Ch 13: Multicast

Question 1

Which of the following transmission methods is multicast known for?

a. One-to-one
b. One-to-all
c. One-for-all
d. All-for-one
e. One-to-many

Answer 1

E. Multicast uses the one-to-many transmission method, where one server sends multicast traffic to a group of receivers.

Question 2

Which protocols are essential to multicast operation? (Choose two.)

1. Open Shortest Path First (OSPF)
2. Protocol Independent Multicast (PIM)
3. Internet Group Management Protocol (IGMP)
4. Auto-RP and BSR

Answer 2

2 and 3.

Multicast relies on Internet Group Management Protocol (IGMP) for its operation in Layer 2 networks and Protocol Independent Multicast (PIM) for its operation in Layer 3 networks. It is routing protocol independent and can work with static RPs.

Question 3

Which of the following multicast address ranges match the administratively scoped block? (Choose two.)

1. 239.0.0.0 to 239.255.255.255
2. 232.0.0.0 to 232.255.255.255
3. 224.0.0.0 to 224.0.0.255
4. 239.0.0.0/8
5. 224.0.1.0/24

Answer 3

1 and 4.

239.0.0.0/8 (239.0.0.0 to 239.255.255.255) is the IANA IP multicast address range assigned to the administratively scoped block.

Administratively scoped

The 239.0.0.0/8 range is assigned by RFC 2365 for private use within an organization. Per the RFC, packets destined to administratively scoped IPv4 multicast addresses do not cross administratively defined organizational boundaries, and administratively scoped IPv4 multicast addresses are locally assigned and do not have to be globally unique. The RFC also discusses structuring the 239.0.0.0/8 range to be loosely similar to the scoped IPv6 multicast address range described in RFC 1884.

Question 4

The first 24 bits of a multicast MAC address always start with ______.

1. 01:5E:00
2. 01:00:53
3. 01:00:5E
4. 01:05:E0
5. none of the above

Answer 4

3.

The first 24 bits of a multicast MAC address always start with 01:00:5E. The low-order bit of the first byte is the individual/group bit (I/G), also known as the unicast/multicast bit, and when it is set to 1, it indicates that the frame is a multicast frame and the 25th bit is always 0.

Question 5

What does a host need to do to start receiving multicast traffic?

1. Send an IGMP join
2. Send an unsolicited membership report
3. Send an unsolicited membership query
4. Send an unsolicited group specific query

Answer 5

2.

An IGMP membership report is a message type that receivers use to join a multicast group or to respond to a local router’s membership query message.

Question 6

What is the main difference between IGMPv2 and IGMPv3?

1. IGMPv3’s max response time is 10 seconds by default.
2. IGMPv3 sends periodic IGMP membership queries.
3. IGMPv3 introduced a new IGMP membership report with source filtering support.
4. IGMPv3 can only work with SSM, while IGMPv2 can only work with PIM-SM/DM.

Answer 6

C.

IGMPv3 supports all IGMPv2’s IGMP message types and is backward compatible with it. The differences between the two are that IGMPv3 added new fields to the IGMP membership query and introduced a new IGMP

Question 7

T/F: IGMPv3 was designed to work exclusively with SSM and is not backward compatible with PIM-SM.

Answer 7

False.

IGMPv3 is backward compatible with IGMPv2. To receive traffic from all sources, which is the behavior of IGMPv2, a receiver uses exclude mode membership with an empty exclude list.

Question 8

How can you avoid flooding of multicast frames in a Layer 2 network?

1. Disable unknown multicast flooding
2. Enable multicast storm control
3. Enable IGMP snooping
4. Enable control plane policing

Answer 8

3.

IGMP snooping, defined in RFC 4541, examines IGMP joins sent by receivers and maintains a table of interfaces to IGMP joins. When a switch receives a multicast frame destined for a multicast group, it forwards the packet only out the ports where IGMP joins were received for that specific multicast group. This prevents multicast traffic from flooding in a Layer 2 network.

Question 9

Which of the following best describe SPT and RPT? (Choose two.)

1. RPT is a source tree where the rendezvous point is the root of the tree.
2. SPT is a source tree where the source is the root of the tree.
3. RPT is a shared tree where the rendezvous point is the root of the tree.
4. SPT is a shared tree where the source is the root of the tree.

Answer 9

2 and 3.

A source tree is a multicast distribution tree where the source is the root of the tree, and branches form a distribution tree through the network all the way down to the receivers. When this tree is built, it uses the shortest path through the network from the source to the leaves of the tree; for this reason, it is also referred to as a shortest path tree.

A shared tree is a multicast distribution tree where the root of the shared tree is not the source but a router designated as the rendezvous point (RP). For this reason, shared trees are also referred to as RP trees (RPTs).

Question 10

Which of the following most accurately describes what an LHR does after it receives an IGMP join from a receiver?

1. It sends a PIM register message toward the RP.
2. It sends a PIM join toward the RP.
3. It sends a PIM register message toward the source.
4. It sends a PIM join message toward the source.

Answer 10

2.

