Example 5b: Cisco Catalyst 3750 (12.2(25)SE) one SSM receiver, one SSM source

Just like example 5a but with a switch that implements IGMP v3 snooping correctly:-) The most interesting thing to note from the traces is that IGMP v3 membership reports are much more complicated to parse than v2 reports.

The traces

Raw tcpdump traces are here:

host 10
host 11
host 12
host 13
router
switch

Host 10 joins (S,G). This join is not heard by hosts 11 or 12.
host 10
No.     Time        Source                Destination           Protocol Info
     18 917.206121  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 18 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xaa3e (correct)
    Num Group Records: 2
    Group Record : 232.5.6.7  Allow New Sources
        Record Type: Allow New Sources (5)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
    Group Record : 232.5.6.7  Change To Include Mode
        Record Type: Change To Include Mode (3)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 13
No.     Time        Source                Destination           Protocol Info
     18 917.639051  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 18 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xaa3e (correct)
    Num Group Records: 2
    Group Record : 232.5.6.7  Allow New Sources
        Record Type: Allow New Sources (5)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
    Group Record : 232.5.6.7  Change To Include Mode
        Record Type: Change To Include Mode (3)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 11 nothing
host 12 nothing
Data starts to flow. Host 13 sees it come down from router which passes through to host 10 only, as it should. For some reason, host 10 chooses to send an (S,G) join again. This gets passed up to the router.
host 13
No.     Time        Source                Destination           Protocol Info
     19 918.021134  128.59.39.150         232.5.6.7             UDP      Source port: 33118  Destination port: 8910

Frame 19 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 232.5.6.7 (232.5.6.7)
User Datagram Protocol, Src Port: 33118 (33118), Dst Port: 8910 (8910)
Data (1458 bytes)

No.     Time        Source                Destination           Protocol Info
     24 922.657159  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 24 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xaa3e (correct)
    Num Group Records: 2
    Group Record : 232.5.6.7  Allow New Sources
        Record Type: Allow New Sources (5)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
    Group Record : 232.5.6.7  Change To Include Mode
        Record Type: Change To Include Mode (3)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 10
No.     Time        Source                Destination           Protocol Info
     19 917.589742  128.59.39.150         232.5.6.7             UDP      Source port: 33118  Destination port: 8910

Frame 19 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 232.5.6.7 (232.5.6.7)
User Datagram Protocol, Src Port: 33118 (33118), Dst Port: 8910 (8910)
Data (1458 bytes)

No.     Time        Source                Destination           Protocol Info
     24 922.225299  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 24 (70 bytes on wire, 70 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0xaa3e (correct)
    Num Group Records: 2
    Group Record : 232.5.6.7  Allow New Sources
        Record Type: Allow New Sources (5)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
    Group Record : 232.5.6.7  Change To Include Mode
        Record Type: Change To Include Mode (3)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 11 nothing
host 12 nothing
switch
Switch>show ip igmp snooping groups vlan 950 232.5.6.7
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
950       232.5.6.7      igmp        v3          Fa1/0/1, Fa1/0/3
router
wat-edge-1#sho ip mroute fa7/37                             
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, s - SSM Group, C - Connected, L - Local,
       P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set,
       J - Join SPT, M - MSDP created entry, X - Proxy Join Timer Running
       A - Candidate for MSDP Advertisement, U - URD, 
       I - Received Source Specific Host Report 
Outgoing interface flags: H - Hardware switched, A - Assert winner
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode

(128.59.39.150, 232.5.6.7), 00:16:08/00:02:57, flags: sTI
  Incoming interface: Vlan39, RPF nbr 0.0.0.0, RPF-MFD
  Outgoing interface list:
    FastEthernet7/37, Forward/Sparse, 00:01:15/00:02:16, H
Data keeps flowing and the router sends out a routine general membership query every 60 seconds which is flooded out all switch ports. Host 10 replies to this query.
host 13
No.     Time        Source                Destination           Protocol Info
     38 935.403596  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 38 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
     49 945.365430  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 49 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0x471f (correct)
    Num Group Records: 1
    Group Record : 232.5.6.7  Mode Is Include
        Record Type: Mode Is Include (1)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 10

No.     Time        Source                Destination           Protocol Info
     38 934.974008  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 38 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
     49 944.935837  128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 49 (58 bytes on wire, 58 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0x471f (correct)
    Num Group Records: 1
    Group Record : 232.5.6.7  Mode Is Include
        Record Type: Mode Is Include (1)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 11 & 12
No.     Time        Source                Destination           Protocol Info
     18 934.965989  128.59.7.1            224.0.0.1             IGMP     V3 Membership Query

Frame 18 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:00:00:01
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 224.0.0.1 (224.0.0.1)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 10.0 sec (0x64)
    Header checksum: 0xec5f (correct)
    Multicast Address: 0.0.0.0 (0.0.0.0)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 0
Host 10 leaves group, sends a leave, which is passed along to the router. After a few seconds the traffic is pruned. The host sends another leave too.
host 10
No.     Time        Source                Destination           Protocol Info
    125 1017.789836 128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 125 (58 bytes on wire, 58 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0x421f (correct)
    Num Group Records: 1
    Group Record : 232.5.6.7  Block Old Sources
        Record Type: Block Old Sources (6)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)

No.     Time        Source                Destination           Protocol Info
    130 1019.589710 128.59.39.150         232.5.6.7             UDP      Source port: 33118  Destination port: 8910

