← Interview Prep

Multicast & PIM — Theory

IP multicast end to end: group addressing & L2 mapping, IGMP/MLD membership, RPF, PIM-SM (RP, register, SPT switchover), RP discovery, Anycast-RP/MSDP, SSM and PIM-Bidir.

One sender, many receivers, one copy per link. Multicast pushes replication into the network instead of the source, which is why it underpins IPTV, market-data feeds, and any one-to-many streaming. This is the theory to explain end to end: addressing, who joins (IGMP), how the tree is built (PIM), and the RPF check that keeps it loop-free.

The mental model: IGMP is how hosts tell the last-hop router "I want group G." PIM is how routers build the distribution tree between them. RPF is the rule that keeps that tree loop-free.

Addressing

Range	Use
`224.0.0.0/4` (224–239)	All of IPv4 multicast (class D).
`224.0.0.0/24`	Link-local control, never routed, TTL 1: `224.0.0.1` all hosts, `.2` all routers, `.5/.6` OSPF, `.13` PIM, `.22` IGMPv3.
`232.0.0.0/8`	SSM (Source-Specific Multicast) — no RP, receiver names the source.
`233.0.0.0/8`	GLOP / inter-domain.
`239.0.0.0/8`	Administratively scoped (private, like RFC 1918).

L2 mapping: an IP group maps to MAC 01:00:5E + the low 23 bits of the group address. Because 28 bits of group map into 23 bits of MAC, 32 IP groups collapse onto one MAC — a classic overlap gotcha (e.g. 224.1.1.1 and 239.129.1.1 share a MAC).

Group membership: IGMP

IGMP runs between a host and its last-hop router (IPv6 uses MLD, which is ICMPv6).

v1: report/query only, no explicit leave.
v2: adds Leave + group-specific query (faster prune), and querier election (lowest IP).
v3: adds source filtering (INCLUDE/EXCLUDE) — required for SSM.

IGMP snooping lets an L2 switch listen to IGMP and forward a group only to ports that joined, instead of flooding it to the whole VLAN. Without it, multicast floods like broadcast.

IGMPv2 message format

IGMP rides directly in IP (protocol 2), TTL 1, with the Router-Alert option. The v2 message is a fixed 8 bytes:

bytes:     1              1                2                    4
       +--------+---------------------+----------+---------------------+
       |  Type  |  Max Resp Time      | Checksum |    Group Address    |
       +--------+---------------------+----------+---------------------+
  Type: 0x11 Membership Query  0x16 v2 Report  0x17 Leave Group  0x12 v1 Report
  Max Resp Time: 1/10 s units, Queries only.  Group: 0.0.0.0 = general query

General query (Group = 0.0.0.0) asks "who's a member of anything?"; a group-specific query (Group = G) probes one group after a Leave to prune fast.
Querier election: lowest-IP router on the subnet sends the periodic queries.

IGMPv3 message format

v3 adds source filtering — the reason SSM works. Reports go to 224.0.0.22 and can carry many group records at once:

v3 Query (Type 0x11): + Resv|S|QRV, QQIC, Num Sources (N), Source[1..N]
                        → lets a router ask a group-and-source-specific query

v3 Report (Type 0x22): Num Group Records (M), then M × Group Record:
  +-------------+----------+-----------+-----------------+-----------+
  | Record Type | Aux Len  | Num Src N | Multicast Addr  | Source[N] |
  +-------------+----------+-----------+-----------------+-----------+
  Record Type: 1 IS_INCLUDE  2 IS_EXCLUDE  3 TO_INCLUDE  4 TO_EXCLUDE
               5 ALLOW_NEW_SOURCES  6 BLOCK_OLD_SOURCES

A host says INCLUDE {S1,S2} ("send me G only from these sources") or EXCLUDE {…} ("everything except these"). INCLUDE-mode with a source list is exactly what SSM needs — the receiver names the source, so no RP is required.

Distribution trees & the RPF check

Source tree / SPT (S,G): shortest path from each source, rooted at the source. Optimal latency, more state.
Shared tree (*,G): rooted at a Rendezvous Point (RP); all sources reach receivers via the RP. Less state, suboptimal paths.

Reverse Path Forwarding (RPF) is the anti-loop rule: a multicast packet is accepted only if it arrived on the interface the unicast routing table would use to reach the source (or RP). Fail the RPF check → drop. Every "why isn't multicast flowing" ticket starts here (show ip rpf <src>).

PIM-SM operation

PIM is protocol-independent — it reuses the unicast RIB for RPF and builds trees on demand. Sparse mode (RFC 7761) is explicit-join: nothing flows until someone asks.

