Troubleshoot multicast

Troubleshooting Strategies
When you troubleshoot multicast networks, it is good to consider the signaling protocol used in the network and packet flow. The signaling protocol is used to setup and tear down the multicast sessions (such as PIM dense mode, PIM sparse mode, and DVMRP), and packet flow is the actual sending, replicating, and receiving of the multicast packets between the source and receiver, based on the forwarding table created by the signaling process.

Check Source Packet Flow
Complete these steps to determine if the source is actually sourcing the packets and inserting the correct packet fields:
Check the interface counters on the host. First, check the interface counters (if you are on a UNIX system, use the netstat command) on the source host to see if it is sending packets. If it is not, check for misconfiguration or bugs in the host stack and application.
Use the show ip igmp groups interface-name command to check the upstream router to see if it received a join membership report at the interface directly connected to source.
Check the TTL value in the application sourcing packets; it should be greater than 1. If the application sends packets with a TTL value less than 1, you should see the traffic dropped at the first upstream router. To verify, use the show ip traffic command and look for an increase in the value of the "bad hop count" counter. Any packet with a TTL value of 1, or less than the TTL threshold set by the interface with the ip multicast ttl-threshold command, is dropped and the "bad hop-count" counter is increased by one. Use the show ip igmp interface interface-name command to see the interface TTL threshold value.
Use the show ip mroute count and show ip mroute active commands to check the first upstream router or switch to see if it sees multicast packets from the source. The command output shows the traffic flow statistics for each (S,G) pair. If you do not observe any traffic, check receiver signaling.
Use the debug ip mpacket command on the nearest upstream router, with the detail or acl argument for granularity. Use this command with caution when there is heavy multicast traffic on the network. Only if necessary, use the debug ip mpacket command on the route. Use the detail argument to show packet headers in the debug output, and access lists to check for traffic from specific sources. Remember that this command can have a serious performance impact on other traffic, so use it with caution.

Check Network Signaling
This is the most complex and important piece of troubleshooting in any network. It depends on the network signaling protocol used, such as PIM sparse mode, PIM dense mode, and DVMRP. We recommend the multi-step approach described in this section.
Troubleshooting PIM Sparse Mode
Complete these steps to troubleshoot PIM sparse mode.
Check that IP multicast routing is enabled on all multicast routers.
Use the show ip pim neighbor command to check the expiration timer and mode to ensure sucessful PIM neighbor establishment, and look for any possible connectivity and timer issues that might inhibit the establishment of PIM neighbors. If necessary, use the ip pim [version] [dense-mode] [sparse-mode] [sparse-dense-mode] interface level subcommand to set the correct mode and version to successfully establish the PIM neighbors.
Use the show ip pim rp mapping command to ensure the correct RP-Group mapping and to check the expiration timer if auto-RP is configured. Use the debug ip pim auto-rp command to help figure out any auto-RP failures. If you do not see any PIM Group-to-RP Mappings, check the Auto-RP configuration, or configure static Group-RP mappings with the ip pim rp-address ip address of RP [access-list] [named-accesslist] [override] command.
Use the show ip rpf ip address of source command to check the RPF failure for the source address. PIM dense mode and PIM sparse mode send Prune messages back to the source if traffic arrives on a non-RPF point-to-point interface. The debug ip pim command helps identify possible reasons for a failure in a PIM network—it compares the typical output with what you see. Use this output to identify the three discrete stages in PIM sparse mode: joining, registering, and SPT-switchover. The show ip mroute command allows you to watch the null entries in the Outgoing Interface lists and pruned entries in the mroute table.
Check Network Packet Flow
Use these commands to check the flow of multicast packets across the network:
multicast trace hop-by-hop using the mtrace command
mstat
ping
show ip mroute count
show ip mroute active
debug ip mpacket
Check Receiver Signaling
Complete these steps to check receiver signaling:
Use the show ip igmp groups command at the first upstream router connected to the receiver to check that the interface has joined the group.
Use the ping command to check the reachability of the host and the first upstream router.
Use the show ip igmp interface command to check the IGMP version of the interface.
Remember that a router configured with IGMP version 1 considers IGMP version 2 packets received from the host as invalid. These IGMP packets do not join the group until the router receives an IGMP version 1 packet from the host.
Use the debug ip igmp command to further troubleshoot receiver signaling.
Check Receiver Packet Flow
Complete these steps to check the receiver packet flow.
Use the netstat command on a UNIX system to check the receiver interface statistics.
Check that the TCP/IP stack was installed and configured properly.
Check that the Multicast receiver client application was installed and configured properly.
Watch for duplicate multicast packets on a multiaccess segment.

