Layer 2 Security · Topic 1 of 7
IGMP Snooping
Learn how IGMP snooping limits multicast to interested ports, how the querier and multicast router ports work, and how to enable it on a RouterOS bridge.
- 4 min
- Without snooping, a bridge floods multicast like a broadcast.
- IGMP snooping forwards a group only to ports that joined it.
- One querier per segment sends general queries.
What it is
IGMP snooping lets a switch send multicast traffic only to ports that asked for it.
Without snooping, a bridge floods multicast frames out of every port, just like broadcasts. A video stream for one viewer then reaches every device and fills every link. With snooping, the bridge listens to IGMP messages and builds a table of who wants what.
IGMP is the protocol IPv4 hosts use to join and leave multicast groups. The IPv6 counterpart is MLD, which newer RouterOS v7 releases can snoop as well.
How it works
The bridge reads membership messages and keeps a database of groups and ports.
IGMP in brief
Hosts and routers use a few message types.
- Membership report (join): a host says it wants a group.
- Leave: a host says it no longer wants a group.
- General query: a querier asks who still wants any group, at regular intervals.
Only one device on the segment acts as the querier. The others listen. If no querier exists, hosts do not refresh their reports, and the snooping table ages out.
What snooping does
The bridge builds a multicast database from the messages that pass through it.
A multicast frame for a group is forwarded only to the ports that joined the group, and to ports where a multicast router was seen. Link local control groups in the 224.0.0.x range are still flooded, because many protocols depend on them.
Configuration
Enable snooping on the bridge, and add a querier if no router provides one.
/interface bridge set bridge1 igmp-snooping=yes
/interface bridge set bridge1 multicast-querier=yes
/interface bridge mdb printThe igmp-snooping setting turns the feature on. The multicast-querier setting makes the bridge send queries itself. Use it when the segment has no multicast router, such as a closed video network.
The mdb print shows the multicast database: each group, and the ports that joined it.
Multicast router ports
A port that leads to a multicast router must always receive the traffic.
/interface bridge port set [find interface=ether1] multicast-router=permanentThe bridge detects router ports by listening for queries. The multicast-router setting can force the choice, or turn it off for a port. The temporary-query value keeps the learned behaviour.
Fast leave
Fast leave removes a port from a group as soon as a leave message arrives.
/interface bridge port set [find interface=ether3] fast-leave=yesWithout it, the bridge first asks whether anyone else on that port still wants the group. Use fast leave only on ports with one receiver, such as an IPTV set top box. If several receivers share the port, one leave would cut the others off.
Versions and hardware
Hosts may use IGMP version 2 or 3.
Version 3 adds source filtering. In newer releases the bridge has a setting that chooses the version it uses when it acts as a querier.
On a chip that supports it, snooping is offloaded to hardware. Check the offload flag on the ports.
Security view
Snooping reduces what unrelated devices can see.
Receivers get only the groups they requested, and a flood of multicast no longer reaches every port. A host can still join any group, so snooping is not access control. For that, combine it with filters.
If multicast works for a minute and then stops, the querier is usually missing, and the table is ageing out.
Checking
/interface bridge print detail
/interface bridge mdb printConfirm that the groups you expect appear, with the correct ports.
What to remember for the exam
Seven facts cover most questions on this topic.
- Without snooping, a bridge floods multicast like a broadcast.
- IGMP snooping forwards a group only to ports that joined it.
- One querier per segment sends general queries.
igmp-snooping=yesenables it, andmulticast-querier=yesadds a querier./interface bridge mdb printshows the multicast database.multicast-routermarks the ports that lead to a multicast router.fast-leavesuits only ports with a single receiver.
Without a querier on the segment, snooping ages out the groups, and multicast stops reaching receivers.
Common mistakes
These four mistakes appear often.
Enabling snooping with no querier. Reports are not refreshed, so groups expire.
Using fast leave on shared ports. One leave cuts off the other receivers.
Forgetting the router port. Multicast traffic never reaches the upstream router.
Treating snooping as security. Any host may still join any group.
Check yourself
Work through these three questions.
What does a bridge do with multicast frames when snooping is off?
It floods them out of all ports, like broadcasts.
Why is a querier needed?
It sends the regular queries that make hosts renew their reports, so the table does not age out.
Which command shows the multicast database?
/interface bridge mdb print.
Topic 1 of 7 in Layer 2 Security
Test yourself on Layer 2 Security
The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.