Multicast Basics, the RPF Check and PIM Sparse Mode

What it is

Multicast sends one stream of packets that many chosen receivers can share.

A unicast sender would need a copy for each receiver. A broadcast reaches everyone, whether or not they want it. Multicast sits between the two, because only the hosts that joined a group receive the traffic.

How it works

Routers build distribution trees, and the RPF check keeps those trees loop free.

Multicast addresses

IPv4 multicast uses the range 224.0.0.0 to 239.255.255.255. Some parts have special meanings.

Examples in the link local range are 224.0.0.5 and 224.0.0.6 for OSPF, 224.0.0.10 for EIGRP and 224.0.0.13 for PIM. On Ethernet, a multicast IP address maps to a MAC address that starts with 01:00:5E.

The RPF check

The reverse path forwarding (RPF) check stops multicast loops. When a multicast packet arrives, the router looks at the source address and asks which interface it would use to send unicast traffic back to that source.

If the packet came in on that interface, it passes the check and is forwarded. If it came in on any other interface, it is dropped. The check uses the unicast routing table, so good routing is a prerequisite for multicast.

R1# show ip rpf 10.1.1.10

The output names the RPF interface and the neighbour for that source.

PIM sparse mode

Protocol Independent Multicast (PIM) builds the multicast trees. It is called protocol independent because it uses the unicast routing table, whatever protocol filled it.

Sparse mode builds trees only toward receivers that ask for traffic. It uses a rendezvous point (RP), a router that acts as a meeting place for sources and receivers.

Routers discover each other with PIM hello messages sent to 224.0.0.13. Receivers join a group through IGMP, which is covered on the next page.

Shared tree and source tree

PIM sparse mode uses two kinds of tree.

In an entry, S is the source address and G is the group. A star means any source.

The steps run in this order:

1. A receiver joins a group, and its router sends a (*, G) join toward the RP.
2. A source starts sending. Its first hop router registers the source with the RP.
3. The RP joins toward the source, and traffic flows down the shared tree.
4. The receiver's router can then switch to the shortest path tree. It joins toward the source directly and prunes the shared tree.

On Cisco routers the switch to the source tree normally happens at the first packet, because the default shortest path tree threshold is zero. The shared tree is a stepping stone, and the final path is often the shortest one.

Finding the RP

Every router needs to know the RP address for a group. There are three ways.

• Static: ip pim rp-address ADDRESS, which is simple and reliable.
• Auto-RP: a Cisco method that announces RPs by multicast.
• BSR: a standard method with a bootstrap router that distributes RP information.

Basic configuration

R1(config)# ip multicast-routing
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip pim sparse-mode
R1(config)# ip pim rp-address 192.168.0.1

Enable multicast routing globally, enable PIM on every interface in the path, and point to the RP.

Verifying

R1# show ip pim neighbor
R1# show ip pim rp mapping
R1# show ip mroute
R1# show ip rpf SOURCE

show ip pim neighbor shows the PIM neighbours that were found. show ip mroute shows the multicast routing table.

An entry such as (*, 239.1.1.1) is the shared tree, and an entry such as (10.1.1.10, 239.1.1.1) is a source tree. Each entry lists an incoming interface and an outgoing interface list.

If traffic does not flow, check that PIM is on every interface in the path, that every router knows the RP, and that the RPF check passes for both the source and the RP.