show Commands

The commands in this section help you gather useful information when troubleshooting a multicast problem. Refer to the IP Multicast Command Reference Guide for more extensive information on these show commands.
If your show command responses are sluggish, the most probable reason is that router currently performs an IP domain lookup for IP addresses in the show command. You can disable IP domain lookup You can use the the no ip domain-lookup command, under the router global configuration mode, to disable IP domain lookup. This stops the IP domain lookup and increases the show command output speed.

show ip igmp groups

This command shows which multicast groups are directly connected to the router, and which are learned via Internet Group Management Protocol (IGMP). You can use this command to verify that a source or receiver has actually joined the target group on the router interface. The "Last Reporter" column shows only one IGMP host, which indicates that it has sent either an unsolicited IGMP Join or IGMP Report in response to a IGMP Query from the PIM router for that particular group. You should only see one "Last Reporter" per Group Address.
R1# show ip igmp groups
IGMP Connected Group Membership
Group Address Interface Uptime Expires Last Reporter
239.255.0.1 Ethernet1 00:10:54 00:01:10 192.168.9.1
224.0.1.40 Ethernet0 01:36:27 00:02:45 192.168.10.2
224.0.1.40 Ethernet1 01:48:15 never 192.168.9.3

show ip igmp interface

Use this command to display multicast-related information about an interface, and to verify that IGMP is enabled, the correct version is running, the timers, Time To Live (TTL) threshold value, and IGMP querier router are properly set. IGMP does not need to be configured on an interface. It is enabled by default when you configure ip pim dense-modesparse-modesparse-dense-mode .
R1# show ip igmp interface
Ethernet1 is up, line protocol is up
Internet address is 192.168.9.3/24
IGMP is enabled on interface
Current IGMP version is 2
CGMP is disabled on interface
IGMP query interval is 60 seconds
IGMP querier timeout is 120 seconds
IGMP max query response time is 10 seconds
Last member query response interval is 1000 ms
Inbound IGMP access group is not set
IGMP activity: 22 joins, 18 leaves
Multicast routing is enabled on interface
Multicast TTL threshold is 0
Multicast designated router (DR) is 192.168.9.5
IGMP querying router is 192.168.9.3 (this system)
Multicast groups joined (number of users):
224.0.1.40(1)

show ip pim neighbor
Use this command to list the Protocol Independent Multicast (PIM) neighbors discovered by the Cisco IOS® Software.
R1# show ip pim neighbor
PIM Neighbor Table
Neighbor Interface Uptime/Expires Ver DR
Address Prio/Mode
10.10.10.1 Ethernet0/0 02:19:41/00:01:38 v2 1 / DR B S
Details of each field are explained below.
Neighbor Address - Specifies a PIM neighbor's IP address
Interface - An interface where a PIM neighbor was discovered
Uptime - The total uptime of neighbor
Expires - The time before a neighbor is timed out and until next PIM hello is received
Ver - The version of PIM on neighbor's interface
DR Prio - The possible values are 0 to 4294967294 or "N"
This is a new column which tracks the priority of a PIM interface for DR election. The feature to configure a DR based on highest priority versus highest IP address was introduced in Cisco IOS versions 12.1(2)T and 12.2 and Cisco IOS images with Bidir-PIM. You can use the ip pim dr-priority <0-4294967294> interface command to set the DR priority. The default DR priority is set to 1. For interoperability, if a PIM neighbor is running an older Cisco IOS version which does not support the DR priority feature, the "DR Prior" column shows as "N". If the neighbor is the only router showing "N" for the interface, it becomes the DR regardless of which router actually has the highest IP address. If there are serveral PIM neighbors with "N" listed under this column, the tie breaker is the highest IP address among them.
Mode - Information regarding the DR and other PIM capabilities.
This column lists the DR in addition to any capabilities supported by the PIM neighbor:
DR - The PIM neighbor is Designated Router
B - Bidirectional PIM (Bidir-PIM) capable
S - State refresh capable (applies only for dense mode)
When you troubleshoot, use this command to verify that all neighbors are up and that they use the proper mode, version, and expiration timer. You can also check the router configuration, or use the show ip pim interface command to verify the mode (PIM sparse or dense mode). Use the debug ip pim command to observe the pim-query message exchange.
show ip pim interface
Use this command to display information about interfaces configured for PIM. In addition, you can use this command to verify that the correct PIM mode (dense or sparse) is configured on the interface, the neighbor count is correct, and the designated router (DR) is correct (which is critical for PIM sparse mode). Multi-access segments (such as Ethernet, Token Ring, FDDI) elect a DR based on highest IP address. Point-to-Point links do not display DR information.
R1# show ip pim interface
Address Interface Version/Mode Nbr Query DR
Count Intvl
192.168.10.1 Ethernet0 v2/Sparse-Dense 1 30 192.168.10.2
192.168.9.3 Ethernet1 v2/Sparse-Dense 1 30 192.168.9.5

