Sniffing IGMP messages on the local network

Question

I\'m trying to sniff all IGMP messages on the local network (for crazy reasons not to be discussed ;-)). I have some questions related to this, as I\'m not really an IGMP/routin

Answer 1

Your problem could be this... Every IGMP packet must have an IP TTL=1, that means that IGMP will never cross a routed boundary (such as a vlan).

From RFC 2236 - IGMP Version 2:

   Like ICMP, IGMP is a integral part of IP.  It is required to be
   implemented by all hosts wishing to receive IP multicasts.  IGMP
   messages are encapsulated in IP datagrams, with an IP protocol number
   of 2.  All IGMP messages described in this document are sent with IP
   TTL 1, and contain the IP Router Alert option [RFC 2113] in their IP
   header.

This means you can't be anywhere and see IGMP; you should check to be sure that your IGMP receiver above is on the same IP subnet as the sender. You also might check to see whether your machine is receiving IGMP with tshark or wireshark...