PIM-SM uses an explicit join model where the receivers send an IGMP join to their locally connected router, which is also known as the last-hop router (LHR), and this join causes the LHR to send a PIM join in the direction of the root of the tree, which is either:

• the RP in the case of a shared tree (RPT)
• or the first-hop router (FHR) where the source transmitting the multicast streams is connected in the case of an SPT.

For a shared tree join:

The LHR knows the IP address of the RP for group G, and it then sends a (*,G) PIM join for this group to the RP. If the RP were not directly connected, this (*,G) PIM join would travel hop-by-hop to the RP, building a branch of the shared tree that would extend from the RP to the LHR. At this point, group G multicast traffic arriving at the RP can flow down the shared tree to the receiver.

Question 11

What does an FHR do when an attached source becomes active and there are no interested receivers?

1. It unicasts register messages to the RP and stops after a register stop from the RP.
2. It unicasts encapsulated register messages to the RP and stops after a register stop from the RP.
3. It waits for the RP to send register message indicating that there are interested receivers.
4. It multicasts encapsulated register messages to the RP and stops after a register stop from the RP.
5. It unicasts encapsulated register messages to the RP until there are interested receivers.

Answer 11

2.

When there is an active source attached to the FHR, the FHR encapsulates the multicast data from the source in a special PIM-SM message called the register message and unicasts that data to the RP by using a unidirectional PIM tunnel.

When the RP receives the register message, it decapsulates the multicast data packet inside the register message, and if there is no active shared tree because there are no interested receivers, the RP sends a register stop message to the FHR, instructing it to stop sending the register messages.

Question 12

Which of the following is a group-to-RP mapping mechanism developed by Cisco?

1. BSR
2. Static RP
3. Auto-RP
4. Phantom RP
5. Anycast-RP

Answer 12

3.

Auto-RP is a Cisco proprietary mechanism that automates the distribution of group-to-RP mappings in a PIM network.

Question 13

T/F: When PIM is configured in dense mode, it is mandatory to choose one or more routers to operate as rendezvous points (RPs).

Answer 13

False.

PIM-DM does not use RPs. When PIM is configured in sparse mode, it is mandatory to choose one or more routers to operate as rendezvous points (RPs).

Question 14

T/F: Multicast relies on Protocol Independent Multicast (PIM) for its operation in Layer 2 networks and Internet Group Management Protocol (IGMP) for its operation in Layer 3 networks.

Answer 14

False.

Multicast communication is a technology that optimizes network bandwidth utilization and conserves system resources.

It relies on Internet Group Management Protocol (IGMP) for its operation in Layer 2 networks and Protocol Independent Multicast (PIM) for its operation in Layer 3 networks.

Figure 13-1 illustrates how IGMP operates between the receivers and the local multicast router and how PIM operates between routers. These two technologies work hand-in-hand to allow multicast traffic to flow from the source to the receivers, and they are explained in this chapter.

Question 15

T/F: Enabling directed broadcast on a Cisco router exposes it to DDoS attacks.

Answer 15

True.

IP Directed broadcasts are an alternative to streaming many streams sans multicast, however there are risks and costs.

RISK: IP directed broadcast functionality is not enabled by default on Cisco routers, and enabling it exposes the router to distributed denial-of-service (DDoS) attacks.

COST: The network interface cards (NICs) of uninterested workstations must still process the broadcast packets and send them on to the workstation’s CPU, which wastes processor resources. In Figure 13-3, Workstation F is processing unwanted packets.

For these reasons, broadcast traffic is generally not recommended.

Question 16

What is an MDT, in reference to Multicast?

Answer 16

Multicast traffic provides one-to-many communication, where only one data packet is sent on a link as needed and then is replicated between links as the data forks (splits) on a network device along the multicast distribution tree (MDT).

Question 17

What are the data packets associated with a multicast session called collectively? What is their collective destination address called?

Answer 17

The data packets are known as a stream that uses a special destination IP address, known as a group address.

Question 18

T/F:

A server for a stream manages only one session, and network devices filter the multicast stream if no receivers are on that segment.

Answer 18

False.

A server for a stream manages only one session, and network devices selectively request to receive the stream. They do not filter the traffic, but rather, they never receive it if they do not register with the server.

However, if there is one receiver on a segment, the router will forward the traffic to that segment, but only receivers that are interested in the video stream process the multicast traffic. The others simply drop it.

Question 19

In Multicast, what is the sender called? and the clients?

Answer 19

A server sends a stream and recipient devices of a multicast stream are known as receivers.

Question 20

What is the reserved range of multicast addresses in IPv4? give answer in net/mask, DD notation and the leading 4 binary bits in first octet.

Answer 20

The Internet Assigned Number Authority (IANA) assigned the IP Class D address space 224.0.0.0/4 for multicast addressing.

It includes addresses ranging from 224.0.0.0 to 239.255.255.255.

The first 4 bits of this whole range start with 1110.

Question 21

What is the SSM range of IP addresses in multicast?

Answer 21

Source Specific Multicast (SSM) block (232.0.0.0/8): This is the default range used by SSM.

SSM is a PIM extension that was added to IGMPv3 and does not exist in IGMPv1 or IGMPv2.

SSM forwards traffic to receivers from only those multicast sources for which the receivers have explicitly expressed interest; it is primarily targeted to one-to-many applications.

