monitoring multicasts 2

[jkeeper]

I have been asked to monitor and track multicast and unicast
to find out where these broadcasts are from and going too.

How should I go about this using a sniffer on a heavy switched network?

Jkeeper

 

[Jsteve]

I'm not familiar with the sniffer programs (yet),

but to help a little, all multicast packets
begins with the hex sequence.

01-00-5E-xx-xx-xx

 

[hexn]

Sniffing multicasts isnt a problem, since the switch will forward all multi/broadcasts out all connected ports. But as for how you want to go about organizing the results....cant help you there.

 

[Jsteve]

A little more info that may be able to help you.

On a Lan Segment one router sends out IGMP 'query messsges' to discover who's in what group to address 224.0.0.1(each host)

each host on that segment responds to the IGMP 'query message' with a Report Message stating what multicast each host is a member off to address 224.0.0.2(each router).

If you some how capture report messages you will be able to see which host accessed which multicast group.

 

[jkeeper]

Thanks for all the information given. I have done some research and found lots of good information about what i am
trying to do. Thanks

 

[Henrry]

Hi,jkeeper
can you paste the infomation which you got for the question.So it can help me too.thanks!