Methods and Systems of Information Protection, Information Security

EXPERIMENTAL ANALYSIS OF IGMPV2 VULNERABILITIES AND COMPARATIVE EVALUATION OF PROTECTION METHODS ON L2+ SWITCHES FROM DIFFERENT VENDORS

A. A. Kyazimov , A. A. Tereshonok
UDC: 004.056.53 Published: 01.09.2026 Issue: Vol. 3 No. 011 (2026): Professionalitet, 2026 DOI: 10.24412/3033-9359-2026-011-66-77
Download PDF

Abstract

This paper describes a laboratory example involving a spoofed IGMP Leave message and discusses ways to protect multicast group membership on Cisco Catalyst 2960, Eltex MES1428, and MikroTik CRS326 switches. It outlines IGMPv2 and IGMP snooping, which maintain subscriber information and direct multicast traffic to selected ports. The article reports approximate client-port removal intervals of two to three seconds for Cisco, less than one second for Eltex, and about ten seconds for MikroTik. These observations concern the stated models and test settings. The main attack and static-entry example concerns the Cisco configuration. Static multicast binding, group-count limits, IGMP access lists, and Last Member Query Interval and Count settings are considered as possible controls. Reported timer combinations illustrate the trade-off between faster membership removal and tolerance of false messages. The illustrated static command and displayed group table contain different multicast addresses, so the displayed result cannot verify that exact command. The authors report uninterrupted delivery during one repeated attempt, but this does not establish universal protection. Operational limitations of static entries and IGMPv3 are discussed rather than independently tested across all platforms. The results support local configuration checks and distinguish observed behavior from proposed protective settings.

Online viewer

References

  1. Fenner, W. (1997). Internet Group Management Protocol, Version 2 (RFC 2236). Internet Engineering Task Force. https://datatracker.ietf.org/doc/html/rfc2236
  2. Gan, M., Liang, D., Li, Y., Guo, Y., Li, Y., Yu, J., & Yang, S. (2023). Sposob i ustroistvo peredachi trafika s gruppovoi adresatsiei s mnozhestvom linii sviazi [Method and device for transmitting multicast traffic over multiple communication lines] (Patent RU 2804753 C1). Huawei Technologies Co., Ltd.
  3. Kazanskii natsionalnyi issledovatelskii tekhnicheskii universitet imeni A. N. Tupoleva—KAI. (2024). Obzor setevykh atak i metodov ikh predotvrashcheniya na kanalnom urovne [Overview of network attacks and methods of preventing them at the data link layer].
  4. Christensen, M., Kimball, K., & Solensky, F. (2006). Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Snooping Switches (RFC 4541). Internet Engineering Task Force. https://datatracker.ietf.org/doc/html/rfc4541
  5. Cisco Systems. (n.d.). Configuring IGMP Snooping for Cisco Catalyst 2960 Series Switches. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swigmp.html
  6. Eltex. (n.d.). Ethernet Switches MES14xx, MES24xx: Operation Manual, Firmware Version 10.1.8.2. https://eltexalatau.kz/upload/iblock/60f/mes14xx_-mes24xx_user-manual_10.2.1.1.pdf
  7. MikroTik. (n.d.). CRS3xx and CSS3xx Series Manual. https://help.mikrotik.com/docs/spaces/SWOS/pages/76415036/CRS3xx+and+CSS3xx+series+Manual
  8. Cain, B., Deering, S., Kouvelas, I., Fenner, B., & Thyagarajan, A. (2002). Internet Group Management Protocol, Version 3 (RFC 3376). Internet Engineering Task Force. https://datatracker.ietf.org/doc/html/rfc3376

License

Copyright (c) 2026 A. A. Kyazimov, A. A. Tereshonok (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

IGMPv2 IGMP snooping multicast L2+ switches network security attack protection