x440-24p - IPMC Group Table Entries - full

[Michal_Rz]

Hello,
I have problem that apears here kinda often, but not a single one that matches mine.

In logs of X440-24p running on 16.1.3.6 i see from some time:
IPv4 multicast entry not added. Hardware Group Table full.

I have only few vlans on it, and it works as AP access switch. Nothing special.

Some commands that I think might be interesting.
debug hal show ipv4Mc

Total IPMC Cache Entries : 2(IPv4 : 2, IPv6 :0)
Total IPMC Caches with No Group Index : 1(IPv4 : 1, IPv6 :0)
L2 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L3 Mode Caches with No Group Index : 1(IPv4 : 1, IPv6 :0)
IPMC Group Table Entries In-use : 64
IPMC Group Table Entries Max : 64
L2MC Group Table Entries In-use : 0
L2MC Group Table Entries Max : 0
IPMC Forwarding Mode : 1

vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=10.160.35.30 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 394
-> 1

show iproute reserved-entries statistics
|-----In HW Route Table-----| |-------In HW L3 Hash Table------|
# Used Routes # IPv4 Hosts IPv4 IPv4 IPv6 IPv4 IPv6
Slot Type IPv4 IPv6 Local Remote Local Rem. Local MCast MCast
---- --------------- ------- ------ ------ ------ ----- ----- ----- ------ ------
1 X440-24p 0 0 0 0 0 0 0 0 0

show forwarding configuration

L2 and L3 Forwarding table hash algorithm:
Configured hash algorithm: crc32
Current hash algorithm: crc32
L3 Dual-Hash configuration:
Configured setting: on
Current setting: on
Dual-Hash Recursion Level: 3
Hash criteria for IP unicast traffic for L2 load sharing and ECMP route sharing
Sharing criteria: L3_L4
IP multicast:
Group Table Compression: on
Local Network Forwarding: slow-path
Lookup-Key: (*,GroupIP,VlanId)
Switch Settings:
Switching mode: store-and-forward
L2 Protocol:
Fast convergence: on
Fabric Flow Control:
Fabric Flow Control: auto

Any ideas what might fill the IPMC Group Table to the maximum? Or its not the issue?

[Jarek]

Michał

if you don't need mcast traffic on specific port, you can block it at ingress:
configure ports 1 rate-limit flood multicast 0

--
Jarek

[Michal_Rz]

I know that. Its not working very good tho.

[Michal_Rz]

Changed deny-cpu to deny, next refresh policy and next step was clear ipmc fdb group 239.255.255.250 and switch rebooted itself.

At the moment its running on 16.2.1.6 (it was installed previously but not rebooted)

And shows
debug hal show ipv4Mc

Total IPMC Cache Entries : 8(IPv4 : 8, IPv6 :0)
Total IPMC Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L2 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
L3 Mode Caches with No Group Index : 0(IPv4 : 0, IPv6 :0)
IPMC Group Table Entries In-use : 4
IPMC Group Table Entries Max : 5
L2MC Group Table Entries In-use : 0
L2MC Group Table Entries Max : 0
IPMC Forwarding Mode : 1

vrId 2 G=239.2.0.252 S=255.255.255.255 Vid 391 : (HW IPMC 3 l3hash 0 hit 0)
vrId 2 G=239.2.0.252 S=xxx.xxx.xxx.xxx (public IP) Vid 391 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 391
-> 1
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 391 : (HW IPMC 3 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 394 : (HW IPMC 1 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=255.255.255.255 Vid 362 : (HW IPMC 2 l3hash 0 hit 0)
vrId 2 G=239.255.255.250 S=xxx.xxx.xxx.xxx (public IP) Vid 362 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 362
-> 1
vrId 2 G=239.255.255.250 S=xxx.xxx.xxx.xxx (public IP) Vid 391 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 391
-> 1
vrId 2 G=239.255.255.250 S=10.160.38.224 Vid 394 : (HW IPMC -1 l3hash 0 hit 0)
-> Vid 394
-> 1
sh access-list counter
Policy Name Vlan Name Port Direction
Counter Name Packet Count Byte Count
==================================================================
block-multicast * * ingress
LLMNR-deny 0
mDNS-deny 30
sh conf | i block
configure access-list block-multicast any ingress

Gonna do some more testing.

[Michal_Rz]

I have ACL like that on that switch. But action is deny-cpu not simple deny. Will try to block it.

entry deny_LLMNR {
if match all {
ethernet-destination-address 01:00:5e:00:00:fc;
} then {
deny-cpu;
count LLMNR-deny;
}
}
entry deny_mDNS {
if match all {
ethernet-destination-address 01:00:5e:00:00:fb;
} then {
deny-cpu;
count mDNS-deny;
}
}

[OscarK]

Probably this multicast address, 239.255.255.250.
https://gtacknowledge.extremenetworks.com/articles/Q_A/What-is-the-239-255-255-250-traffic-I-see-man...

The X440 does not have much space for multicast entries, if you dont need this IP multicast to be forwarded you can block it using an ACL.