Skip to content

IGMP snooping / spoofing

1. Context & stakes

Manipulate multicast membership (forged join/leave).

Switches use IGMP snooping to forward multicast only to interested ports, but membership reports are unauthenticated: forged joins pull streams to the attacker's port and forged leaves cut delivery to legitimate receivers. In IPTV, market-data and industrial-control networks that ride multicast this is both eavesdropping and targeted DoS. A validating IGMP querier limits it.

2. Theory

IGMP manages IPv4 multicast membership: hosts join/leave, the querier tracks groups, and switches use IGMP snooping to forward multicast only to interested ports. Forged joins make a switch flood a group to the attacker (eavesdrop); forged leaves or a rogue querier disrupt delivery (DoS).

3. Attack (PoC)

netlab-igmp attack --i-own-this-network --iface veth-host
  1. Forge IGMP joins/leaves
  2. Multicast eavesdrop / DoS

4. Detection

netlab-igmp detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • IGMP snooping, querier control

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading