What Is IGMP Snooping?

IGMP snooping is a feature of managed Ethernet switches that limits where multicast traffic goes. A plain switch treats a multicast frame much like a broadcast and sends it out of every port in the VLAN. With snooping enabled, the switch reads the IGMP messages passing through it, builds a table of which ports have a receiver for each multicast group, and forwards each stream only to those ports plus the port towards the multicast router or querier.

The name describes the trick. IGMP is a Layer 3 protocol between hosts and routers, and a Layer 2 switch would normally pass it along without looking. A snooping switch inspects those packets anyway, which is a layer violation by design. The IETF documented how switches should do it in RFC 4541.

The result is that a camera stream, a clock signal or a process data feed reaches the devices that asked for it and nothing else. Links to devices that never joined the group stay free, and small devices such as PLCs and remote I/O are not forced to receive and discard traffic they cannot use.

IGMP, the Internet Group Management Protocol, is how an IPv4 host tells the network which multicast groups it wants to receive. Multicast addresses run from 224.0.0.0 to 239.255.255.255, and a group is simply one of those addresses. One sender transmits a single stream to the group address, and the network copies it to every member, which uses far less bandwidth than sending a separate unicast stream to each receiver.

Hosts send a membership report to join a group. A router or switch acting as the querier sends a general query at regular intervals, by default every 125 seconds, and hosts that still want the group answer. If nobody answers for around 260 seconds, the membership times out. IPv6 does the same job with Multicast Listener Discovery (MLD), so the IPv6 version of this feature is MLD snooping.

Snooping only works while the switch keeps hearing IGMP traffic. Hosts often send a report only when they first join, so without regular queries the switch’s table ages out. Depending on the switch, the stream then either floods every port again or stops reaching receivers that still want it. Either way the symptom looks like an intermittent fault.

On a routed network the multicast router is the querier. On an isolated plant or camera network with no router, enable the IGMP querier function on one managed switch in each VLAN. If several switches are set as queriers, IGMPv2 and IGMPv3 elect the one with the lowest IP address, so the result is predictable. Our explainer on Layer 3 switches vs routers covers which device usually takes the router role.

Multicast is common on plant and security networks, often without anyone choosing it. These are the usual sources.

Most of our industrial PoE switches with management list IGMP snooping, and some state the number of multicast groups supported, for example 1,024, or add MLD snooping for IPv6. A few settings decide whether it behaves well:

We supply managed switches with our camera, vision and control systems, and as standard we set up IGMP snooping, the querier and VLANs to match the multicast traffic before the system ships.