Possible to emulate an IGMP querier in software?

Question

I have a L3 switch that does IGMP snooping, but it cannot act as an IGMP querier, and there is no IGMP querier connected to this network.

Would it be possible to implement an IGMP querier in software, so that my L3 switch can snoop on it and route accordingly?

Solution

I implemented a proof of concept and found it actually is possible to implement an IGMP querier in software.

My software querier gets treated like the real thing, i.e. clients send their reports when prompted by it, as I could verify with Wireshark, comparing a network with a real IGMP querier, to a network without one but having that software querier running.

The software querier periodically sends "IGMP general queries", and, using WinPCap to capture all IGMP traffic, it is able to send "IGMP specific query" messages in response to "IGMP leave" messages.

N.B. If you want to subscribe to IGMP groups on the same host (and NIC) where you run the software IGMP querier, it seems necessary to use (= spoof) an IP address/MAC address combo different from that of the interface you are using, otherwise my Windows (8.1) e.g. did not properly detect the IGMP version.

Comments

[Evgeniy Berezovsky]

"IGMP querier" and "IGMP snooping" are common IGMP terms, and I'm not sure if you are aware of them. If there's no IGMP querier in a network, hosts interested in a multicast group will send a single unsolicited IGMP membership report. But to keep the membership fresh, e.g. for an "IGMP snooping" switch, the IGMP report needs to be refreshed periodically. But Clients only resend reports when prompted by IGMP queries, which are sent by the IGMP querier.

[Philip]

I'm aware of the terms. But I fail to see how you're going to get multicast working on a network where the router does not support IGMP.

[Evgeniy Berezovsky]

As stated in the question, the L3 switch does support IGMP snooping. This is multicast where the source is in the same network as the clients, hence the routers don't need to get involved to route the traffic. What's missing is an IGMP querier.

[Evgeniy Berezovsky]

See e.g. NETGEAR's FAQ on IGMP snooping queriers for IGMP without a capable router: the IGMP snooping operation usually requires an extra network device—usually a router—that can generate an IGMP membership query and solicit interested nodes to respond. With the built-in IGMP querier feature inside the switch, such an external device is no longer needed.

[Evgeniy Berezovsky]

Or see CISCO: You can configure the IGMP snooping querier on the switch to support IGMP snooping in subnets that do not have any multicast router interfaces

[Philip]

Ok, but your question is about your L3 Switch Routing multicast traffic. None of this has anything to do with that. Without IGMP the switch should just fall back to broadcasting the multicast traffic and letting the clients sort out where it's supposed to go. This is obviously less than ideal, but should work fine unless you've got bandwidth problems. If you don't have bandwidth problems then I don't see how this is even a "real" problem in the first place. What am I missing here?

[Evgeniy Berezovsky]

This isn't leading anywhere. My question is specific, and you just don't address it. In the meantime, however, my proof of concept gave the answer: Yes, it is possible to use a software IGMP querier in the absence of a hardware one, and the IGMP snooper won't know the difference. That fact btw is not affected by you downvoting it.

[Evgeniy Berezovsky]

Having said that, it might be best to migrate this question over to stackoverflow, where users actually do write software, although this question is neither here nor there. In any event, it would need 3k rep (on serverfault) to move the question.

[Philip]

Eugene, You seem to really struggle to type sentences that say what you mean, go back and read what you've left, it's full of sentences that don't make sense. Your Answer doesn't actually answer your Question as it's written. Server Fault is for Professional Administrators (et al) only, not programmers (if you wanted to know how to program a IGMP Querier then you should have said so and this would have been migrated immediately). Similarly if you just wanted to know if Snooping could be fooled by any random Querier then you should have said that. You seriously need to work on your communication skills

[Dan Pritts]

I see that the question was rewritten at some point - as it stands now, its' a reasonable question.

[P Marecki]

Aren't generic linux machines capable of acting as queriers? There seems to be a lot of discussion on enabling them for linux bridges, and the behavior seems to be enableable by echo -n 1 > /sys/devices/virtual/net/br0/bridge/multicast_querier; see eg.: unix.stackexchange.com/questions/132604/…

[Evgeniy Berezovsky]

@PMarecki That's in fact an answer to my question (so go ahead and make it a proper answer). In the past, the (software) IGMP querier was enabled by default, when IGMP snooping is enabled, but that changed when the flag you mention was added.