| [PIM / MSDP Watch](#pim--msdp-watch) | Diagnostics · L3 | `GET /api/net/pim-watch` |

**NTP**, **ICMP**, **SNMP**, **TLS-cert**, **STP**, **DTP**, **CDP**, **LLDP**, **VTP**, **SMB**, **Relay/Coercion**, **SSH** (regreSSHion/Terrapin), **Telnet**, **RPC/NetLogon** (Zerologon/DCSync/WinRM), **LACP** (LAG hijack), **Link OAM** (802.3ah loopback blackhole), **CFM / Y.1731** (protection-switch forgery), **BFD** (failover manipulation), **PTP** (grandmaster takeover), **SR-MPLS** (label/segment injection), **IPsec/IKE** (D(HE)at / weak-DH / SWEET32 / Aggressive-Mode), **DNS Watch** (KeyTrap / NSEC3 / NXNSAttack / MaginotDNS cache-poisoning / SAD DNS), **Modbus Watch** (PLC writes / Force Listen Only / UMAS / libmodbus framing), **RADIUS Watch** (BlastRADIUS / FreeRADIUS CVEs / RADIUS-EAP auth posture), **EIGRP**, **IS-IS**, **PIM / MSDP** (multicast RP-hijack / Register & SA injection / DR hijack / flood), **FHRP**, OSPF and BGP detectors — plus the cross-protocol **D(HE)at** (CVE-2002-20001) coverage that also names finite-field-DH exposure in TLS and SSH — the vendor CVE guards (**Cisco**, **Juniper**, **Arista**, **Comware**, **MikroTik**, **Aruba** and **Dell** — Dell Guard is a standalone daemon, so the panel runs its offline classifier self-test) — plus the **BGP speaker** (codec/framer/FSM/RIB), the Pathwatch v6 passive tiers (**BGPsec** posture/downgrade, **SR-Policy/BGP-LS**, dual-stack **tap**) and

A **passive** scanner for the **multicast routing control plane** — PIM (Protocol

Independent Multicast) and MSDP. It rides **IP proto 103**, multicast in the clear

(`224.0.0.13` / `ff02::d`) with no authentication beyond optional IPsec AH (RFC 5796),

so an on-segment attacker can bend the whole multicast tree. **Detection-only** — it

never transmits. The engine is vendored at `python/pimwatch.py` (self-contained stdlib;

scapy only on its own live path, which the adapter does not use — it captures via

tcpdump→pcap and feeds frames to `PimWatch.handle_frame`). **88 finding codes**

(37 posture + 51 attack) across the PIM and MSDP planes, and — being a protocol-abuse

engine rather than a version scanner — **no CVEs**.

**Coverage:** PIM-SM (RFC 7761: Hello, Register, Register-Stop, Join/Prune, Assert),

PIM-DM (RFC 3973: Graft/Graft-Ack, State Refresh), BiDir-PIM (RFC 5015: DF election),

PIM-SSM (RFC 4607 range checks), BSR (RFC 5059: Bootstrap, Candidate-RP), RPF-Vector

(RFC 5496), Anycast-RP (RFC 4610), Embedded-RP (RFC 3956), IPsec-AH posture (RFC 5796),

Cisco **Auto-RP** (UDP/496 to 224.0.1.39/.40) and **MSDP** (RFC 3618, TCP/639 SA /

SA-Request / KeepAlive). What it flags:

- **attack** — a forged **Hello** winning the DR election, a rogue **Candidate-RP / BSR**

(becoming everyone's RP → multicast MITM / blackhole), a PIM **Register** or an **MSDP

SA** injected to pull or poison (S,G) state, **Assert** contention, and Hello /

Join-Prune / Graft / SA **floods**. Rate-based attack rules are gated on arming (a

static threshold on an unmeasured fabric is a false-positive generator).

- **posture / structural** — **IPsec-AH protection loss** (a peer that was AH-protected

going cleartext, or an SPI change), **SSM-range violations**, **Embedded-RP / Auto-RP**

anomalies, bad-checksum / truncated / malformed messages, unexpected TTL/hop-limit on

link-local messages, and version anomalies.

**RPF is not on the wire** — it is a router's own decision against its RIB, stated in no

PIM message. pimwatch covers it with three observable heuristics (a Join/Prune naming an

upstream that never sent a Hello → `PMW-060`; sustained Assert contention → `PMW-081`; an

RFC 5496 RPF-Vector pointing outside the learned neighbour/RP set → `PMW-068`) and says

so in the finding text; a RIB cross-check against the BGP/OSPF watchers is out of scope.

