I'm trying to sniff all IGMP messages on the local network (for crazy reasons not to be discussed ;-)). I have some questions related to this, as I'm not really an IGMP/routing expert.
Is it even possible? I know I can read IGMP from a raw socket, and I know you can use Wireshark to monitor the IGMP messages that reach your local computer, but what puzzles me is this:
I use a program on another computer (separated from the one running Wireshark by a switch) which will join a multicast address - BUT - it's not always that I even see the Membership report/JOIN in Wireshark. Now does anyone know if it's guaranteed that every IGMP join is spread out on the entire local network? Sometimes I see the join in Wireshark, sometimes I don't.
Assuming all IGMP join messages are always sent to every station on the network, shouldn't it be possible to monitor which stations are members of which multicast groups doing something like this (posix socket c++ code):
int rawSock = ::socket(AF_INET, SOCK_RAW, IPPROTO_IGMP);
uint8_t buf[10*1024];
while(true)
{
ssize_t rval = ::recv(rawSock, buf, sizeof(buf), 0);
iphdr *iph = (iphdr*)buf;
printf("Received %d bytes - protocol %d\n", rval, iph->protocol);
/*do whatever needed to the IGMP message*/
}