show ip mroute summary
Use this command to display the summarized contents of the IP multicast routing table. You can also use it to verify the active multicast group(s) and which multicast senders are active by looking at the timers and flags.
R1## show ip mroute summary
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned
R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT
M - MSDP created entry, X - Proxy Join Timer Running
A - Advertised via MSDP
Outgoing interface flags: H - Hardware switched
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 239.255.0.1), 01:57:07/00:02:59, RP 192.168.7.2, flags: SJCF
(133.33.33.32, 239.255.0.1), 01:56:23/00:02:59, flags: CJT
(192.168.9.1, 239.255.0.1), 01:57:07/00:03:27, flags: CFT
(*, 224.0.1.40), 1d00h/00:00:00, RP 192.168.7.2, flags: SJPCL
show ip mroute
Use this command to display the full contents of the IP multicast routing table. When you troubleshoot, use this command to verify:
The (S,G) and (*,G) state entries from the flags.
The incoming interface is correct. If it is not, check the unicast routing table.
The outgoing interface(s) is correct. If it is incorrectly pruned, check the state in the downstream router.
R1# show ip mroute
IP Multicast Routing Table
Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned
R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT
M - MSDP created entry, X - Proxy Join Timer Running
A - Advertised via MSDP
Outgoing interface flags: H - Hardware switched
Timers: Uptime/Expires
Interface state: Interface, Next-Hop or VCD, State/Mode
(*, 239.255.0.1), 01:55:27/00:02:59, RP 192.168.7.2, flags: SJCF
Incoming interface: Ethernet0, RPF nbr 192.168.10.2
Outgoing interface list:
Ethernet1, Forward/Sparse, 01:55:27/00:02:52
(133.33.33.32, 239.255.0.1), 01:54:43/00:02:59, flags: CJT
Incoming interface: Ethernet0, RPF nbr 192.168.10.2
Outgoing interface list:
Ethernet1, Forward/Sparse, 01:54:43/00:02:52
(192.168.9.1, 239.255.0.1), 01:55:30/00:03:26, flags: CFT
Incoming interface: Ethernet1, RPF nbr 0.0.0.0
Outgoing interface list:
Ethernet0, Forward/Sparse, 01:55:30/00:03:12
(*, 224.0.1.40), 1d00h/00:00:00, RP 192.168.7.2, flags: SJPCL
Incoming interface: Ethernet0, RPF nbr 192.168.10.2
Outgoing interface list: Null
show ip mroute active
Use this command to display the active traffic sources and groups above the threshold. When you troubleshoot, use it to verify active source groups, the traffic rate for each source group (S,G) pair (you must have switched to Shortest Path Tree (SPT)), and to check if the target group multicast traffic is being received. If the traffic is not being received, look for active traffic starting from the source towards the receiver.
R1# show ip mroute active
Active IP Multicast Sources - sending >= 4 kbps
Group: 239.255.0.1, (?)
Source: 133.33.33.32 (?)
Rate: 10 pps/115 kbps(1sec), 235 kbps(last 23 secs), 87 kbps(life avg)
show ip rpf
Use this command to display how IP multicast routing does Reverse Path Forwarding (RPF). When you troubleshoot, use it to verify that the RPF information is correct. If it is not, check the unicast routing table for the source address. Also use the ping and trace commands on the source address to verify that unicast routing works. You may need to use Distance Vector Multicast Routing Protocol (DVMRP) routes or static mroutes to fix any unicast-multicast inconsistencies.
R1# show ip rpf 133.33.33.32
RPF information for ? (133.33.33.32)
RPF interface: Ethernet0
RPF neighbor: ? (192.168.10.2)
RPF route/mask: 133.33.0.0/16
RPF type: unicast (eigrp 1)
RPF recursion count: 0