**Dual-stack by protocol pairing:** PIM is IPv4 **and** IPv6 (extension-header chains

walked); Auto-RP and MSDP have **no IPv6 form**, and their v6 equivalents — Embedded-RP

and Anycast-RP — are implemented on the PIM side, so the directive is satisfied by the

protocol family rather than a v6 variant that does not exist. The capture BPF is

`(ip proto 103) or (ip and udp port 496) or (ip and tcp port 639) or ip6` — the bare

`ip6` term is load-bearing (a `port`/`proto` primitive cannot walk a v6 extension-header

chain), with the software gate deciding in Python after the walk. On a short **on-demand

scan** the engine learns the neighbours/RP set early in the window and arms partway

through; the standalone daemon uses the full learn window. **API:** `GET /api/net/pim-watch`.

*branch `feature/pim-msdp-igmp-v5`*

- **New passive watcher: PIM / MSDP** — the multicast routing control plane. Covers PIM-SM (RFC 7761), PIM-DM (RFC 3973), BiDir (RFC 5015), SSM (RFC 4607), RP discovery via BSR (RFC 5059) / Cisco Auto-RP (UDP/496) / Embedded-RP (RFC 3956) / Anycast-RP (RFC 4610), and inter-domain MSDP (RFC 3618, TCP/639). Rides IP proto 103, multicast in the clear (`224.0.0.13` / `ff02::d`) with no auth beyond optional IPsec AH. Flags **attack** (forged Hello DR-hijack, rogue Candidate-RP/BSR, PIM Register & MSDP SA injection, Assert contention, Join/Prune/SA floods) and **posture/structural** (IPsec-AH protection loss, SSM-range violations, Embedded-RP/Auto-RP anomalies, bad-checksum/truncated/malformed messages). **88 codes** (37 posture + 51 attack), **no CVEs** (protocol-abuse engine, not a version scanner). RPF (a router-internal RIB decision) is covered by three observable heuristics (`PMW-060`/`PMW-081`/`PMW-068`), never guessed at. Engine vendored verbatim at `python/pimwatch.py` (self-contained stdlib; scapy only on its own live path) + `python/pimwatch_fixtures.py` / `python/pimwatch_selftest.py`; new `do_pim_watch` adapter in `network_diagnostics.py` via a `python/`-on-`sys.path` guard, using the engine's in-capture learn-then-arm (no persisted baseline). Verdicts map attack→`attack`, warn/critical posture→`anomaly` (existing tokens). **Dual-stack by protocol pairing:** PIM is v4+v6 (extension-header chains walked); Auto-RP + MSDP are IPv4-only (their v6 equivalents are Embedded-RP and Anycast-RP, on the PIM side). Route `GET /api/net/pim-watch`; UI card in the L3 tab (count 14→15); new `pim` self-test suite (8 scenarios incl. the vendored engine's own 179-check suite + a Scapy pcap e2e leg). Live-validated in a sealed netns (bad-checksum PIM replay → `PMW-003` off the real tcpdump path).

- **IGMP Watch v5** — the standalone `igmpwatch/` package (invoked `python3 -m igmpwatch`; sibling to the in-app `do_igmp_watch`) updated to v5: restructured pipeline (new `main.py` / `models.py` / `alerting.py`, `alert.py` removed), expanded flood/anomaly/recon/policy/posture detector matrix, and the same three IGMP/MLD CVEs the in-app watcher already detects (`CVE-2019-5608` / `CVE-2025-50681` / `CVE-2026-53275` → `IGMPW-003/001/002`). **No CVE-index change** — `gen_cve_list` gains an `igmpwatch/` → *IGMP / MLD Watch* owner so the package's CVE strings dedupe to the existing owner rather than double-count. Self-test **123/123** (a scapy-version compatibility fix in the harness: v3 report/query builders now carry the `IGMPv3()` base layer that supplies the type byte on current scapy, where a bare `IGMPv3mr(...)` serialized type `0x00`). Docs refreshed at [docs/igmpwatch.md](igmpwatch.md).

- **OSI visibility matrix refreshed** — `web/images/osi/matrix_full.jpg` replaced with the current module set (now including RADIUS at L7 and RIP + PIM/MSDP at L3), and the seven per-layer band crops (`matrix_l1…l7.jpg`) regenerated from it; matrix cache-bust bumped across all 16 references.