Frame 130 (1512 bytes on wire, 1500 bytes captured)
Ethernet II, Src: 00:08:7c:d0:08:40, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.39.150 (128.59.39.150), Dst Addr: 232.5.6.7 (232.5.6.7)
User Datagram Protocol, Src Port: 33118 (33118), Dst Port: 8910 (8910)
Data (1458 bytes)

No.     Time        Source                Destination           Protocol Info
    131 1025.827546 128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 131 (58 bytes on wire, 58 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0x421f (correct)
    Num Group Records: 1
    Group Record : 232.5.6.7  Block Old Sources
        Record Type: Block Old Sources (6)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 11 nothing
host 12 nothing
host 13
No.     Time        Source                Destination           Protocol Info
    125 1018.212278 128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 125 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0x421f (correct)
    Num Group Records: 1
    Group Record : 232.5.6.7  Block Old Sources
        Record Type: Block Old Sources (6)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
In response to the host leave, the router sends two closely-spaced group-specifc queries which the switch forwards to all ports. Unlike the HP, no data packets leak out along with the group-specific query. The switch spoofs the router's query and changes the max response time to 5 seconds and sets the suppress router-side processing flag. All other ports on the switch get the group-specific queries as sent by the router. After the second group-specific query gets no response within the specified one-second interval, traffic to the group is pruned. The switch spoofs a v2 leave as well! And the host sends a second leave, perhaps because it kept receiving traffic....
host 13
No.     Time        Source                Destination           Protocol Info
    126 1018.325793 128.59.7.1            232.5.6.7             IGMP     V3 Membership Query

Frame 126 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 232.5.6.7 (232.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x56da (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 1
    Source Address: 128.59.39.150 (128.59.39.150)

No.     Time        Source                Destination           Protocol Info
    128 1019.907153 128.59.7.1            232.5.6.7             IGMP     V3 Membership Query

Frame 128 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 232.5.6.7 (232.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x56da (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 1
    Source Address: 128.59.39.150 (128.59.39.150)

No.     Time        Source                Destination           Protocol Info
    130 1023.218904 128.59.7.10           224.0.0.2             IGMP     V2 Leave Group

Frame 130 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0f:8f:c7:27:83, Dst: 01:00:5e:00:00:02
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.2 (224.0.0.2)
Internet Group Management Protocol
    IGMP Version: 2
    Type: Leave Group (0x17)
    Max Response Time: 0.0 sec (0x00)
    Header checksum: 0xfaf2 (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)

No.     Time        Source                Destination           Protocol Info
    131 1026.249063 128.59.7.10           224.0.0.22            IGMP     V3 Membership Report

Frame 131 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:00:86:51:bd:b2, Dst: 01:00:5e:00:00:16
Internet Protocol, Src Addr: 128.59.7.10 (128.59.7.10), Dst Addr: 224.0.0.22 (224.0.0.22)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Report (0x22)
    Header checksum: 0x421f (correct)
    Num Group Records: 1
    Group Record : 232.5.6.7  Block Old Sources
        Record Type: Block Old Sources (6)
        Aux Data Len: 0
        Num Src: 1
        Multicast Address: 232.5.6.7 (232.5.6.7)
        Source Address: 128.59.39.150 (128.59.39.150)
host 10
No.     Time        Source                Destination           Protocol Info
    126 1017.790223 128.59.7.1            232.5.6.7             IGMP     V3 Membership Query

Frame 126 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0f:8f:c7:27:85, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 232.5.6.7 (232.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 5.0 sec (0x32)
    Header checksum: 0xf684 (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)
    QRV=2 S=SUPRESS router side processing
    QQIC: 60
    Num Src: 0

No.     Time        Source                Destination           Protocol Info
    127 1017.904663 128.59.7.1            232.5.6.7             IGMP     V3 Membership Query

Frame 127 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 232.5.6.7 (232.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x56da (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 1
    Source Address: 128.59.39.150 (128.59.39.150)
host 11 & 12
No.     Time        Source                Destination           Protocol Info
     20 1017.896949 128.59.7.1            232.5.6.7             IGMP     V3 Membership Query

Frame 20 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 232.5.6.7 (232.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x56da (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 1
    Source Address: 128.59.39.150 (128.59.39.150)

No.     Time        Source                Destination           Protocol Info
     21 1019.478464 128.59.7.1            232.5.6.7             IGMP     V3 Membership Query

Frame 21 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:d0:03:66:80:0a, Dst: 01:00:5e:05:06:07
Internet Protocol, Src Addr: 128.59.7.1 (128.59.7.1), Dst Addr: 232.5.6.7 (232.5.6.7)
Internet Group Management Protocol
    IGMP Version: 3
    Type: Membership Query (0x11)
    Max Response Time: 1.0 sec (0x0a)
    Header checksum: 0x56da (correct)
    Multicast Address: 232.5.6.7 (232.5.6.7)
    QRV=2 S=Do not supress router side processing
    QQIC: 60
    Num Src: 1
    Source Address: 128.59.39.150 (128.59.39.150)
switch
Switch>show ip igmp snooping groups vlan 950 232.5.6.7
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
950       232.5.6.7      igmp        v3          Fa1/0/1, Fa1/0/3
Switch>show ip igmp snooping groups vlan 950 232.5.6.7
Vlan      Group          Type        Version     Port List
-------------------------------------------------------------
router
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter
232.5.6.7        FastEthernet7/37         00:01:42  stopped   128.59.7.10
wat-edge-1#sho ip igmp groups fa7/37
IGMP Connected Group Membership
Group Address    Interface                Uptime    Expires   Last Reporter