v3 with two receivers

Just like example 2a, except IGMP v3 snooping works on this box. There are a couple of unusual things going on but nothing major:
  1. The switch floods the router's group-specific query to all ports, not just multicast joiners.
  2. The switch spoofs the first group-specific query only to the port that issued the leave and changes the max response time from 1 to 5 seconds and toggles the suppress router-side processing flag, I guess because they diddled the max response time.

The traces

Raw tcpdump traces and console logs are here:

host 10
host 11
host 12
host 13
switch
router

Host 10 joins group. Exclude mode membership report is sent up to switch and passed through unmodified to router, but is supressed out other switch ports (so hosts 11 and 12 don't hear it).
host 10
No.     Time        Source                Destination           Protocol Info
      2 50.911048   128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 2 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf3f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Exclude Mode
host 13
No.     Time        Source                Destination           Protocol Info
      2 50.969013   128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 2 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf3f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Exclude Mode
host 11 & 12 nothing
Data starts to flow. Host 13 sees it come down from router which passes through to host 10 only, as it should.
host 13
No.     Time        Source                Destination           Protocol Info
      3 51.537894   128.59.39.150         224.5.6.7             UDP      Source port: 32959  Destination port: 8910

Frame 3 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 224.5.6.7 (224.5.6.7)
User Datagram Protocol, Src Port: 32959 (32959), Dst Port: 8910 (8910)
Data (1458 bytes)
host 10
No.     Time        Source                Destination           Protocol Info
      3 51.481368   128.59.39.150         224.5.6.7             UDP      Source port: 32959  Destination port: 8910

Frame 3 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 224.5.6.7 (224.5.6.7)
User Datagram Protocol, Src Port: 32959 (32959), Dst Port: 8910 (8910)
Data (1458 bytes)
host 11 nothing
host 12 nothing
switch
Switch>show ip igmp snooping groups vlan 950 224.5.6.7 
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
950       224.5.6.7      igmp        v3          Fa1/0/1, Fa1/0/3
router
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter
224.5.6.7        FastEthernet7/37         00:00:01  00:02:58  128.59.7.10
Data keeps flowing for about 9 seconds and the router sends out a once-a-minute general membership query which is flooded out all switch ports.
host 13
No.     Time        Source                Destination           Protocol Info
     13 60.720838   128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 13 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 10
No.     Time        Source                Destination           Protocol Info
     13 60.664341   128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 13 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 11 & 12
No.     Time        Source                Destination           Protocol Info
      2 60.680468   128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 2 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
Data keeps flowing and a random time within the 10 seconds specified in the query, host 10 responds with a membership report. The router receives this and it is suppressed from being sent to hosts 11 or 12.
host 10
No.     Time        Source                Destination           Protocol Info
     15 62.014300   128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 15 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 13
No.     Time        Source                Destination           Protocol Info
     15 62.071808   128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 15 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 11 & 12 nothing
Stuff keeps running for a few minutes with the IGMP general membership query going out once a minute. Then host 11 joins the group by sending a change to exclude mode membership report. This report is suppressed to other ports by the switch and only passed up to the router.
host 11 
No.     Time        Source                Destination           Protocol Info
      5 234.452572  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 5 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf3f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Exclude Mode
host 13
No.     Time        Source                Destination           Protocol Info
    192 234.494429  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 192 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf3f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Exclude Mode
host 10 Data keeps flowing.
host 12 nothing
The router keeps sending data and the switch adds host 11's port to the list of ports getting the data. About 8 seconds later the router sends a general query which is received by all hosts.
host 13
No.     Time        Source                Destination           Protocol Info
    201 242.460407  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 201 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 10
data keeps flowing...

No.     Time        Source                Destination           Protocol Info
    200 242.402976  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 200 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 11
No.     Time        Source                Destination           Protocol Info
      6 234.497386  128.59.39.150         224.5.6.7             UDP      Source port: 32959  Destination port: 8910

Frame 6 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 224.5.6.7 (224.5.6.7)
User Datagram Protocol, Src Port: 32959 (32959), Dst Port: 8910 (8910)
Data (1458 bytes)

No.     Time        Source                Destination           Protocol Info
     14 242.419669  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 14 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 12
No.     Time        Source                Destination           Protocol Info
      5 242.471799  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 5 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
Hosts 10 and 11 each respond to the membership query and the switch passes both membership reports through to the router, demonstrating the lack of a passive member since the switch suppresses the host membership reports from being repeated to other hosts. It is necessary for the switch to do this since it needs to snoop these membership reports in order to keep track of which ports have members on them. However, it could technically be "smarter" and only pass one membership report up to the router for the given group. If, for example, the switch had 200 ports and all ports had members of the same group, then a membership query would results in 200 membership reports being sent, randomly distributed during the query response interval of 10 seconds, averaging 20 IGMP packets per second for a 10 second burst (which isn't all that much work to do for a modern router).
host 11 & 12
No.     Time        Source                Destination           Protocol Info
     18 244.679960  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 18 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 10
No.     Time        Source                Destination           Protocol Info
    210 250.723606  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 210 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 13
No.     Time        Source                Destination           Protocol Info
    205 244.721688  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 205 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude

