Linux Multicast Routing and IGMP Explained

This article explores how the Linux operating system handles multicast network traffic and implements the Internet Group Management Protocol (IGMP). It covers the division of responsibilities between the Linux kernel space and user-space routing daemons, the role of IGMP in managing local group memberships, the Reverse Path Forwarding (RPF) check, and the Multicast Forwarding Cache (MFC) mechanism that routes packets across network interfaces.

The Role of IGMP in Linux

The Internet Group Management Protocol (IGMP) operates between hosts and immediate local routers on IPv4 networks. In Linux, IGMP handling depends on whether the system functions as a multicast host (endpoint receiver) or a multicast router:

1. Host Role: When a Linux application wants to receive multicast traffic, it issues a socket call using the IP_ADD_MEMBERSHIP socket option. The Linux kernel's networking stack processes this request and automatically generates an IGMP Report message onto the corresponding local network link. When the socket closes or issues IP_DROP_MEMBERSHIP, the kernel issues an IGMP Leave message (in IGMPv2) or an updated report (in IGMPv3).
2. Router Role: When acting as a router, Linux tracks which multicast groups have active listeners on each connected interface by processing incoming IGMP Reports and periodically sending IGMP General Queries.

Kernel Configuration for Multicast Routing

Standard IP routing in Linux forwards unicast packets based solely on the destination address. Multicast routing requires distinct logic because packets are addressed to an arbitrary group and must be replicated across multiple egress interfaces without causing loops.

To support multicast routing, the Linux kernel must be compiled with the following options:

• CONFIG_IP_MROUTE: Enables the multicast routing framework.
• CONFIG_IP_MROUTE_MULTIPLE_TABLES: (Optional) Allows policy routing for multicast traffic.

Additionally, multicast forwarding must be enabled administratively via sysctl:

sysctl -w net.ipv4.conf.all.mc_forwarding=1

User-Space Multicast Routing Daemons

The Linux kernel does not independently calculate inter-network multicast routes. Instead, it relies on user-space daemons (such as pimd, smcroute, or FRRouting's pimd) implementing protocols like Protocol Independent Multicast (PIM) or Distance Vector Multicast Routing Protocol (DVMRP).

The interaction proceeds as follows:

1. The routing daemon opens a raw IGMP socket and initializes multicast routing in the kernel using the setsockopt(..., MRT_INIT, ...) system call.
2. The daemon configures virtual interfaces (VIFs) in the kernel matching the physical or tunnel interfaces using the MRT_ADD_VIF option.
3. The daemon listens for IGMP group membership messages and exchanges routing information with adjacent multicast routers.

Reverse Path Forwarding (RPF) and Packet Processing

To prevent routing loops, Linux subjects every incoming multicast packet to a Reverse Path Forwarding (RPF) check:

1. A multicast packet arrives on an interface with source IP \(S\) and destination group \(G\).
2. The kernel checks its unicast routing table to identify the interface it would use to send a packet back to source \(S\).
3. If the packet arrived on that exact interface, the RPF check passes. If it arrived on any other interface, the packet is silently dropped.

The Multicast Forwarding Cache (MFC)

Once a packet passes the RPF check, the kernel must determine which outgoing interfaces should receive a copy of the packet.

• Cache Lookup: The kernel consults the Multicast Forwarding Cache (MFC). The cache maps the tuple (Source IP, Group IP) or (*, Group IP) to an entry containing the incoming virtual interface (VIF) and a bitmask of outgoing VIFs.
• Cache Miss: If no MFC entry exists, the kernel generates an IGMPMSG_NOCACHE message and sends it via the raw control socket to the user-space routing daemon.
• Route Installation: The user-space daemon checks its IGMP state tables and PIM trees to determine where that traffic belongs. It then installs an entry into the kernel's MFC using MRT_ADD_MFC.
• Fast-Path Forwarding: Subsequent packets matching that source and group are forwarded directly in the kernel's fast path across all specified egress interfaces, cloning the packet buffer (sk_buff) for each destination.

You can inspect the active multicast routing entries directly from the kernel via the iproute2 utility using ip mroute show or by reading /proc/net/ip_mr_cache.