Receiver joins: last-hop router gets an IGMP report, sends a PIM (*,G) Join toward the RP, building the shared tree.
Source starts: its first-hop router registers with the RP (PIM Register, unicast, encapsulating the data). The RP joins the source tree back toward the source, then sends Register-Stop so traffic flows natively.
SPT switchover: once the last-hop router sees traffic on the shared tree, it joins the (S,G) shortest-path tree directly to the source and prunes off the RP tree (Cisco default threshold: on first packet). Optimal path, RP off the data path.
DR election (highest priority, then highest IP) picks who registers/forwards on a segment; Assert resolves duplicate forwarders on a LAN (one winner).

Reading `show ip mroute` flags

(*,G) = shared tree, (S,G) = source tree. S sparse, C connected receiver, J joined SPT, T SPT-bit set (forwarding on source tree), P pruned, F register flag, R RP-bit. Incoming interface = the RPF interface; the OIL (outgoing interface list) is where copies go.

PIM message header & types

PIM messages ride directly in IP, protocol 103, to ALL-PIM-ROUTERS 224.0.0.13 with TTL 1 (link-local) — except Register / Register-Stop, which are unicast between the first-hop router and the RP. Every message starts with the same 4-byte header:

 0 1 2 3 4 5 6 7 8 9 ...                              31
+-------+-------+---------------+-------------------------------+
|Ver=2  | Type  |   Reserved    |           Checksum            |
+-------+-------+---------------+-------------------------------+

Type	Message	Purpose
0	Hello	Neighbor discovery. Options: Holdtime, DR Priority, Generation ID, LAN Prune Delay.
1	Register	First-hop router unicasts encapsulated multicast data to the RP (has Border & Null-Register bits).
2	Register-Stop	RP tells the FHR to stop encapsulating (native path is up).
3	Join/Prune	Build/tear the tree toward the upstream neighbor — the core message.
4	Bootstrap	BSR distributes the RP-set.
5	Assert	Resolve duplicate forwarders on a LAN (best metric/preference wins).
8	Candidate-RP-Adv	A C-RP advertises itself to the BSR.

How (*,G) vs (S,G) is signalled — the S/W/R bits

Join/Prune carries Encoded-Source addresses whose low three flag bits say which tree:

S (Sparse) — set for PIM-SM.
W (Wildcard) — set = a (*,G) join (toward the RP, shared tree); clear = a specific source.
R (RPT) — set = this entry belongs to the RP tree; clear = the shortest-path tree.

So a (*,G) join to the RP sets W+R; an (S,G) join toward the source (after SPT switchover) clears both. Same message type, different flags — that's the whole shared-vs-source-tree signalling.

Finding the RP

Method	How
Static	Configure the RP address everywhere. Simple, no failover on its own.
Auto-RP (Cisco)	Candidate-RPs announce to `224.0.1.39`; a mapping agent picks and floods on `224.0.1.40`.
BSR (standard)	Bootstrap Router distributes the RP-set to all PIM routers.

RP redundancy: Anycast-RP + MSDP

Give several RPs the same anycast address (on a loopback, advertised in the IGP). Each router uses the nearest RP by IGP metric — instant failover if one dies. To make sources known across all the RP islands, the RPs run MSDP and exchange Source-Active (SA) messages, so every RP learns active sources and can join their SPTs. (MSDP is the same mechanism used for inter-AS multicast.)

Variants: SSM & PIM-Bidir

SSM (232/8 + IGMPv3): the receiver specifies (S,G) directly, so there's no RP and no shared tree — simplest and most secure (no rogue sources). Ideal for one-to-many streaming/market data. SSM has no unique wire format: it reuses IGMPv3 INCLUDE-mode reports (host names the source) and ordinary PIM-SM (S,G) Join/Prune with the W and R bits clear (straight to the source, no RP, no Register). PIM-SSM is just PIM-SM restricted to source trees on 232/8.
PIM-Bidir: shared tree only, no (S,G) state and no SPT switchover — scales to many-to-many (e.g. huge fan-in). Uses a Designated Forwarder (DF) per link instead of RPF/Assert.

Likely interview questions

Difference between IGMP and PIM? (host↔router membership vs router↔router tree building)
What is the RPF check and why is it needed? (loop prevention via the unicast route to the source)
Walk the PIM-SM join: receiver join to RP, source register, SPT switchover. Where does the RP leave the data path?
Shared tree vs source tree — state vs path-optimality tradeoff.
How do you make the RP redundant? (Anycast-RP + MSDP)
When would you use SSM, and what does it remove? (no RP; IGMPv3 source filter)
Why can 224.1.1.1 and 239.129.1.1 collide at L2? (23-bit MAC mapping)
What does IGMP snooping solve? (stops L2 flooding of groups)