Internet Group Management Protocol (IGMP) / Multicast Listener Discovery (MLD)-Based Multicast Forwarding ("IGMP/MLD Proxying")
Extracted elements (25)
By not supporting multicast routing protocols such as PIM or DVMRP, IGMP/MLD proxying reduces device cost and operational overhead, and makes proxy devices independent of the routing protocol used by the core network.
For senders inside the proxy tree, all traffic is forwarded towards the root, and upstream PIM-SM routers must be configured to Register-encapsulate new sources as if they were directly connected, since IGMP/MLD proxying provides no mechanism to advertise internal prefixes upstream.
Forwarder election is 'piggybacked' on IGMP/MLD Querier election (lowest IP address wins), delivering similar functionality to the PIM Assert mechanism on a local link without requiring a separate election protocol.
IGMP/MLD-based forwarding is restricted to a simple manually-configured tree topology because no spanning tree protocol is specified. More complex topologies, desired failover, or multi-domain scenarios require a full multicast routing protocol.
Interfaces configured to run IGMPv1 or IGMPv2 do not maintain SSM semantics; the proxy device should ignore IGMPv1/v2 subscriptions sent to SSM addresses on such interfaces.
The proxy device must support both the IGMP Host Requirement and the IGMP Router Requirement for SSM (IGMPv3/MLDv2), as it acts as a host on the upstream interface and as a router on each downstream interface.
When reporting via IGMPv1 or IGMPv2/MLDv1 on the upstream interface, only the multicast address field in the membership record is used; source-specific changes (filter-mode, source-list) are ignored.
A proxy device MAY use a forwarding cache to avoid per-packet decisions, but MUST update the cache whenever any of the information used to build it changes.
Packets with source-specific (SSM) addresses SHOULD NOT be forwarded to interfaces with IGMPv2 or IGMPv1 subscriptions for those addresses, as IGMPv1/v2 cannot maintain SSM semantics.
Since IGMP/MLD-based forwarding provides no upstream loop detection, it MUST be administratively assured that upstream loops do not exist when deploying IGMP/MLD Proxying.
The default configuration MUST include the querier rule, requiring the proxy to be the IGMP/MLD Querier before forwarding packets to a downstream interface. This prevents local loops and redundant traffic.
The IP addressing scheme applied to the proxying tree topology SHOULD be configured to ensure that a proxy device can win the IGMP/MLD Querier election, requiring proxy devices to hold the lowest IP addresses on each link.
The proxy device MUST NOT perform the router portion of IGMP/MLD on its upstream interface. It performs the router portion only on downstream interfaces and the host portion on the upstream interface.
To mitigate the black-hole attack via querier election, an operator SHOULD assign the subnet's lowest IP address(es) to the proxy device(s) so they win the querier election.
A subscription is either a group membership (IGMPv1/v2 or MLDv1 mode) or an IGMPv3/MLDv2 state entry tuple of (multicast address, group timer, filter-mode, source-element list) on a specific interface.
Downstream interfaces are each of the proxy device's interfaces not in the direction of the tree root (also called 'Router interfaces'). They run the router portion of IGMP/MLD.
If an IGMPv1 or IGMPv2/MLDv1 querier exists on the upstream network, the proxy performs the corresponding older version on its upstream interface; otherwise it performs IGMPv3/MLDv2.
Packet forwarding: packets received on the upstream interface are forwarded to qualifying downstream interfaces; packets from any downstream interface are forwarded upstream and to other qualifying downstream interfaces, excluding the incoming interface.
The membership database is maintained per proxy device and merges subscriptions from all downstream interfaces into records of the form (multicast-address, filter-mode, source-list), following IGMPv3/MLDv2 merging rules.
The upstream interface is the proxy device's interface in the direction of the root of the tree (also called the 'Host interface'). It runs the host portion of IGMP/MLD.
When building the membership database, IGMPv1/v2 and MLDv1 subscriptions are converted to IGMPv3/MLDv2 equivalents, timers are removed, and EXCLUDE-mode sources with source timer > 0 are removed before merging using IGMPv3/MLDv2 multi-membership rules.
Access control applied at the upstream router on group membership operates on the aggregated proxy subscription, not on individual downstream subscribers; it is not possible to apply per-subscriber access control at the upstream router.
An attacker on a downstream LAN can manipulate the IGMP/MLD Querier election by advertising a lower IP address, causing itself to be elected Querier; since only the Querier forwards packets, this results in a black hole with no multicast traffic forwarded.
IGMP/MLD-based forwarding provides no upstream loop detection; misconfigured upstream/downstream interface assignments can cause forwarding loops that require administrative intervention to prevent.
Group mode is determined per multicast group: IGMPv1 mode if an IGMPv1 report is heard; IGMPv2 mode if an IGMPv2 report is heard but no IGMPv1; IGMPv3 mode if an IGMPv3 report is heard but no IGMPv1 or IGMPv2. The equivalent applies for MLD (MLDv1/MLDv2).