No.     Time        Source                Destination           Protocol Info
    212 250.782096  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 212 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 12 nothing
Another minute goes by with the router sending a general query and hosts 10 and 11 both answering it. Then host 10 leaves the group. It sends a change to include mode membership report.
host 10
No.     Time        Source                Destination           Protocol Info
    300 338.159376  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 300 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf4f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Include Mode
host 13
No.     Time        Source                Destination           Protocol Info
    303 338.218427  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 303 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf4f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Include Mode
host 11
data keeps flowing...
In response to host 10's leave, the router sends a group-specific query which the sends to all ports -- even those with no multicast interest. Furthermore, note how the switch has modified the query that is sent to host 10 while the query is passed through unmodified to all other ports. I don't really understand the need to toggle the suppress router-side processing flag, even after reading this thread on the IETF MAGMA mailing list archive:-)
host 13
No.     Time        Source                Destination           Protocol Info
    304 338.218919  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 304 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 10
No.     Time        Source                Destination           Protocol Info
    301 338.159801  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 301 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0f:8f:c7:27:85, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 5.0 sec (0x32)
    Header checksum: 0xfe84 (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=SUPRESS router side processing
    QQIC: 60
    Num Src: 0
host 11
No.     Time        Source                Destination           Protocol Info
    114 338.178201  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 114 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 12
No.     Time        Source                Destination           Protocol Info
      7 338.235477  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 7 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
switch
Switch>show ip igmp snooping groups vlan 950 224.5.6.7 
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
950       224.5.6.7      igmp        v3          Fa1/0/1, Fa1/0/3, Fa1/0/4
Switch>show ip igmp snooping groups vlan 950 224.5.6.7 
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
950       224.5.6.7      igmp        v3          Fa1/0/1, Fa1/0/4
router
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter
224.5.6.7        FastEthernet7/37         00:04:35  00:02:45  128.59.7.10
wat-edge-1##host 10 leaves
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter
224.5.6.7        FastEthernet7/37         00:04:49  00:02:58  128.59.7.11
Host 11 responds to the group-specific query saying it still wants the traffic. Host 10 doesn't since it has left the group. The last data packet to host 10 arrives about 5 seconds later when the switch prunes the port. You will note, above, that the switch took the router's group-specific query which had a 1 second maximum response time and spoofed it with a 5 second maximum response time. So we get 4 extra seconds of traffic!
host 11
No.     Time        Source                Destination           Protocol Info
    116 339.172616  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 116 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 13
No.     Time        Source                Destination           Protocol Info
    306 339.214540  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 306 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf5f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Mode Is Exclude
host 10
No.     Time        Source                Destination           Protocol Info
    307 342.480651  128.59.39.150         224.5.6.7             UDP      Source port: 32959  Destination port: 8910

Frame 307 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 224.5.6.7 (224.5.6.7)
User Datagram Protocol, Src Port: 32959 (32959), Dst Port: 8910 (8910)
Data (1458 bytes)
host 12 nothing
A couple more minutes go by with host 11 still receiving. General queries from the router are flooded out all ports and membership reports are sent in response from host 11. Then, host 11 leaves, generating a change to include mode report which, as usual, is passed up to the router and suppressed out all other switch ports.
host 11
No.     Time        Source                Destination           Protocol Info
    214 432.801397  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 214 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf4f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Include Mode
host 13
No.     Time        Source                Destination           Protocol Info
    404 432.843594  128.59.7.11           224.0.0.22            IGMP     V3 Membership Report

Frame 404 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:50:04:8d:24:62, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xf4f1 (correct)
    Num Group Records: 1
    Group Record : 224.5.6.7  Change To Include Mode
host 10 nothing
host 12 nothing
Host 11's leave triggers the router to send two group-specfic queries about a second apart. These are flooded to all ports but modified to host 11's port to increase the maximum response time from 1 second to 5 and to toggle the suppress router-side processing flag. This modification only happens on the first of the two queries. The last data packet for host 11 shows up about 5 seconds after it first sent the leave. What's kinda wierd is the router sent two 1-second queries this time but only one when host 10 left. Is that because it already knew host 11 had interest so it wasn't doing final cleanup of the group? Finally, what's ultimately wierd is the switch then spoofs an IGMP v2 Leave Group from host 11. The MAC address (and traces from host 11) show this packet originated at the switch.
host 13
No.     Time        Source                Destination           Protocol Info
    405 432.844750  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 405 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
    408 434.636866  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 408 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
    410 437.850176  128.59.7.11           224.0.0.2             IGMP     V2 Leave Group

Frame 410 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0f:8f:c7:27:83, Dst: 01:00:5e:00:00:02
Internet Protocol, Src Addr: 128.59.7.11 (128.59.7.11), Dst Addr: 224.0.0.2 (224.0.0.2)
Internet Group Management Protocol
    IGMP Version: 2
    Type: Leave Group (0x17)
    Max Response Time: 0.0 sec (0x00)
    Header checksum: 0x02f3 (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
host 11
No.     Time        Source                Destination           Protocol Info
    215 432.801808  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 215 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0f:8f:c7:27:86, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 5.0 sec (0x32)
    Header checksum: 0xfe84 (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=SUPRESS router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
    219 434.595974  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 219 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
    220 435.497944  128.59.39.150         224.5.6.7             UDP      Source port: 32959  Destination port: 8910

Frame 220 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 224.5.6.7 (224.5.6.7)
User Datagram Protocol, Src Port: 32959 (32959), Dst Port: 8910 (8910)
Data (1458 bytes)
host 10
No.     Time        Source                Destination           Protocol Info
    310 432.786555  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 310 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
    311 434.578635  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 311 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
host 12
No.     Time        Source                Destination           Protocol Info
     10 432.866188  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 10 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
     11 434.658376  128.59.7.1            224.5.6.7             IGMP     V3 Membership Query

Frame 11 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.5.6.7 (224.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x06ad (correct)
    Multicast Address: 224.5.6.7 (224.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
switch
Switch>show ip igmp snooping groups vlan 950 224.5.6.7 
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
950       224.5.6.7      igmp                    Fa1/0/1, Fa1/0/4
Switch>show ip igmp snooping groups vlan 950 224.5.6.7 
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
router
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter
224.5.6.7        FastEthernet7/37         00:06:24  now       128.59.7.11
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter