Once you've verified that you see the interface subscribed to the correct group fire up your tcpdump command: tcpdump -nnXs 0 -i eth1 udp port 22001 and dst 233.54.12.234Īlternatively, if you don't want to fully go the route of tcpdump (or stumbled upon this answer and are just curious to see multicast in action) you can use socat command above to join and echo the content to STDOUT by replacing /dev/null with STDOUT: socat -u UDP4-RECV:22001,ip-add-membership=233.54.12.234:eth1 If you're feeling super fancy you can go nuts parsing the hex out of /proc/net/igmp, but I'd suggest just running netstat -gn. Once that's done (but before we go nuts testing our tcpdump/ tshark command) make sure that the kernel recognizes the interface having joined the correct IGMP group. The second option doesn't require root, but also expects to run in the foreground and thus may be less conducive to scripting (though tracking the child process ID and cleaning it up with a trap in BASH may be just what you're looking for. The first option will require either root, or at least the capability CAP_NET_ADMIN. Option 1: sudo ip addr add 233.54.12.234/32 dev eth1 autojoin On some number of hosts run one of the following two combinations: Just to test this out we can generate multicast UDP packets with socat or ncat (generally packaged via nmap/ nmap-ncat). In the event that you do not 22001 is a high numbered port and other utilities like socat will also get things done.ĭon't take my word for it though. I assume since you'll be running tcpdump or tshark that you have root permission. This raises some subsequent questions though. That being said using the autojoin flag with the address verb does the trick just nicely. The problem is ip maddress only affects link layer multicast addresses not protocol multicast addresses ( man 8 ip-maddress).

Socat STDIO UDP4-RECV:22001,ip-add-membership=233.54.12.234:eth1 > /dev/nullĪt first I was going to say 'just use ip maddress add and be done with it'.

Tcpdump to get all multicast centos 7