...

To track the problem, wait until the Cisco router stops forwarding the traffic, and then check the related state:

1. The PIM Join state inside Cisco
2. The PIM Join state inside XORP
3. The IGMP group state inside XORP.

Yes, unfortunately all of them look good :)

I believe there might be a bug in the Cisco Software. (it's a Catalyst 3750, in the documentation I was able to find what you said about PIM-Snooping and it should support it)

Setup is LAN <-> xorp DR <-> C3750 <-> RP(xorp) <-> Source

The Cisco has attached other LANs, some of them running xorp, others have a bridge between their LAN and the Cisco and thus do not need xorp. (*) So maybe the bug even occurs only because of the mixed setup, where the C3750 has to perform IGMP Snooping on some, while PIM-Snooping on other ports.

The behaviour is weird: -After launching xorp, multicast groups will only be received from the Cisco for about 5 minutes -Crafting an IGMP Join for specific multicast groups will make it send again (that specific group only) for 2 minutes or so

-Also it sends IGMP Queries to xorp, but according to the documentation the IGMP Querier should be automatically disabled due to our setup (e.g. having PIM routers attached)

You could try to run tcpdump on the "xorp DR <-> C3750" and on the "3750 <-> RP(xorp)" links to see whether the control (PIM and IGMP) and data traffic is as expected. The extra IGMP Queries are harmless (modulo the extra traffic if you care about it), but it is important to verify whether the PIM Snooping is working.

Guess we should contact Cisco about this....

Thanks again! -Daniel

(*) Btw, Sammy and Carsten Otto (C-Otto), who told me that you have helped them greatly too so far with a whole bunch of mails, are administrating networks attached to that same C3750 on our campus network :)

It's a small world. :)

Pavlin