This wiki has been migrated to https://gitlab.com/wireshark/wireshark/-/wikis/home and is now deprecated. Please use that site instead.
Differences between revisions 3 and 4
Revision 3 as of 2008-04-12 17:51:24
Size: 1250
Editor: localhost
Comment: converted to 1.6 markup
Revision 4 as of 2010-01-20 17:46:20
Size: 2602
Comment:
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
PIM is a multicast routing protocol that runs over an existing unicast infrastructure. PIM provides for both dense and sparse group membership. It is different from other protocols, since it uses an explicit join model for sparse groups. Joining occurs on a shared tree and can switch to a per-source tree. Where bandwidth is plentiful and group membership is dense, overhead can be reduced by flooding data out all links and later pruning exception cases where there are no group members.
Line 4: Line 5:
XXX - add a brief PIM description here PIM-DM uses the underlying unicast routing information base to flood multicast datagrams to all multicast routers. Prune messages are used to prevent future messages from propagating to routers without group membership information.

PIM-SM uses either the underlying unicast routing information base or a separate multicast-capable routing information base. It builds unidirectional shared trees routed at a Rendezvous Point (RP) per group, and optionally creates shortest-path trees per source.
Line 7: Line 10:

XXX - add a brief description of PIM history
 . Network Sorcery's [[http://www.networksorcery.com/enp/protocol/pim.htm|PIM page]] has a lot of information and lists most of the relevant PIM RFC's.
Line 11: Line 13:
Line 15: Line 16:
Line 19: Line 19:

The PIM dissector is (fully functional, partially functional, not existing, ... whatever the current state is). Also add info of additional Wireshark features where appropriate, like special statistics of this protocol.
The PIM dissector is partially functional. Many protocol fields are not yet filterable.
Line 23: Line 22:
Line 27: Line 25:
A sample capture file containing PIM traffic is available on the SampleCaptures page.
Line 28: Line 27:
XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically.  * [[http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=pim-reg.cap|SampleCaptures/pim-reg.cap]]
Line 31: Line 30:
A complete list of PIM display filter fields can be found in the [[http://www.wireshark.org/docs/dfref/p/pim.html|display filter reference]] [[http://www.wireshark.org/docs/dfref/p/pim.html|display filter reference]] . Show only the PIM based traffic:
Line 33: Line 32:
 Show only the PIM based traffic: {{{
 pim }}}
 . {{{
 pim
}}}
Line 37: Line 37:

You cannot directly filter PIM protocols while capturing.
 . To capture all PIM traffic, use the following capture filter:
 {{{
(ip proto 103) or ((ip proto 2) and (ip[20] == 0x14))
}}}
Line 41: Line 43:

 * http://netweb.usc.edu/pim/
 * PIM-DM: [[http://tools.ietf.org/html/rfc3973|RFC 3973]]
 * PIM-SM: [[http://tools.ietf.org/html/rfc4601|RFC 4601]]
 * PIMv1 [[ftp://ftp.usc.edu/pub/csinfo/tech-reports/papers/95-599.ps.Z|specification]] (or as close to one as possible.)
Line 45: Line 48:
The PIM dissector is currently undergoing some changes, primarily to allow many more protocol fields to be filterable. A bugzilla report with the proposed changes will be filed in the near future (hopefully) ...

Protocol Independent Multicast (PIM)

PIM is a multicast routing protocol that runs over an existing unicast infrastructure. PIM provides for both dense and sparse group membership. It is different from other protocols, since it uses an explicit join model for sparse groups. Joining occurs on a shared tree and can switch to a per-source tree. Where bandwidth is plentiful and group membership is dense, overhead can be reduced by flooding data out all links and later pruning exception cases where there are no group members.

PIM-DM uses the underlying unicast routing information base to flood multicast datagrams to all multicast routers. Prune messages are used to prevent future messages from propagating to routers without group membership information.

PIM-SM uses either the underlying unicast routing information base or a separate multicast-capable routing information base. It builds unidirectional shared trees routed at a Rendezvous Point (RP) per group, and optionally creates shortest-path trees per source.

History

  • Network Sorcery's PIM page has a lot of information and lists most of the relevant PIM RFC's.

Protocol dependencies

  • XXX

Example traffic

XXX - Add example traffic here (as plain text or Wireshark screenshot).

Wireshark

The PIM dissector is partially functional. Many protocol fields are not yet filterable.

Preference Settings

There are no PIM specific preference settings.

Example capture file

A sample capture file containing PIM traffic is available on the SampleCaptures page.

Display Filter

display filter reference . Show only the PIM based traffic:

  •  pim

Capture Filter

  • To capture all PIM traffic, use the following capture filter:
    (ip proto 103) or ((ip proto 2) and (ip[20] == 0x14))

Discussion

The PIM dissector is currently undergoing some changes, primarily to allow many more protocol fields to be filterable. A bugzilla report with the proposed changes will be filed in the near future (hopefully) ...

PIM (last edited 2010-01-21 14:29:31 by ChristopherMaynard)