Question 22

T/F: Every multicast group address (IP address) is mapped to a special MAC address that allows Ethernet interfaces to identify multicast packets to a specific group.

Answer 22

True.

Every multicast group address (IP address) is mapped to a special MAC address that allows Ethernet interfaces to identify multicast packets to a specific group.

A LAN segment can have multiple streams, and a receiver knows which traffic to send to the CPU for processing based on the MAC address assigned to the multicast traffic.

The first 24 bits of a multicast MAC address always start with 01:00:5E.

Question 23

What is the I/G bit in multicast?

Answer 23

The first 24 bits of a multicast MAC address always start with 01:00:5E.

The low-order bit of the first byte is the individual/group bit (I/G) bit, also known as the unicast/multicast bit, and when it is set to 1, it indicates that the frame is a multicast frame, and the 25th bit is always 0.

The lower 23 bits of the multicast MAC address are copied from the lower 23 bits of the multicast group IP address.

Figure 13-5 shows an example of mapping the multicast IP address 239.255.1.1 into multicast MAC address 01:00:5E:7F:01:01. The first 25 bits are always fixed; the last 23 bits that are copied directly from the multicast IP address vary.

Question 24

T/F: When a receiver wants to receive a specific multicast feed, it sends an IGMP join using the multicast IP group address for that feed.

Answer 24

True.

When a receiver wants to receive a specific multicast feed, it sends an IGMP join using the multicast IP group address for that feed. The receiver reprograms its interface to accept the multicast MAC group address that correlates to the group address. For example, a PC could send a join to 239.255.1.1 and would reprogram its NIC to receive 01:00:5E:7F:01:01. If the PC were to receive an OSPF update sent to 224.0.0.5 and its corresponding multicast MAC 01:00:5E:00:00:05, it would ignore it and eliminate wasted CPU cycles by avoiding the processing of undesired multicast traffic.

Question 25

What is IGMP?

Answer 25

Internet Group Management Protocol (IGMP) is the protocol that receivers use to join multicast groups and start receiving traffic from those groups.

IGMP must be supported by receivers and the router interfaces facing the receivers. When a receiver wants to receive multicast traffic from a source, it sends an IGMP join to its router. If the router does not have IGMP enabled on the interface, the request is ignored.

Question 26

How many versions of IGMP exist?

Answer 26

Three versions of IGMP exist.

1. RFC 1112 defines IGMPv1, which is old and rarely used.
2. RFC 2236 defines IGMPv2, which is common in most multicast networks
3. RFC 3376 defines IGMPv3, which is used by SSM.

Question 27

T/F: IGMP messages are encapsulated in an IP packet with a protocol number of 2.

Answer 27

True.

Question 28

What is the TTL on an IGMP message?

Answer 28

Messages are sent with the IP router alert option set, which indicates that the packets should be examined more closely, and a time-to-live (TTL) of 1.

IGMP packets are sent with a TTL of 1 so that packets are processed by the local router and not forwarded by any router.

Question 29

What is the Type field in an IGMP message?

Answer 29

Type: This 8-bit field describes five different types of IGMP messages used by routers and receivers:

1. Version 2 membership report (type value 0x16) is a message type also commonly referred to as an IGMP join; it is used by receivers to join a multicast group or to respond to a local router’s membership query message.
2. Version 1 membership report (type value 0x12) is used by receivers for backward compatibility with IGMPv1.
3. Version 2 leave group (type value 0x17) is used by receivers to indicate they want to stop receiving multicast traffic for a group they joined.
4. General membership query (type value 0x11) is sent periodically sent to the all-hosts group address 224.0.0.1 to see whether there are any receivers in the attached subnet. It sets the group address field to 0.0.0.0.
5. Group specific query (type value 0x11) is sent in response to a leave group message to the group address the receiver requested to leave. The group address is the destination IP address of the IP packet and the group address field.

Question 30

T/F: The Checksum field on an IGMP message is 16-bit 1s complement of the 1s complement sum of the IGMP message.

Answer 30

True.

Checksum: This field is the 16-bit 1s complement of the 1s complement sum of the IGMP message. This is the standard checksum algorithm used by TCP/IP.

Question 31

What is the unit of time in the ‘max response time’ field in an IGMP message?

Answer 31

Max response time: This field is set only in general and group-specific membership query messages (type value 0x11); it specifies the maximum allowed time before sending a responding report in units of one-tenth of a second. In all other messages, it is set to 0x00 by the sender and ignored by receivers.

Question 32

What is an IGMP join?

Answer 32

IGMP join is not a valid message type in the IGMP RFC specifications, but the term is commonly used in the field in place of IGMP membership reports because it is easier to say and write.

Question 33

When a receiver wants to receive a multicast stream, how does it do so?

Answer 33

1. When a receiver wants to receive a multicast stream, it sends an unsolicited membership report, commonly referred to as an IGMP join, to the local router for the group it wants to join (for example, 239.1.1.1).
2. The local router then sends this request upstream toward the source using a PIM join message.
3. When the local router starts receiving the multicast stream, it forwards it downstream to the subnet where the receiver that requested it resides.

Question 34

What happens if there is more than one router on a segment with regards to the IGMP querier?

Answer 34

If there is more than one router in a LAN segment, an IGMP querier election takes place to determine which router will be the querier.

IGMPv2 routers send general membership query messages with their interface address as the source IP address and destined to the 224.0.0.1 multicast address. When an IGMPv2 router receives such a message, it checks the source IP address and compares it to its own interface IP address. The router with the lowest interface IP address in the LAN subnet is elected as the IGMP querier. At this point, all the non-querier routers start a timer that resets each time they receive a membership query report from the querier router.

If the querier router stops sending membership queries for some reason (for instance, if it is powered down), a new querier election takes place. A non-querier router waits twice the query interval, which is by default 60 seconds, and if it has heard no queries from the IGMP querier, it triggers IGMP querier election.

Question 35

T/F: IGMPv3 is an extension of IGMPv2 that adds support for multicast source filtering, which gives the receivers the capability to pick the source they wish to accept multicast traffic from.

Answer 35

True.

IGMPv3 is an extension of IGMPv2 that adds support for multicast source filtering, (aka SSM -Source Specific Multicast), which gives the receivers the capability to pick the source they wish to accept multicast traffic from.

IGMPv3 is designed to coexist with IGMPv1 and IGMPv2.

IGMPv3 supports all IGMPv2’s IGMP message types and is backward compatible with IGMPv2. The differences between the two are that IGMPv3 added new fields to the IGMP membership query and introduced a new IGMP message type called Version 3 membership report to support source filtering.

Question 36

What is the difference between include and exclude mode when a receiver is signaling to join a stream?

Answer 36

IGMPv3 supports applications that explicitly signal sources from which they want to receive traffic. With IGMPv3, receivers signal membership to a multicast group address using a membership report in the following two modes:

• Include mode: In this mode, the receiver announces membership to a multicast group address and provides a list of source addresses (the include list) from which it wants to receive traffic.
• Exclude mode: In this mode, the receiver announces membership to a multicast group address and provides a list of source addresses (the exclude list) from which it does not want to receive traffic. The receiver then receives traffic only from sources whose IP addresses are not listed on the exclude list. To receive traffic from all sources, which is the behavior of IGMPv2, a receiver uses exclude mode membership with an empty exclude list.

Question 37

What is the mechanism that IGMP uses to optimize forwarding and minimize flooding? Switches need a method of sending traffic only to interested receivers…

Answer 37

Cisco switches use two methods to reduce multicast flooding on a LAN segment:

1. IGMP snooping
2. Static MAC address entries

IGMP snooping, defined in RFC 4541, is the most widely used method and works by examining IGMP joins sent by receivers and maintaining a table of interfaces to IGMP joins. When the switch receives a multicast frame destined for a multicast group, it forwards the packet only out the ports where IGMP joins were received for that specific multicast group.

A multicast static entry can also be manually programmed into the MAC address table, but this is not a scalable solution because it cannot react dynamically to changes; for this reason, it is not a recommended approach.

Question 38

What is the Multicast MAC address of 239.255.1.1?

Answer 38

• 239.255.1.1, which translates to the multicast MAC address 01:00:5E:7F:01:01.
• The first three octets are always 01:00:5E
• The 25th bit, (first bit of the fourth octet), is always 0 for multicast MAC.
• The rest of the 3rd octet is all 1s because of the 255 in the IP address.
• The last two octets are 01:01, because of the last two IP octets.

Figure 13-5 shows an example of mapping the multicast IP address 239.255.1.1 into multicast MAC address 01:00:5E:7F:01:01. The first 25 bits are always fixed; the last 23 bits that are copied directly from the multicast IP address vary.

Out of the 9 bits from the multicast IP address that are not copied into the multicast MAC address, the high-order bits 1110 are fixed; that leaves 5 bits that are variable that are not transferred into the MAC address. Because of this, there are 32 (25) multicast IP addresses that are not universally unique and could correspond to a single MAC address; in other words, they overlap.

Question 39

T/F: Enabling IGMP snooping eliminates flooding from Multicast groups.

Answer 39

False.

Even with IGMP snooping enabled, some multicast groups are still flooded on all ports (for example, 224.0.0.0/24 reserved addresses).

Question 40

What is PIM in multicast?

Answer 40

Protocol Independent Multicast.

Receivers use IGMP (L2) to join a multicast group, which is sufficient if the group’s source connects to the same router to which the receiver is attached. At L3 a multicast routing protocol is necessary to route the multicast traffic throughout the network so that routers can locate and request multicast streams from other routers. Multiple multicast routing protocols exist, but Cisco fully supports only Protocol Independent Multicast (PIM).

PIM is a multicast routing protocol that routes multicast traffic between network segments. PIM can use any of the unicast routing protocols to identify the path between the source and receivers.

Question 41

What are the two types of distribution trees used by multicast routers?

Answer 41

Multicast routers create distribution trees that define the path that IP multicast traffic follows through the network to reach the receivers. The two basic types of multicast distribution trees are source trees, also known as shortest path trees (SPTs), and shared trees.

Question 42

What is the root of the tree in a SPT, Shortest Path Tree?

Answer 42

A source tree is a multicast distribution tree where the source is the root of the tree, and branches form a distribution tree through the network all the way down to the receivers.

When this tree is built, it uses the shortest path through the network from the source to the leaves of the tree; for this reason, it is also referred to as a shortest path tree (SPT).

Question 43

The forwarding state of the SPT is known by the notation (S,G), pronounced “S comma G”. What do S & G represent?

Answer 43

The forwarding state of the SPT is known by the notation (S,G), pronounced “S comma G,” where S is the source of the multicast stream (server), and G is the multicast group address.

Using this notation, the SPT state for the example shown in Figure 13-12 is (10.1.1.2, 239.1.1.1), where the multicast source S is 10.1.1.2, and the multicast group G is 239.1.1.1, joined by Receivers A and B.

Question 44

T/F: Because every SPT is rooted at the source S, every source sending to a multicast group requires an SPT.

Answer 44

True.

Question 45

What is a “shared tree”?

Answer 45

A shared tree is a MDT, a multicast distribution tree, where the root of the shared tree is not the source but a router designated as the rendezvous point (RP).

For this reason, shared trees are also referred to as RP trees (RPTs).

Multicast traffic is forwarded down the shared tree according to the group address G that the packets are addressed to, regardless of the source address.

Question 46

What is one benefit and one drawback to shared trees in multicast?

Answer 46

Benefit: One of the benefits of shared trees over source trees is that they require fewer multicast entries (for example, S,G and *,G).

Drawback: The major drawback of shared trees is that the receivers receive traffic from all the sources sending traffic to the same multicast group. Even though the receiver’s applications can filter out the unwanted traffic, this situation still generates a lot of unwanted network traffic, wasting bandwidth. In addition, because shared trees can allow multiple sources in an IP multicast group, there is a potential network security issue because unintended sources could send unwanted packets to receivers.

Question 47

What is the Reverse Path Forwarding (RPF) interface in PIM ?

Answer 47

Reverse Path Forwarding (RPF) interface: The interface with the lowest-cost path (based on administrative distance [AD] and metric) to the IP address of the source (SPT) or the RP, in the case of shared trees.

If multiple interfaces have the same cost, the interface with the highest IP address is chosen as the tiebreaker.

IIF is the same interface, the Incoming InterFace. Packets from the source traverse this interface.

Question 48

What is an RP router in PIM?

Answer 48

This is the router acting as a Rendevous Point. This router acts as the root of the RPT.

Question 49

In PIM, what is an RPF neighbor?

Answer 49

The PIM neighbor on the RPF interface.

If a router is using the RPT(Rendezvous Point Tree) shared tree, the RPF (Reverse Path Forwarding) neighbor would be the lowest-cost path to the RP.

If it is using the SPT, the RPF neighbor is chosen because it offers the lowest cost to the source.

Question 50

Does a PIM join travel upstream or downstream to the source or RP?

Answer 50

Upstream: Toward the source of the tree, which could be the actual source in source-based trees or the RP in shared trees. A PIM join travels upstream toward the source.

Upstream interface: The interface toward the source of the tree. It is also known as the RPF interface or the incoming interface (IIF).

Question 51

What is the Outgoing interface list (OIL) in PIM?

Answer 51

Outgoing interface list (OIL): A group of OIFs(Outgoing InterFaces) that are forwarding multicast traffic to the same group.

An example of this is a router’s interfaces sending multicast traffic downstream for the same multicast group.

Question 52

In PIM, what is the Last-hop router (LHR)?

Answer 52

Last-hop router (LHR): A router that is directly attached to the receivers, also known as a leaf router. It is responsible for sending PIM joins upstream toward the RP or to the source.

Question 53

What is a First-hop router (FHR) in PIM?

Answer 53

First-hop router (FHR): A router that is directly attached to the source, also known as a root router. It is responsible for sending register messages to the RP.

Question 54

What is the Multicast Routing Information Base (MRIB)?

Answer 54

Multicast Routing Information Base (MRIB): A topology table that is also known as the multicast route table (mroute), which derives from the unicast routing table and PIM.

MRIB contains the source (S), group (G), incoming interfaces (IIF), outgoing interfaces (OIFs), and RPF (Reverse Path Forwarding) neighbor information for each multicast route as well as other multicast-related information.

Question 55

What is the Multicast Forwarding Information Base (MFIB) in PIM?

Answer 55

Multicast Forwarding Information Base (MFIB): A forwarding table that uses the MRIB to program multicast forwarding information in hardware for faster forwarding.

Question 56

What do these acronyms of the 5 operational modes of PIM stand for?

1. PIM-DM
2. PIM-SM
3. PIM-SDM
4. PIM-SSM
5. Bidir-PIM

Answer 56

There are currently five PIM operating modes:

1. PIM Dense Mode (PIM-DM)
2. PIM Sparse Mode (PIM-SM)
3. PIM Sparse Dense Mode
4. PIM Source Specific Multicast (PIM-SSM)
5. PIM Bidirectional Mode (Bidir-PIM)

Question 57

T/F: PIM-DM and PIM-SM are also commonly referred to as any-source multicast (ASM).

Answer 57

True.

Any-source multicast (ASM) is the older and more usual form of multicast where multiple senders can be on the same group/channel, as opposed to source-specific multicast where a single particular source is specified.

Any-source multicast allows a host computer to map IPs and then sends IPs to a number of groups via IP address. This method of multicasting allows hosts to transmit to/from groups without any restriction on the location of end-user computers by allowing any receiving host group computer to become a transmission source. Bandwidth usage is nominal allowing Video Conferencing to be used extensively. However, this type of multicast is vulnerable in that it allows for unauthorized traffic and denial-of-service attacks.

Commonly, any-source multicast is used in IGMP version 2; however, it can also be used in PIM-SM, MSDP, and MBGP.

Question 58

T/F: All PIM control messages use the IP protocol number 103.

Answer 58

True.

All PIM control messages use the IP protocol number 103; they are either unicast (that is, register and register stop messages) or multicast, with a TTL of 1 to the all PIM routers address 224.0.0.13.

Question 59

What address are Hellos message sent to all PIM routers?

Answer 59

224.0.0.13

PIM hello messages are sent by default every 30 seconds out each PIM enabled interface to learn about the neighboring PIM routers on each interface to the all PIM routers address shown in Table 13-4.

Hello messages are also the mechanism used to elect a designated router (DR), as described later in this chapter, and to negotiate additional capabilities. All PIM routers must record the hello information received from each PIM neighbor.

Question 60

Why would you configure a router to use PIM-DM?

Answer 60

PIM routers can be configured for PIM Dense Mode (PIM-DM) when it is safe to assume that the receivers of a multicast group are located on every subnet within the network—in other words, when the multicast group is densely populated across the network.

Question 61

When PIM-DM is building the multicast tree it grows from the root to the leaves.

1. What type of routers reply to the traffic that is flooded out from the source?
2. How are branches pruned?

Answer 61

Fact: For PIM-DM, the multicast tree is built by flooding traffic out every interface from the source to every Dense Mode router in the network. The tree is grown from the root toward the leaves.

Pruning process:

1. As each router receives traffic for the multicast group, it must decide whether it already has active receivers wanting to receive the multicast traffic. If so, the router remains quiet and lets the multicast flow continue. If no receivers have requested the multicast stream for the multicast group on the LHR, the router sends a prune message toward the source. That branch of the tree is then pruned off so that the unnecessary traffic does not continue.
2. The resulting tree is a source tree because it is unique from the source to the receivers.

Question 62

T/F: PIM-DM is generally recommended for production environments

Answer 62

false.

PIM-DM is applicable to small networks where there are active receivers on every subnet of the network. Because this is rarely the case, PIM-DM is not generally recommended for production environments; however, it can be useful for a lab environment because it is easy to set up.

In PIM-DM, prunes expire after three minutes. This causes the multicast traffic to be reflooded to all routers just as was done during the initial flooding. This periodic (every three minutes) flood and prune behavior is normal and must be taken into account when a network is designed to use PIM-DM.

Question 63

T/F: PIM-SM, PIM-Sparse Mode, only works well in sparsely populated networks.

Answer 63

False.

PIM Sparse Mode (PIM-SM) was designed for networks with multicast application receivers scattered throughout the network—in other words, when the multicast group is sparsely populated across the network.

However, PIM-SM also works well in densely populated networks. It also assumes that no receivers are interested in multicast traffic unless they explicitly request it.

Question 64

T/F: PIM is routing protocol independent.

Answer 64

True.

Just like PIM-DM, PIM-SM uses the unicast routing table to perform RPF checks, and it does not care which routing protocol (including static routes) populates the unicast routing table; therefore, it is protocol independent.

Question 65

What is incorrect about this statement? Only one thing is amiss…

PIM-SM uses an explicit join model where the receivers send an IGMP hello message to their locally connected router, which is also known as the last-hop router (LHR), and this hello causes the LHR to send a PIM join in the direction of the root of the tree, which is either the RP in the case of a shared tree (RPT) or the first-hop router (FHR) where the source transmitting the multicast streams is connected in the case of an SPT.

Answer 65

PIM-SM uses an explicit join model where the receivers send an IGMP join to their locally connected router, which is also known as the last-hop router (LHR), and this join causes the LHR to send a PIM join in the direction of the root of the tree, which is either the RP in the case of a shared tree (RPT) or the first-hop router (FHR) where the source transmitting the multicast streams is connected in the case of an SPT.

Question 66

What is a PIM-SM “register message”?

Answer 66

The FHR encapsulates the multicast data from the source in a special PIM-SM message called the register message and unicasts that data to the RP using a unidirectional PIM tunnel. When the RP receives the register message, it decapsulates the multicast data packet inside the register message, and one of two things happen:

No active shared tree: If there is no active shared tree because there are no interested receivers, the RP sends a register stop message directly to the registering FHR, without traversing the PIM tunnel, instructing it to stop sending the register messages.

Active shared tree: If there is an active shared tree for the group, it forwards the multicast packet down the shared tree, and it sends an (S,G) join back toward the source network S to create an (S,G) SPT. If there are multiple hops (routers) between the RP and the source, this results in an (S,G) state being created in all the routers along the SPT, including the RP. There will also be a (*,G) in R1 and all of the routers between the FHR and the RP.

As soon as the SPT is built from the source router to the RP, multicast traffic begins to flow natively from the source S to the RP.

Question 67

On a FHR, what is the DR, Designated Router, responsible for?

On a LHR, what is the DR responsible for?

Answer 67

On an FHR, the designated router is responsible for encapsulating in unicast register messages any multicast packets originated by a source that are destined to the RP.

On an LHR, the designated router is responsible for sending PIM join and prune messages toward the RP to inform it about host group membership, and it is also responsible for performing a PIM STP switchover.

Question 68

Why is a DR elected in PIM?

Answer 68

When multiple PIM-SM routers exist on a LAN segment, PIM hello messages are used to elect a designated router (DR) to avoid sending duplicate multicast traffic into the LAN or the RP.

Without DRs, all LHRs on the same LAN segment would be capable of sending PIM joins upstream, which could result in duplicate multicast traffic arriving on the LAN. On the source side, if multiple FHRs exist on the LAN, they all send register messages to the RP at the same time.

Question 69

____________ is an algorithm used to prevent loops and ensure that multicast traffic is arriving on the correct interface.

Answer 69

Reverse Path Forwarding (RPF) is an algorithm used to prevent loops and ensure that multicast traffic is arriving on the correct interface.

RPF functions as follows:

• If a router receives a multicast packet on an interface it uses to send unicast packets to the source, the packet has arrived on the RPF interface.
• If the packet arrives on the RPF interface, a router forwards the packet out the interfaces present in the outgoing interface list (OIL) of a multicast routing table entry.
• If the packet does not arrive on the RPF interface, the packet is discarded to prevent loops.

Question 70

PIM uses multicast _____________ between the source and the LHR and between the source and the RP. It also uses multicast ____________ between the RP and the LHRs.

1. shared trees
2. source trees

Answer 70

PIM uses multicast source trees between the source and the LHR and between the source and the RP. It also uses multicast shared trees between the RP and the LHRs. The RPF check is performed differently for each, as follows:

• If a PIM router has an (S,G) entry present in the multicast routing table (an SPT state), the router performs the RPF check against the IP address of the source for the multicast packet.
• If a PIM router has no explicit source-tree state, this is considered a shared-tree state. The router performs the RPF check on the address of the RP, which is known when members join the group.

Question 71

T/F: In PIM-DM, it is mandatory to choose one or more routers to operate as rendezvous points (RPs).

Answer 71

False.

In PIM-SM, it is mandatory to choose one or more routers to operate as rendezvous points (RPs).

Question 72

T/F: A RP can be either configured statically in each router or learned through a dynamic mechanism.

Answer 72

True.

Question 73

T/F: Pros of statically defining RPs, Rendezvous Points, include fast setup in small evironments. Cons are scalablilty and no dynamic failover if the topology changes.

Answer 73

True.

It is possible to statically configure RP for a multicast group range by configuring the address of the RP on every router in the multicast domain. Configuring static RPs is relatively simple and can be achieved with one or two lines of configuration on each router. If the network does not have many different RPs defined or if the RPs do not change very often, this could be the simplest method for defining RPs. It can also be an attractive option if the network is small.

However, static configuration can increase administrative overhead in a large and complex network. Every router must have the same RP address. This means changing the RP address requires reconfiguring every router. If several RPs are active for different groups, information about which RP is handling which multicast group must be known by all routers.

To ensure this information is complete, multiple configuration commands may be required. If a manually configured RP fails, there is no failover procedure for another router to take over the function performed by the failed RP, and this method by itself does not provide any kind of load splitting.

Question 74

What is Cisco “Auto-RP”? What are some advantages?

Answer 74

Auto-RP is a Cisco proprietary mechanism that automates the distribution of group-to-RP mappings in a PIM network. Auto-RP has the following benefits:

• It is easy to use multiple RPs within a network to serve different group ranges.
• It allows load splitting among different RPs.
• It simplifies RP placement according to the locations of group participants.
• It prevents inconsistent manual static RP configurations that might cause connectivity problems.
• Multiple RPs can be used to serve different group ranges or to serve as backups for each other.
• The Auto-RP mechanism operates using two basic components, candidate RPs (C-RPs) and RP mapping agents (MAs).

Question 75

What is a “Candidate-RP”?

Answer 75

A C-RP is a backup RP, similar to a Backup Designated Router.

A C-RP advertises its willingness to be an RP via RP announcement messages. These messages are sent by default every RP announce interval, which is 60 seconds by default, to the reserved well-known multicast group 224.0.1.39 (Cisco-RP-Announce).

The RP announcements contain the default group range 224.0.0.0/4, the C-RP’s address, and the hold time, which is three times the RP announce interval. If there are multiple C-RPs, the C-RP with the highest IP address is preferred.

Question 76

What are RP Mapping Agents?

Answer 76

RP MAs join group 224.0.1.39 to receive the RP announcements. They store the information contained in the announcements in a group-to-RP mapping cache, along with hold times. If multiple RPs advertise the same group range, the C-RP with the highest IP address is elected.

The RP MAs advertise the RP mappings to another well-known multicast group address, 224.0.1.40 (Cisco-RP-Discovery). These messages are advertised by default every 60 seconds or when changes are detected.

