How to Analyze Network Protocols, Learn More >>

Being able to support more than 300 protocols in the latest version, Capsa Network Sniffer make it easy to analyze protocols in network and understand what is happening.

Recommend Network Analysis Software >>


RFC 1112 http://tools.ietf.org/html/rfc1112
RFC 2236 http://tools.ietf.org/html/rfc2236

The Internet Group Management Protocol (IGMP) is used by IP hosts to report their host group memberships to any immediately neighboring multicast routers. IGMP is a integral part of IP. It must be implemented by all hosts conforming to level 2 of the IP multicasting specification. IGMP messages are encapsulated in IP datagrams, with an IP protocol number of 2.Version 3 of IGMP adds support for source filtering. This indicates the ability for a system to report interest in receiving packets;only from specific source addresses, or from all but specific source addresses, sent to a particular multicast address.

The format of the IGMP packet is shown in the following illustration:

8
16
32 bits
Type
Max response
time
Checksum
Group address
 
 
IGMP packet structure

Version
The protocol version.

Type
The message type:

0x11 Membership query. There are 2 sub-types of membership queries, general query and group-specific query.
0x16 Version 2 membership report.
0x17 Leave group.
0x12 Version 1 membership report. Provides compatibility with IGMPv1.
0x22 Version 3 membership report.

Max Response Time
Used only in Membership query messages. Specifies the maximum time allowed before sending a responding report in units of 1/10 second. In all other messages, it is set to 0 by the sender and ignored by the receiver.


Checksum
The checksum.

Group Address
In a Membership query message, The Group address is set to 0 when sending a general query. It is set to the group address being queried, when sending a group specific query or group-and-source-specific query. In a membership report of a leave group message, it holds the IP multicast group address of the group being reported or left.

IGMP Version Membership Report Messages
IGMP Version Membership Report messages have the following format:

8 16 32 bits
Type Reserved Checksum  
Reserved Number of group record
Group record
Group record
Group record
Group record

Type
The Type field has a value of 21.

Reserved.
Set to zero on transmission, and ignored on reception.

Checksum
The Checksum is the 16-bit one's complement of the one's complement sum of the whole IGMP message.

Number of Group Records (M)
The number of Group records present in this report.

Group Record
A block of fields containing information about the sender's membership in a single multicast group, on the interface from which the report is sent.

Group Record Type
There are a number of different types of Group Records that may be included in a Report message:

Current-State Record, which has the following record types:
    1. Include mode
    2. Exclude mode

Filter-Mode-Change Record, which has the following two record types:
    3. Change to Include Mode
    4. Change to Exclude Mode

Source-List-Change Record, which has the following two record types:
    5. Allow New Sources
    6. Block Old Sources

Vulnerabilities for this protocol (from CVE)

CVE ID Protocol Source Port Targetport

TCP/IP Protocols:

AHARP/RARPATMPBGP-4COPSDCAPDHCPDNS
DVMRPEGPEIGRPESPFANPFingerFTPHSRP
HTTPICMPICMPv6IGMPIGRPIMAP4IPIPDC
IPv6ISAKMPL2FL2TPLDAPMARSMobile IPNARP
NetBIOS/IPNHRPNTPOSPFPIMPOP3PPTPRadius
RIP2RIPng for IPv6RLOGINRSVPRTSPRUDPS-HTTPSCTP
SLPSMTPSNMPSOCKS V5TACACSTALITCPTELNET
TFTPUDPVan JacobsonVRRPWCCPX-WindowXOT