Back to All Scenarios
PASSEDnetwork / igmp_snooping_failure_multicast_flood
IGMP Snooping Failure Causing Multicast Flood
IGMP snooping is disabled on a distribution switch after a firmware upgrade, causing all multicast traffic (video surveillance, IPTV, software distribution) to flood to every port on the VLAN, saturating access links.
Pattern
UNKNOWN
Severity
CRITICAL
Confidence
90%
Remediation
Auto-Heal
Test Results
| Metric | Expected | Actual | Result |
|---|---|---|---|
| Pattern Recognition | UNKNOWN | UNKNOWN | |
| Severity Assessment | CRITICAL | CRITICAL | |
| Incident Correlation | Yes | 21 linked | |
| Cascade Escalation | N/A | No | |
| Remediation | — | Auto-Heal — Corax resolves autonomously |
Scenario Conditions
Distribution switch firmware upgrade disabled IGMP snooping on VLAN 50. Multicast sources: 32 IP cameras (8Mbps each), IPTV (15Mbps). Total multicast: 271Mbps flooding to all 200 access ports. 1Gbps access links saturated by multicast.
Injected Error Messages (2)
IGMP snooping failure on Dist-SW2 VLAN 50 — multicast traffic flooding to all ports after firmware upgrade disabled IGMP snooping, 271Mbps of multicast video now sent to all 200 access ports (was properly constrained to 8 subscriber ports), switch resources consumed by multicast replication, IGMP snooping table empty, multicast group membership tracking non-functional
IP camera multicast flood on VLAN 50 — 32 camera streams (8Mbps each = 256Mbps) now flooding to every port, access switch uplinks saturated with unwanted multicast traffic, end-user workstations receiving all 32 camera streams regardless of IGMP membership, network performance on VLAN 50 severely impacted, multicast flood consuming 25% of 1Gbps access port bandwidth on every connected device
Neural Engine Root Cause Analysis
The distribution switch Dist-SW2 experienced an IGMP snooping configuration failure following a firmware upgrade. The firmware upgrade disabled IGMP snooping on VLAN 50, causing 271Mbps of multicast video traffic that was previously constrained to 8 subscriber ports to flood all 200 access ports. This multicast flooding is overwhelming switch resources through excessive replication and has rendered the switch non-functional, with the IGMP snooping table now empty and multicast group membership tracking completely broken.
Remediation Plan
1. Immediately connect to Dist-SW2 via console or management interface 2. Access VLAN 50 configuration 3. Re-enable IGMP snooping on VLAN 50 using 'ip igmp snooping vlan 50' or equivalent command 4. Verify IGMP snooping table begins populating with multicast group memberships 5. Monitor multicast traffic flow to confirm it's constrained to appropriate subscriber ports 6. Check switch resource utilization returns to normal levels 7. Validate that all 10 correlated incidents resolve as multicast flooding stops 8. Document firmware upgrade impact and update change management procedures
Tested: 2026-03-30Monitors: 2 | Incidents: 2Test ID: cmnckayao083xobqehflk98sm