How to Analyze Network Protocols, Learn More >>

Being able to support more than 300 protocols in the latest version, Capsa Network Sniffer make it easy to analyze protocols in network and understand what is happening.

Recommend Network Analysis Software >>

RFC 1112
RFC 2236

The Internet Group Management Protocol (IGMP) is used by IP hosts to report their host group memberships to any immediately neighboring multicast routers. IGMP is a integral part of IP. It must be implemented by all hosts conforming to level 2 of the IP multicasting specification. IGMP messages are encapsulated in IP datagrams, with an IP protocol number of 2.Version 3 of IGMP adds support for source filtering. This indicates the ability for a system to report interest in receiving packets;only from specific source addresses, or from all but specific source addresses, sent to a particular multicast address.

The format of the IGMP packet is shown in the following illustration:

32 bits
Max response
Group address
IGMP packet structure

The protocol version.

The message type:

0x11 Membership query. There are 2 sub-types of membership queries, general query and group-specific query.
0x16 Version 2 membership report.
0x17 Leave group.
0x12 Version 1 membership report. Provides compatibility with IGMPv1.
0x22 Version 3 membership report.

Max Response Time
Used only in Membership query messages. Specifies the maximum time allowed before sending a responding report in units of 1/10 second. In all other messages, it is set to 0 by the sender and ignored by the receiver.

The checksum.

Group Address
In a Membership query message, The Group address is set to 0 when sending a general query. It is set to the group address being queried, when sending a group specific query or group-and-source-specific query. In a membership report of a leave group message, it holds the IP multicast group address of the group being reported or left.

IGMP Version Membership Report Messages
IGMP Version Membership Report messages have the following format:

8 16 32 bits
Type Reserved Checksum  
Reserved Number of group record
Group record
Group record
Group record
Group record

The Type field has a value of 21.

Set to zero on transmission, and ignored on reception.

The Checksum is the 16-bit one's complement of the one's complement sum of the whole IGMP message.

Number of Group Records (M)
The number of Group records present in this report.

Group Record
A block of fields containing information about the sender's membership in a single multicast group, on the interface from which the report is sent.

Group Record Type
There are a number of different types of Group Records that may be included in a Report message:

Current-State Record, which has the following record types:
    1. Include mode
    2. Exclude mode

Filter-Mode-Change Record, which has the following two record types:
    3. Change to Include Mode
    4. Change to Exclude Mode

Source-List-Change Record, which has the following two record types:
    5. Allow New Sources
    6. Block Old Sources

Vulnerabilities for this protocol (from CVE)

CVE ID Protocol Source Port Targetport

TCP/IP Protocols: