IGMP
Internet Group Management ProtocolIGMP is the subscription desk for multicast. One-to-many traffic — IPTV, video walls, market-data feeds — should only reach hosts that actually want it. IGMP is how a host tells its router “I want this group”, and how the router knows when nobody is listening any more.
IGMP manages multicast group membership — so a feed reaches only the hosts that asked to join it.
How it works
The router is the querier; hosts only speak up to join or when asked. IGMPv3 adds source filtering — a host can ask for a group from a specific sender and ignore the rest.
What IGMP does, step by step
A host sends a membership report for a multicast address in the 224.0.0.0/4 range it wants to receive.
The router periodically queries the segment; one host per group replies, the rest stay quiet.
A leave message (or simply going silent) tells the router to prune the group off this link.
IGMP snooping lets a switch overhear these reports and forward multicast only to ports that joined.
In cybersecurity
IGMP is unauthenticated and trusts any host on the segment, so on a flat network a single client can distort what multicast every port receives.
A host that joins thousands of groups can exhaust switch and router state — a denial of service.
A forged low-IP querier can take over membership timing and starve real feeds — lock the querier down.
Without IGMP snooping a switch floods multicast to every port — wasteful and a passive eavesdrop risk.
Anyone can join a group and receive its stream; sensitive feeds need SSM plus network access control.
Per-port group limits and IGMP profiles cap how many and which groups a host may ever request.
IGMP never leaves the segment; VLAN boundaries are the natural containment for its blast radius.