← Interview Prep

Multicast — Life of a Packet

Tracing a multicast packet hop by hop in three cases: L2 within a subnet (IGMP snooping vs flooding), PIM-SM across subnets (shared tree → Register → SPT switchover → RPT prune), and PIM-SSM (IGMPv3 INCLUDE → (S,G) join, no RP).

Multicast is easier to reason about hop by hop. This traces a multicast packet in the three cases you'll be asked to walk: L2 within a subnet, PIM-SM across subnets (shared → source tree), and PIM-SSM. Theory: Multicast & PIM.

The recurring pieces: IGMP tells the last-hop router who wants group G; PIM builds the tree between routers; the RPF check (arrived on the interface toward the source/RP?) keeps it loop-free; and the L2 dst MAC is always 01:00:5e + the low 23 bits of G.

Control plane — how the tree & forwarding state get signalled (before/with the packet)

Multicast forwarding runs off state the control plane builds first:

Signalling	Builds (the state it populates)
IGMP reports (v2/v3)	Router's group membership per interface; on a switch, the IGMP snooping table group → ports (+ the mrouter port). IGMPv3 INCLUDE(S,G) records the source too.
PIM (*,G) Join	A shared-tree mroute (*,G): IIF = RPF interface toward the RP; OIL grows from the Joins received downstream.
PIM (S,G) Join	A source-tree mroute (S,G): IIF = RPF interface toward the source; OIL from downstream Joins.
Register / Register-Stop	Flips the RP's (S,G) from register/pruned (P) to native forwarding once the SPT to the source is up.
RP discovery (static / Auto-RP / BSR)	The group-to-RP mapping every router uses to point its (*,G) Joins.
Prune / Assert	Prune trims the OIL (incl. the (S,G,RPT) prune after SPT switchover); Assert elects one forwarder on a shared LAN.

The result on each router is the mroute table: for every (*,G) and (S,G), an Incoming Interface (which must pass RPF) and an Outgoing Interface List, with flags (S C J T P F). A packet is forwarded only if it arrives on the IIF, then copied to every interface in the OIL. See the show ip mroute flags.

1 · L2 (within a subnet — IGMP snooping)

Source and receivers on the same VLAN; no routing. The question is: does the switch flood, or forward selectively?

1. Receivers signal interest: each sends an IGMP report for G to its port; the switch's IGMP snooping records "port P wants G."
2. The source sends to G (dst MAC = 01:00:5e:xx:xx:xx).
3. Without snooping: the switch treats it like broadcast and floods G to every port in the VLAN. With snooping: it forwards only to the ports that joined G — plus the mrouter port (toward any multicast router).
4. An IGMP querier (the elected router, or a snooping querier if there's no router) periodically refreshes membership; a Leave + group-specific query prunes a port quickly.

No L3, no PIM — purely the switch deciding which ports get the group.

2 · PIM-SM (across subnets — shared tree, then source tree)

Source S behind the first-hop router (FHR); receiver behind the last-hop router (LHR); a Rendezvous Point (RP). Sparse mode is explicit-join: nothing flows until someone asks.

1. Receiver joins: host IGMP report reaches the LHR → LHR sends a PIM (*,G) Join toward the RP, building the shared tree (RPT) hop by hop (each router RPF-checks toward the RP).
2. Source starts: the FHR receives S's traffic and Registers — it unicasts the encapsulated data to the RP (PIM Register).
3. The RP de-encaps, forwards down the RPT to the receiver, and sends a PIM (S,G) Join toward S to pull the traffic natively; once it arrives, the RP sends Register-Stop so the FHR stops encapsulating.
4. SPT switchover: the LHR now sees traffic and (Cisco default: on the first packet) joins the (S,G) shortest-path tree directly toward S, then prunes the RP tree (an (S,G,RPT) prune toward the RP). The RP falls off the data path.

  before switchover:  S → FHR → (register/native) → RP → RPT → LHR → receiver
  after switchover:   S → ......... shortest path (SPT) ......... → LHR → receiver

Every hop keeps forwarding only if the packet passes RPF; the OIL (outgoing interface list) is built from the Joins received.

3 · PIM-SSM (source-specific)

The receiver already knows the source S (out-of-band), and the group is in 232.0.0.0/8. This is the simplest path — no RP, no Register, no shared tree.

1. The receiver sends an IGMPv3 INCLUDE(S,G) report — it names the source explicitly.
2. The LHR immediately sends a PIM (S,G) Join toward S (the W and R bits clear — straight to the source, not the RP).
3. The SPT is built hop by hop from S to the receiver; traffic flows on the shortest path from the first packet.

No RP to find or fail, no Register encapsulation, and a rogue source can't inject into G because the receiver pinned S — which is why SSM is the norm for one-to-many streaming and market data.