IGMP snooping is the process of listening to Internet Group Management Protocol

Internet Group Management Protocol

The Internet Group Management Protocol is a communications protocol used by hosts and adjacent routers on IP networks to establish multicast group memberships....

 (IGMP) network traffic. IGMP snooping, as implied by the name, is a feature that allows a network switch

Network switch

A network switch or switching hub is a computer networking device that connects network segments.The term commonly refers to a multi-port network bridge that processes and routes data at the data link layer of the OSI model...

 to listen in on the IGMP conversation between hosts

Host (network)

A network host is a computer connected to a computer network. A network host may offer information resources, services, and applications to users or other nodes on the network. A network host is a network node that is assigned a network layer host address....

 and routers. By listening to these conversations the switch maintains a map of which links need which IP multicast

IP Multicast

IP multicast is a method of sending Internet Protocol datagrams to a group of interested receivers in a single transmission. It is often employed for streaming media applications on the Internet and private networks. The method is the IP-specific version of the general concept of multicast...

 streams. Multicasts may be filtered from the links which do not need them.

Purpose

A switch will, by default, flood

Flooding algorithm

A flooding algorithm is an algorithm for distributing material to every part of a connected network. The name derives from the concept of inundation by a flood....

 multicast traffic to all the ports in a broadcast domain

Broadcast domain

A broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. A broadcast domain can be within the same LAN segment or it can be bridged to other LAN segments....

 (or the VLAN equivalent). Multicast can cause unnecessary load on host devices by requiring them to process packets they have not solicited. When purposefully exploited this is known as one variation of a denial-of-service attack

Denial-of-service attack

A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer resource unavailable to its intended users...

. IGMP snooping is designed to prevent hosts on a local network from receiving traffic for a multicast group they have not explicitly joined. It provides switches with a mechanism to prune multicast traffic from links that do not contain a multicast listener (an IGMP client).

IGMP snooping allows a switch to only forward multicast traffic to the links that have solicited them. Essentially, IGMP snooping is a layer 2 optimization for the layer 3 IGMP. IGMP snooping takes place internally on switches and is not a protocol feature. Snooping is therefore especially useful for bandwidth-intensive IP multicast applications such as IPTV

IPTV

Internet Protocol television is a system through which television services are delivered using the Internet protocol suite over a packet-switched network such as the Internet, instead of being delivered through traditional terrestrial, satellite signal, and cable television formats.IPTV services...

.

Standard status

IGMP snooping, although an important technique, overlaps two standards organizations namely IEEE which standardizes Ethernet switches, and IETF which standardises IP multicast. This means that even today there is no clear owner of this technique. This is why RFC 4541 on IGMP snooping only has the status Informational despite actually being referenced in other standards work such as RFC 4903 as normative.

Proxy reporting

IGMP snooping with proxy reporting or report suppression actively filters IGMP packets in order to reduce load on the multicast router. Joins and leaves heading upstream to the router are filtered so that only the minimal quantity of information is sent. The switch is trying to ensure the router only has a single entry for the group, regardless of how many active listeners there are. If there are two active listeners in a group and the first one leaves, then the switch determines that the router does not need this information since it does not affect the status of the group from the router's point of view. However the next time there is a routine query from the router the switch will forward the reply from the remaining host, to prevent the router from believing there are no active listeners. It follows that in active IGMP snooping, the router will generally only know about the most recently joined member of the group.

IGMP querier

In order for IGMP, and thus IGMP snooping, to function, a multicast router must exist on the network and generate IGMP queries. The tables created for snooping (holding the member ports for each a multicast group) are associated with the querier. Without a querier the tables are not created and snooping will not work. Furthermore IGMP general queries must be unconditionally forwarded by all switches involved in IGMP snooping. Some IGMP snooping implementations include full querier capability. Others are able to proxy and retransmit queries from the multicast router.