The MA announcements contain the elected RPs and the group-to-RP mappings. All PIM-enabled routers join 224.0.1.40 and store the RP mappings in their private cache.

Question 77

What is the PIM bootstrap router (BSR) mechanism?

Answer 77

The bootstrap router (BSR) mechanism, described in RFC 5059, is a nonproprietary mechanism that provides a fault-tolerant, automated RP discovery and distribution mechanism.

PIM uses the BSR to discover and announce RP set information for each group prefix to all the routers in a PIM domain. This is the same function accomplished by Auto-RP, but the BSR is part of the PIM Version 2 specification. The RP set is a group-to-RP mapping that contains the following components:

• Multicast group range
• RP priority
• RP address
• Hash mask length
• SM/Bidir flag

Generally, BSR messages originate on the BSR, and they are flooded hop-by-hop by intermediate routers. When a bootstrap message is forwarded, it is forwarded out of every PIM-enabled interface that has PIM neighbors (including the one over which the message was received). BSR messages use the all PIM routers address 224.0.0.13 with a TTL of 1.

Question 78

What is SSM?

Answer 78

Source-specific multicast (SSM) is a method of delivering multicast packets in which the only packets that are delivered to a receiver are those originating from a specific source address requested by the receiver.

By so limiting the source, SSM reduces demands on the network and improves security. SSM requires that the receiver specify the source address and explicitly excludes the use of the (*,G) join for all multicast groups in RFC 3376, which is possible only in IPv4’s IGMPv3 and IPv6’s MLDv2.

Question 79

What is BSR in multicast?

Answer 79

Bootstrap: PIM uses the BSR to discover and announce RP-set (rendevous Point set info like (S,G) or (*,G) ) information for each group prefix to all the routers in a PIM domain.

This is the same function performed by Auto-RP, but the BSR is part of the PIM Version 2 specification. The BSR mechanism interoperates with Auto-RP on Cisco routers.

BSR uses two roles:

• Candidate BSR: this is the router that collects information from all available RPs in the network and advertises is throughout the network. It’s function is similar to the mapping agent in AutoRP.
• Candidate RP: these are routers that are advertising themselves who want to become the RP.

Question 80

What is Auto-RP in multicast?

Answer 80

Auto-RP automates the distribution of group-to-rendezvous point (RP) mappings in a PIM network.

To make Auto-RP work, a device must be designated as an RP mapping agent, which receives the RP announcement messages from the RPs and arbitrates conflicts. The RP mapping agent then sends the consistent group-to-RP mappings to all other devices by way of dense mode flooding.

Thus, all routers automatically discover which RP to use for the groups they support. The Internet Assigned Numbers Authority (IANA) has assigned two group addresses, 224.0.1.39 and 224.0.1.40, for Auto-RP.

Question 81

How does a host join a multicast group?

Answer 81

When a host wants to join a multicast group, the host sends one or more unsolicited membership reports (IGMP Joins) for the multicast group it wants to join.

The IGMP join process is the same for IGMPv1 and IGMPv2 hosts. In IGMPv3, the join process for hosts proceeds as follows: When a hosts wants to join a group, it sends an IGMPv3 membership report to 224.0.0.22, the well-known address reserved. by IANA for IGMPv3.

Question 82

T/F: PIM-SM allows the LHR to switch from the shared tree to an SPT for a specific source.

Answer 82

True.

Question 83

What is PIM?

Answer 83

Protocol-Independent Multicast (PIM) is a family of multicast routing protocols for Internet Protocol (IP) networks that provide one-to-many and many-to-many distribution of data over a LAN, WAN or the Internet.

It is termed protocol-independent because PIM does not include its own topology discovery mechanism, but instead uses routing information supplied by other routing protocols. PIM is not dependent on a specific unicast routing protocol; it can make use of any unicast routing protocol in use on the network. PIM does not build its own routing tables. PIM uses the unicast routing table for reverse path forwarding.

There are four variants of PIM:

1. PIM Sparse Mode (PIM-SM) explicitly builds unidirectional shared trees rooted at a rendezvous point (RP) per group, and optionally creates shortest-path trees per source. PIM-SM generally scales fairly well for wide-area usage.[2]
2. PIM Dense Mode (PIM-DM) uses dense multicast routing. It implicitly builds shortest-path trees by flooding multicast traffic domain wide, and then pruning back branches of the tree where no receivers are present. PIM-DM is straightforward to implement but generally has poor scaling properties. The first multicast routing protocol, DVMRP used dense-mode multicast routing.[3] See the PIM Internet Standard RFC 3973.
3. Bidirectional PIM (Bidir-PIM) explicitly builds shared bi-directional trees. It never builds a shortest path tree, so may have longer end-to-end delays than PIM-SM, but scales well because it needs no source-specific state.[1]:70-73 See Bidirectional PIM Internet Standard RFC 5015.
4. PIM Source-Specific Multicast (PIM-SSM) builds trees that are rooted in just one source, offering a more secure and scalable model for a limited number of applications (mostly broadcasting of content). In SSM, an IP datagram is transmitted by a source S to an SSM destination address G, and receivers can receive this datagram by subscribing to channel (S,G). See informational RFC 3569.