12

I'm using tcpdump to capture multicast packets and had to code up a custom program to join multicast feeds so tcpdump will "see" the packets. Just wondering if netcat or any other applications can perform this function instead?

chriskirk
  • 323
  • 1
  • 3
  • 7

7 Answers7

12

One can use socat to subscribe to groups. This works nicely for both L2 and L3 subscription:

socat STDIO  UDP4-DATAGRAM:239.101.1.68:8889,\
  ip-add-membership=239.0.1.68:10.100.201.1

This will subscribe to group 239.0.1.68 using the interface with address 10.100.201.1. The UDP4-DATAGRAM:239.101.1.68:8889 bit listens for packets on a dummy group and udp port that should not receive any data to prevent socat from also outputting everything to stdout. If, instead, you want to direct the payload to stdout, change that group and port to be actual group and port that you want to subscribe to.

Multiple comma-separated ip-add-membership directives can be specified to subscribe to multiple groups at the same time. When socat exits, it seems to clear out the IGMP subscriptions too.

NeilenMarais
  • 221
  • 2
  • 3
  • When i try to listen for ssdp packages i adapted your command, but get the error: "exactly 2 addresses required (there are 3); use option "-h" for help" `socat STDIO UDP4-DATAGRAM:239.255.255.250:1900, ip-add-membership=239.255.255.250:192.168.2.120` – Marc Apr 26 '22 at 12:03
  • 1
    @Marc -- because you have a space after the comma socat is interpreting the remaining text as another address. – silverjam May 05 '23 at 04:54
11

This answer has been retracted.

u1686_grawity
  • 426,297
  • 64
  • 894
  • 966
  • Running this on an Ubuntu 14.04 box yields the following error message: `"ff02" is invalid lladdr. Error: "ff02" is not a legal ll address.` – Nathan Osman Jun 11 '15 at 18:05
  • 3
    After more digging, it appears that `ip maddr` only works with _link-layer_ multicast addresses and not _protocol-layer_ multicast addresses. – Nathan Osman Jun 11 '15 at 18:35
  • @NathanOsman- Have you ever find way to subscribe protocol-layer multicast addresses? – kit Aug 07 '17 at 09:45
  • 2
    Unfortunately this answer doesn't answer the question as it only works for **link-layer** i.e. MAC addresses. The IPv6 example fails as mentioned in 1st comment, and the IPv4 example fails but quietly (i.e. the group is not joined nor listed by `ip maddr show`) – Pierz Nov 30 '17 at 11:22
2

In addition to socat answer, here is a heavyweight solution - smcroute. This application run as a daemon and can be controlled on the fly:

smcroutectl join eth0 239.1.1.27
smcroutectl leave eth0 239.1.1.27
SergA
  • 316
  • 3
  • 5
1

In FRR's pimd, you can do:

interface vlan2000
 ip address A.B.C.D/24
 ip igmp
 ip igmp join 239.0.110.219
 ip igmp join 239.0.110.220
 ip igmp version 2
yasu
  • 11
  • 1
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Feb 04 '23 at 11:17
0

Use the "Receive" part in https://stackoverflow.com/questions/603852/multicast-in-python, omit the definition of the MCAST_PORT and the line "sock.bind ..." and replace the last line (print ...) with pass. That gives you a program similar to the SOCAT example without reading a dummy port.

Siegfried
  • 1
0

You can use omping for this.

Example: To test multicast traffic between 3 hosts - execute then the same command line on each host:

omping example.org example.com example.net

Omping uses 192.168.178.79 by default but you can tell it to use any other multicast address.

If you snoop IGMP traffic you see the report (join) and leave messages then.

In contrast to socat omping also supports IPv6, in case you want to test MLD instead of IGMP.

maxschlepzig
  • 164
  • 9
0

For future visitors of this thread

Why not use ip addr add ... autojoin? The following works for me to join a multicast ipv4 or ipv6 group:

desktop:~ $ sudo ip addr add ff05:feed:dead:beef:feed:dead:beef:beef dev enp4s0 autojoin
desktop:~ $ # or for ipv4: sudo ip addr add 239.42.42.42/32 dev enp4s0 autojoin
desktop:~ $ # optional check that the address is added:
desktop:~ $ ip addr show
desktop:~ $ # to start listening:
desktop:~ $ netcat -6 -l -k -u -p 9000

On the sender (for ipv6)

pi@blueberry:~ $ echo "Hello multicast" | netcat -w 0 -u ff05:feed:dead:beef:feed:dead:beef:beef 9000
Al_
  • 21
  • 3