Doing distance-preferred lookups across tables
show ip mcache
This command can verify the IP multicast fast switching cache and debug fast switching bugs.
R1# show ip mcache
IP Multicast Fast-Switching Cache
(133.33.33.32/32, 239.255.0.1), Ethernet0, Last used: 00:00:00
Ethernet1 MAC Header: 01005E7F000100000C13DBA90800
(192.168.9.1/32, 239.255.0.1), Ethernet1, Last used: 00:00:00
Ethernet0 MAC Header: 01005E7F000100000C13DBA80800
show ip mroute count
Use this command to verify that multicast traffic is received and to check on its flow rates and drops. If no traffic is received, work from the source to the receiver until you find where the traffic stops. You can also use this command to verify that traffic is being forwarded. If it is not, use the show ip mroute command to look for "Null Outgoing interface list" and RPF failures.
R1# show ip mroute count
IP Multicast Statistics
routes using 2406 bytes of memory
2 groups, 1.00 average sources per group
Forwarding Counts: Pkt Count/Pkts per second/Avg Pkt Size/Kilobits per second
Other counts: Total/RPF failed/Other drops(OIF-null, rate-limit etc)
Group: 239.255.0.1, Source count: 2, Group pkt count: 11709
RP-tree: Forwarding: 3/0/431/0, Other: 3/0/0
Source: 133.33.33.32/32, Forwarding: 11225/6/1401/62, Other: 11225/0/0
Source: 192.168.9.1/32, Forwarding: 481/0/85/0, Other: 490/0/9
Group: 224.0.1.40, Source count: 0, Group pkt count:
show ip route
Use this command to check the unicast routing table and fix the RPF failures in the mroute table.
R2# show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
D 192.168.9.0/24 [90/307200] via 192.168.10.1, 00:59:45, Ethernet0
C 192.168.10.0/24 is directly connected, Ethernet0
D 192.168.4.0/24 [90/11040000] via 192.168.7.1, 23:21:00, Serial0
D 192.168.5.0/24 [90/11023872] via 192.168.7.1, 23:21:02, Serial0
C 192.168.7.0/24 is directly connected, Serial0
D 133.33.0.0/16 [90/2195456] via 192.168.7.1, 1d23h, Serial0
D 192.168.1.0/24 [90/11552000] via 192.168.7.1, 22:41:27, Serial0
show ip pim rp mapping
Use this command to check the RP assignment by multicast group range, and to verify that the source of RP learning (static or auto-RP) and the mapping are correct. If you find an error, check the local router configuration or auto-RP configuration.
R1# show ip pim rp mapping
PIM Group-to-RP Mappings
Group(s) 224.0.1.40/32
RP 192.168.7.2 (?), v1
Info source: local, via Auto-RP
Uptime: 2d00h, expires: never
Group(s): 224.0.0.0/4, Static
RP: 192.168.7.2 (?)

clear ip igmp group
To delete entries from the IGMP cache, use the clear ip igmp group EXEC command. clear ip igmp group [group-name group-address type number]

group-name
(Optional) Name of the multicast group, as defined in the DNS hosts table or with the ip host command.
group-address
(Optional) Address of the multicast group. This is a multicast IP address in four-part, dotted notation.
type number
(Optional) Interface type and number.
clear ip mroute
To delete entries from the IP multicast routing table, use the clear ip mroute EXEC command. clear ip mroute {* group [source]}
*
Deletes all entries from the IP multicast routing table.
group
Can be either one of the following:
· Name of the multicast group, as defined in the DNS hosts table or with the ip host command.
· IP address of the multicast group. This is a multicast IP address in four-part, dotted notation.
source
(Optional) If you specify a group name or address, you can also specify a name or address of a multicast source that is transmitting to the group. A source does not need to be a member of the group.