PIM is a multicast routing protocol that runs over an existing unicast infrastructure. PIM provides for both dense and sparse group membership. It is different from other protocols, since it uses an explicit join model for sparse groups. Joining occurs on a shared tree and can switch to a per-source tree. Where bandwidth is plentiful and group membership is dense, overhead can be reduced by flooding data out all links and later pruning exception cases where there are no group members.
PIM-DM uses the underlying unicast routing information base to flood multicast datagrams to all multicast routers. Prune messages are used to prevent future messages from propagating to routers without group membership information.
PIM-SM uses either the underlying unicast routing information base or a separate multicast-capable routing information base. It builds unidirectional shared trees routed at a Rendezvous Point (RP) per group, and optionally creates shortest-path trees per source.
"Protocol Independent Multicast (PIM): Motivation and Architecture" is another paper hosted at USC of relevance here.
XXX - Add example traffic here (as plain text or Wireshark screenshot).
The PIM dissector is partially functional. Many protocol fields are not yet filterable.
There are no PIM specific preference settings.
A sample capture file containing PIM traffic is available on the SampleCaptures page.
display filter reference . Show only the PIM based traffic:
To capture all PIM traffic, use the following capture filter:
(ip proto 103) or ((ip proto 2) and (ip == 0x14))
PIM-DM: RFC 3973
PIM-SM: RFC 4601
PIMv1 specification (or as close to one as possible.)
Network Sorcery's PIM page has a lot of information and lists most of the relevant PIM RFC's.
The PIM dissector is currently undergoing some changes, primarily to allow many more protocol fields to be filterable. A bugzilla report with the proposed changes will be filed in the near future (hopefully) …
Imported from https://wiki.wireshark.org/PIM on 2020-08-11 23:17:56 UTC