Skip to main content

6. Security Considerations

Under normal network operation, the snooping switch provides the benefit of conserving bandwidth on those segments of the local network where no node has expressed interest in receiving the multicast traffic. In the presence of forged IGMP messages, the benefit of using snooping switches may be reduced or eliminated.

Security considerations for IGMPv3 at the network layer of the protocol stack are described in [IGMPv3]. The introduction of IGMP snooping functionality does not alter the handling of multicast packets by the router as it does not make use of link layer information.

The following changes in behaviour within the local network are relevant:

  1. A forged Query message with a source address lower than the current Querier may cause the snooping switch to forward subsequent membership reports to the wrong network interface. For this reason, IGMP membership reports should be sent to all multicast routers as well as to the current Querier.

  2. A host on the local network may generate Current-State Report messages, causing the switch to incorrectly believe that there are multicast listeners on the same segment as the sender of the forged message. This will result in unrequested multicast packets being forwarded onto the segment between the source and the router. If the router requires that all Multicast Report messages be authenticated as described in Section 9.4 of [IGMPv3], it will discard the forged Report message from the host inside the network in the same way that it would discard one which originates from a remote location. It is worth noting that if the router accepts unauthenticated Reports merely because they arrive on an interface associated with the internal network, then troubleshooting the affected segment will quickly narrow the search for the source of the forged messages.

  3. As described in [IGMPv3], there is little motivation for an attacker to forge membership report messages, since joining a group is typically an unprivileged operation. The sender of a forged membership report will become the sole recipient of the multicast traffic destined to that group. This is in contrast to a shared LAN segment (a hub) or a network without snooping switches, where, while the unwanted traffic is flooded on the segment, all other hosts on the same segment are unable to transmit data.

The worst result of each of these attacks is that it eliminates the performance improvement that snooping was intended to provide; it will not be worse than a network that uses switches without multicast snooping.