Methods and Systems of Information Protection, Information Security

EXPERIMENTAL ANALYSIS OF IGMPV2 VULNERABILITIES AND COMPARATIVE EVALUATION OF PROTECTION METHODS ON L2+ SWITCHES FROM DIFFERENT VENDORS

A. A. Kyazimov , A. A. Tereshonok
UDC: 004.056.53 EDN: OVBZHO Published: 01.09.2026 Issue: Vol. 3 No. 011 (2026): Professionalitet, 2026 DOI: 10.24412/3033-9359-2026-011-66-77
Download PDF Article on eLIBRARY.RU

Abstract

This paper describes a laboratory example involving a spoofed IGMP Leave message and discusses ways to protect multicast group membership on Cisco Catalyst 2960, Eltex MES1428, and MikroTik CRS326 switches. It outlines IGMPv2 and IGMP snooping, which maintain subscriber information and direct multicast traffic to selected ports. The article reports approximate client-port removal intervals of two to three seconds for Cisco, less than one second for Eltex, and about ten seconds for MikroTik. These observations concern the stated models and test settings. The main attack and static-entry example concerns the Cisco configuration. Static multicast binding, group-count limits, IGMP access lists, and Last Member Query Interval and Count settings are considered as possible controls. Reported timer combinations illustrate the trade-off between faster membership removal and tolerance of false messages. The illustrated static command and displayed group table contain different multicast addresses, so the displayed result cannot verify that exact command. The authors report uninterrupted delivery during one repeated attempt, but this does not establish universal protection. Operational limitations of static entries and IGMPv3 are discussed rather than independently tested across all platforms. The results support local configuration checks and distinguish observed behavior from proposed protective settings.

Online viewer

References

  1. Fenner W. Internet Group Management Protocol, Version 2 : RFC 2236. — IETF, 1997. — URL: https://datatracker.ietf.org/doc/html/rfc2236 (дата обращения: 15.02.2026).
  2. Способ и устройство передачи трафика с групповой адресацией с множеством линий связи : пат. 2804753 Российская Федерация, МПК H04W 4/06, H04W 72/04 / М. Гань, Д. Лян, И. Ли, Ю. Го, Ю. Ли, Ц. Юй, С. Ян ; патентообладатель Хуавэй Текнолоджиз Ко., Лтд. — № 2022133288 ; заявл. 04.06.2021 ; опубл. 05.10.2023. — 30 с. : ил.
  3. Обзор сетевых атак и методов их предотвращения на канальном уровне / Казанский национальный исследовательский технический университет имени А. Н. Туполева — КАИ. — Казань, 2024. — 6 с.
  4. Christensen M., Kimball K., Solensky F. Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Snooping Switches : RFC 4541. — IETF, 2006. — URL: https://datatracker.ietf.org/doc/html/rfc4541 (дата обращения: 15.02.2026).
  5. Cisco Systems. Configuring IGMP Snooping for Cisco Catalyst 2960 Series Switches [Электронный ресурс]. — URL: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swigmp.html (дата обращения: 16.02.2026).
  6. Eltex. Ethernet Switches MES14xx, MES24xx : Operation Manual, Firmware Version 10.1.8.2 [Электронный ресурс]. — URL: https://eltexalatau.kz/upload/iblock/60f/mes14xx_-mes24xx_user-manual_10.2.1.1.pdf (дата обращения: 10.12.2025).
  7. MikroTik. CRS3xx and CSS3xx Series Manual [Электронный ресурс]. — URL: https://help.mikrotik.com/docs/spaces/SWOS/pages/76415036/CRS3xx+and+CSS3xx+series+Manual (дата обращения: 10.12.2025).
  8. Cain B., Deering S., Kouvelas I., Fenner B., Thyagarajan A. Internet Group Management Protocol, Version 3 : RFC 3376. — IETF, 2002. — URL: https://datatracker.ietf.org/doc/html/rfc3376.

License

Copyright (c) 2026 A. A. Kyazimov, A. A. Tereshonok (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

IGMPv2 IGMP snooping multicast L2+ switches network security attack protection