Subject: [magma] IGMP Snooping proxy

From: "V, Magesh (Magesh)" <[email-masked]>
Date: Sun, 12 Apr 2009 22:01:58 +0530

Hi,
A v2 snooping switch that works in proxy-mode may aggregate and send the v2 igmp membership reports to upstream igmp router with source ip address 0.0.0.0. In such a case,
1. How can the upstream igmp router ensure that the membership report is coming from a host that is indeed in the same subnet that of the igmp interface?
2. Should the igmp router not discard the reports if the source-ip of such packets are not in its local network?
3. If such packets (as in 2) will indeed be dropped then is it not required of the snooping switch (proxy mode) to send at least one report for each LAN w/ valid source-ip address for that network?

Would appreciate if someone can educate me on this.

Thanks a lot,
Magesh.

---

From: Bharat Joshi <[email-masked]>
Date: Mon, 13 Apr 2009 08:56:55 +0530

Hi Magesh,

    Please see my response in line.

Thanks,
Bharat

>A v2 snooping switch that works in proxy-mode may aggregate and send the v2 igmp membership reports to upstream igmp 
>router with source ip address 0.0.0.0. In such a case, 
>

It can not. Router needs to be told that there is a snooping switch which does aggregation as well.

>2. Should the igmp router not discard the reports if the source-ip of such packets are not in its local network?

No. It should not. A router needs to be configured appropriately to not discard such messages. IIRC, Proxy RFC mention this somewhere.

>3. If such packets (as in 2) will indeed be dropped then is it not required of the snooping switch (proxy mode) to 
>send at least one report for each LAN w/ valid source-ip address for that network?

As I mentioned above, router must be configured not to drop these packets. 

For your question, if snooping switch forwards at least one report upstream for each valid source ip, part of aggregation is broken. Another question is how does this switch will know what all are the valid source addresses?

**************** CAUTION - Disclaimer *****************
This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely 
for the use of the addressee(s). If you are not the intended recipient, please 
notify the sender by e-mail and delete the original message. Further, you are not 
to copy, disclose, or distribute this e-mail or its contents to any other person and 
any such actions are unlawful. This e-mail may contain viruses. Infosys has taken 
every reasonable precaution to minimize this risk, but is not liable for any damage 
you may sustain as a result of any virus in this e-mail. You should carry out your 
own virus checks before opening the e-mail or attachment. Infosys reserves the 
right to monitor and review the content of all messages sent to or from this e-mail 
address. Messages sent to or from this e-mail address may be stored on the 
Infosys e-mail system.
***INFOSYS******** End of Disclaimer ********INFOSYS***

---

From: "V, Magesh (Magesh)" <[email-masked]>
Date: Mon, 13 Apr 2009 10:54:11 +0530

Hello Bharat,

Thanks for the answers.

*         Can you please elaborate as to what the igmp router can be configured with; is it to explicitly specify to process reports with src-ip 0.0.0.0?

*         I referred in 2236 (mine is a v2 router) where, I couldn't find a reference for this?

*         Lastly, regarding valid source-ip; I agree that a part of aggregation will be defeated but the switch may send just ONE report per mc group per vlan in addition to the aggregated report. The switch can use the source-ip of the report which it last heard to refresh its group membership expiry timer for than LAN.

*         OR it must be made possible in the proxy-snooping implementation to configure an ip-address per mrouter port which, can be used as the source-ip for the aggregates.

Thanks,

Magesh.

-----Original Message-----
From: Bharat Joshi [mailto:[email-masked]]
Sent: Monday, April 13, 2009 8:57 AM
To: V, Magesh (Magesh)
Cc: [email-masked]
Subject: RE: IGMP Snooping proxy

Hi Magesh,

Thanks,

Bharat

>1. How can the upstream igmp router ensure that the membership report is coming from a host that is indeed in the same

>subnet that of the igmp interface?

Infosys e-mail system.

---

From: Bharat Joshi <[email-masked]>
Date: Mon, 13 Apr 2009 11:08:33 +0530

Hi Magesh,

Thanks,
Bharat

> 
> ·        Can you please elaborate as to what the igmp router can be configured with; is it to explicitly specify to process reports with src-ip 0.0.0.0?
> 
> ·        I referred in 2236 (mine is a v2 router) where, I couldn’t find a reference for this?

Please look at point 2 of section 2.1.1 of RFC 4541. It mention this. Just read through this RFC, consideration of source address as 0.0.0.0 is mentioned at couple of places.

> ·        Lastly, regarding valid source-ip; I agree that a part of aggregation will be defeated but the switch may send just ONE report per mc group per vlan in addition to the aggregated report. The switch can use the source-ip of the report which it last heard to refresh its group membership expiry timer for than LAN.

Yes. Switch can surely do that and with this you do not need to send multiple join/leave requests upstream.

> ·        OR it must be made possible in the proxy-snooping implementation to configure an ip-address per mrouter port which, can be used as the source-ip for the aggregates.

You can do this as well. It is similar to the above one but more granular.

---

From: "V, Magesh (Magesh)" <[email-masked]>
Date: Mon, 13 Apr 2009 12:21:32 +0530

Hi Bharat,
4541 talks about a switch receiving/sending reports with src-ip 0.0.0.0. My question was w.r.t the upstream igmp router that receives this report. Hence, I was referring 2236. However, I got a reference in 3376 (IgmpV3 - section 4.2.13) that mandates to accept reports w/ source-ip 0.0.0.0

However, my igmp router is v2.

Thanks,
Magesh.

-----Original Message-----
From: Bharat Joshi [mailto:[email-masked]] 
Sent: Monday, April 13, 2009 11:09 AM
To: V, Magesh (Magesh)
Cc: [email-masked]
Subject: RE: IGMP Snooping proxy

Hi Magesh,

Thanks,
Bharat

---

From: Bharat Joshi <[email-masked]>
Date: Mon, 13 Apr 2009 12:44:09 +0530

Hi Magesh,

     You are right. I was thinking that I have read this somewhere.

     From RFC 4541, it is clear that a switch can generate a join message with 0.0.0.0 source address. Now if your router is IGMPv2 and follow RFC to the word, it will discard this packet. But if your router can interoperate with switches that supports RFC 4541, it must not discard this packet.

     Alternatively, you can check if switch provides some mean to configure an IP address that can be used as source address for these messages but then the same IP address can not be used in the general queries generated on downstream ports.

Thanks,
Bharat

________________________________________
From: V, Magesh (Magesh) [[email-masked]]
Sent: Monday, April 13, 2009 12:21 PM
To: Bharat Joshi
Cc: [email-masked]
Subject: RE: IGMP Snooping proxy

Hi Bharat,

Thanks,
Magesh.

-----Original Message-----
From: Bharat Joshi [mailto:[email-masked]]
Sent: Monday, April 13, 2009 11:09 AM
To: V, Magesh (Magesh)
Cc: [email-masked]
Subject: RE: IGMP Snooping proxy

Hi Magesh,

Thanks,
Bharat