The Packet Wizard : Multicast

This week I have been troubleshooting a Multicast problem, before Tuesday I knew the basics of it but I did not realize how deep that rabbit hole went, I can only imagine how deep it goes in CCIE level since it has not really crossed my path in any of my studies thus far. I thought I should write this blog post to share what I have learned this week about Multicast. I will also write another post on how to configure and troubleshoot it.

What is Multicast?

Multicast is a group communication where data packets are sent to a group of receiver/destination computers at the same time. Multicast is one to many or many to many real time communication protocol, where Unicast is one to one and Broadcast is one to all. Multicast is mainly used in IPTV (Netflix, Hulu, Prime Video).

Multicast Address Ranges

They use Class D Range – – – Reserved for Local Addresses – – Globally Scoped Addresses – – Source Specific Multicast Addresses – – GLOP Addresses – – Limited Scope Address (Similar to Private IP addresses but for Multicast)


How does Multicast Work?

The Receiver sends a packet to the Router asking to Join the Multicast Group. Only the clients that want to receive Multicast join what is called a Multicast Group. If the router doesn’t know about it it will send requests out its next hop interface.

Protocol Independent Multicast (PIM) Think of this like a multicast routing protocol sits on top of the Internet Group Management Protocol (IGMP) and builds a pipe back to the source from the destination. There are 3 versions of IGMP:

IGMPv1 – has a 60 second timer and continually asks.
IGMPv2 – can send an I want to leave the multicast group message to the router.
IGMPv3 – can include a source in the join packets.

If the multicast sender has multiple paths to the receiver it will send the multicast multi ways meaning the receiver will receive duplicate messages. The receiver then has to send the reply but it uses the unicast routing table to return the traffic and uses that interface.

Reverse Path Forwarding (RPF) is a check that the receiving device does before the sender sends anything so it knows how to get back to get back to the sender without receiving multiple multicast messages.

Multicast Types

I am sure there are more than two types of multicast but all I have covered are Sparse and Dense mode.

Sparse Mode is like a Join Protocol, where traffic is not forwarded on a segment unless it is explicitly requested. Sparse mode is typically deployed where the receivers are sparsely populated over the network, so that most of the network bandwidth is conserved.

Dense Mode is like a flood and prune system, where everyone receives the traffic until they inform (through the prune system) that they do not want that particular multicast messages. Dense Mode is typically deployed in topologies where listeners are densely populated, but it can be a very chatty protocol.

You can setup sparse mode or dense mode on a per interface basis. Once they are setup and enabled interfaces can run sparse mode while others run dense mode.

A Networking genius (Denise Fishburne – ) said on a training video I watched yesterday “Friends don’t let friends do dense mode”. Denise also recently started following my blog, which is a huge honor. I hope this post is doing some basic justice to Multicast. I am trying to share information I have gathered in the last couple of days. If anyone has any comments or further insight let me know.


Cisco Switch : Storm Control

Storm Control can shut down an interface that is causing a Unicast, Multicast or Broadcast Storm. It works with Rising and Falling Thresholds. If a specific type of traffic hits the rising Threshold it will block that type of traffic until the number of packets it see’s is below the set falling threshold. This can be in Percentage, Bits Per Second or Packets Per Second

Here is how to enable its various options:

tpw-sw1(conf)# int gi0/1
tpw-sw1(config-int)# storm-control broadcast level 10 5 - this command means if I see more than 10% broadcast traffic I will block until I see it fall under 5%
tpw-sw1(conf)# int gi0/1
tpw-sw1(config-int)# storm-control multicast level bps 20m 10m - this command means if I see more than 20Mbps multicast traffic I will block until I see it fall under 10Mbps
tpw-sw1(conf)# int gi0/1
tpw-sw1(config-int)# storm-control unicast level pps 50k  - this command means if I see more than 50,000 unicast packets per second, I will drop traffic until I see it fall below 50,000 packers per second, that is what happens if you do not put a falling threshold. Both rising and falling threshold is 50,000
tpw-sw1(conf)# int gi0/1
tpw-sw1(config-int)# storm-control action shutdown

Check and Verify

tpw-sw1(conf)# show storm-control broadcast

tpw-sw1(conf)# show storm-control multicast

tpw-sw1(conf)# show storm-control unicast