I am writing testcases for the IGMP and MLD implementation of a network switch. Those testcases run on Raspbian. However, Raspbian seems to regularly send IGMP reports/queries of its own, which interfere with my testcases. How can I disable those packets, either globally or for a given interface?
I have seen this answer, but had no luck in figuring out which process generates the IGMP traffic. I do not have any applications installed that require multicast groups, to the best of my knowledge.
Because I need to send and receive IGMP with Scapy for the testcases, just blocking IGMP in the firewall is not an option.
Here is the traffic in question:
pi@raspberrypi204:~ $ sudo tshark -i any -Y igmp
tshark: Lua: Error during loading:
[string "/usr/share/wireshark/init.lua"]:46: dofile has been disabled due to running Wireshark as superuser. See http://wiki.wireshark.org/CaptureSetup/CapturePrivileges for help in running Wireshark as an unprivileged user.
Running as user "root" and group "root". This could be dangerous.
Capturing on 'any'
[...]
196 62.189350 192.168.178.202 -> 224.0.0.22 IGMPv3 64 Membership Report / Join group 224.0.0.252 for any sources / Join group 224.0.1.12 for any sources
197 62.344484 192.168.178.201 -> 224.0.0.22 IGMPv3 62 Membership Report / Join group 224.0.0.252 for any sources
198 62.356118 192.168.178.201 -> 224.0.0.22 IGMPv3 62 Membership Report / Join group 224.0.0.252 for any sources
199 62.357405 192.168.2.206 -> 224.0.0.22 IGMPv3 62 Membership Report / Join group 224.0.0.251 for any sources
201 62.361857 192.168.178.201 -> 224.0.0.22 IGMPv3 62 Membership Report / Join group 224.0.0.252 for any sources
206 62.384387 192.168.178.201 -> 224.0.0.22 IGMPv3 62 Membership Report / Join group 224.0.0.252 for any sources
[...]
I am using:
pi@raspberrypi204:~ $ lsb_release -a
No LSB modules are available.
Distributor ID: Raspbian
Description: Raspbian GNU/Linux 8.0 (jessie)
Release: 8.0
Codename: jessie
Best Answer
Group
224.0.0.252
is for LLMNR and224.0.0.251
is for mDNS. One guess is that it theavahi-daemon
generating it, you might try uninstalling it to see if the traffic stops.But since you are using this to run tests, I suggest you look for a small VM that you can run, that way you will have a much more control over what is on your testing environment, and it is easy to replicate to another machine without risking running to this kind of problem again.