- Aggregate `do_routing_selftest` **58 suites**, all green.

interface: eth0 # SPAN/mirror destination NIC (RX-only)

db_path: /var/lib/igmpwatch/igmpwatch.db

log_path: /var/log/igmpwatch/events.jsonl

membership_timeout: 300 # s before an un-refreshed join ages out

learning_period: 180 # s to baseline querier + membership before enforcing

posture:

flag_ssm_version_mismatch: true # IGMPW-P01 / RFC 4604 - pre-v3 membership in SSM range

cve:

flag_invalid_record_type: true # IGMPW-001 / CVE-2025-50681 (7.5) igmpproxy

flag_query_source_overrun: true # IGMPW-002 / CVE-2026-53275 (8.8) Linux MLD UAF

flag_fragmented_membership: true # IGMPW-003 / CVE-2019-5608 (9.8) FreeBSD MLDv2

mld:

enable: true # also decode IPv6 MLD (ICMPv6) alongside IGMP

capture_filter: "" # optional BPF override; empty = auto (ip proto 2 [+ icmp6])

flood:

window: 10 # sliding-window seconds

report_rate: 40 # reports / source / window

leave_rate: 30 # leaves / source / window

query_rate: 8 # queries / source / window

global_rate: 300 # total IGMP msgs / window (segment-wide storm)

flap_transitions: 8 # join<->leave toggles / (host,group) / window

anomaly:

require_router_alert: true # flag v2/v3 queries missing IP Router Alert

require_ttl_1: true # IGMP must be TTL 1 (link-local)

flag_downgrade: true # v1/v2 query after v3 established (SSM bypass)

recon:

scan_distinct_groups: 6 # group-specific queries to N groups...

scan_window: 15 # ...within this many seconds -> scan

alert_nonquerier_query: true # general query from a non-elected querier

policy:

mode: learn # learn | enforce

allow_link_local: true # 224.0.0.0/24 joins (mDNS/LLMNR/etc) are normal

flag_unknown_group: true # first-seen group -> INFO (baseline)

benign_groups: [] # extra always-allowed groups

# groups where ANY unlisted join is alerted, even in learn mode:

sensitive_groups: []

# - 239.100.0.0/24 # e.g. IPTV / market-data / OT feed

allow: [] # host -> permitted groups allowlist

# - mac: "aa:bb:cc:*" # MAC prefix (wildcard) or exact

# groups: ["239.10.0.0/16", "224.0.0.251"]

# - ip: "10.20.30.40"

# groups: ["232.1.0.0/16"]

ssm_source_allow: [] # optional allowed SSM (232/8) source CIDRs

# - 198.51.100.0/24

alerting:

cooldown: 60 # s to suppress duplicate (rule,host,group)

min_severity: LOW # INFO | LOW | MEDIUM | HIGH | CRITICAL

stdout: true

enable: true # sample NIC counters, cross-ref vs joined groups

interval: 5 # s between /sys/class/net/<iface>/statistics reads

mcast_pps: 2000 # received multicast pps over this -> storm (HIGH)

mcast_pps_floor: 150 # multicast pps while NO data groups joined -> flood

members_floor: 1 # "no members" = fewer than this many active data groups

rx_drop_pps: 100 # rx_dropped delta/s over this -> capture loss (MED)

mcast_ratio: 0.9 # multicast fraction of rx over this -> alert (MED)

ratio_min_pps: 500 # only evaluate the ratio above this total rx pps

enable: false

host: "" # switch management IP / hostname

port: 161

version: "2c" # "1" | "2c" | "3"

community: public # v1/v2c

# v3 (used when version: "3"):

v3_user: ""

v3_level: authPriv # noAuthNoPriv | authNoPriv | authPriv

v3_auth_protocol: SHA

v3_auth_key: ""

v3_priv_protocol: AES

v3_priv_key: ""

timeout: 2

retries: 1

interval: 30 # s between polls (heavier than sysfs)

snmp_bin_dir: "" # optional dir holding snmpbulkwalk

iface_mcast_pps: 3000 # per-interface in/out multicast pps -> storm (HIGH)

monitor_ifaces: [] # optional ifName/ifIndex whitelist (empty = all)

cross_reference: true # compare switch group table vs igmpwatch census

cache_capabilities: true # remember which walks each switch answers

capability_ttl: 3600 # s before re-checking a "known empty" group table

capability_strikes: 3 # consecutive empty walks before marking unsupported

flag_unsubscribed_forwarding: true # switch forwards a group we never saw join (HIGH)

flag_census_not_forwarded: false # we saw a join the switch doesn't list (noisier)

# OID overrides for non-standard / L2-only platforms:

# if_name_oid: 1.3.6.1.2.1.31.1.1.1.1

# if_in_mcast_oid: 1.3.6.1.2.1.31.1.1.1.2

# if_out_mcast_oid: 1.3.6.1.2.1.31.1.1.1.4

# group_table_oid: 1.3.6.1.2.1.85.1.2.1.4

__version__ = "1.0.0"