0

I am trying to identify a problem reported by our network admins.

One of CentOS 6.8 server kept sending IGMP report packet on MGMT/OOB interface, following is what I captured using 'tcpdump'

# tcpdump -vvv -i eth0 igmp
    20:48:22.711222 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
        server1 > igmp.mcast.net: igmp v3 report, 1 group record(s) [gaddr 224.0.32.4 to_ex { }]
    20:48:26.653012 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
        server1 > igmp.mcast.net: igmp v3 report, 1 group record(s) [gaddr 224.0.32.4 to_ex { }]
    20:48:52.720071 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
        server1 > igmp.mcast.net: igmp v3 report, 1 group record(s) [gaddr 224.0.32.4 to_in { }]
    20:48:54.091070 IP (tos 0xc0, ttl 1, id 0, offset 0, flags [DF], proto IGMP (2), length 40, options (RA))
        server1 > igmp.mcast.net: igmp v3 report, 1 group record(s) [gaddr 224.0.32.4 to_in { }]

Network admin says a Linux box should not send IGMP report packets but I have no idea how to identify the root cause.

'eth0' is the MGMT interface and no other services in listening on that IP.

Any suggestions?

Thanks

  • As root run ss -ap | grep 224.0.32.4. With a bit of luck this will identify the process that is working with that multicast address. The Network admin is wrong to say a linux box should not send IGMP report packets. Since you say this is the MGMT/OOB interface, can we assume that this has a BMC, and that is what is actually connected to this interface rather than the main cpus? If so then the BMC is almost certainly not running CentOS, and the ss command will not show anything as it is being run on the wrong cpu. – icarus Jan 30 '17 at 4:31
  • @icarus What is BMC? ss -aup4 | grep 224.0.32 did give me a PID. thanks for your advice. – Ask and Learn Jan 30 '17 at 23:33
  • Baseboard management controller - see en.m.wikipedia.org/wiki/… which allows you remote control of the server including power control and remote console access. From the process id you probably can deduce what is doing multicast. – icarus Jan 31 '17 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.