Let's switch gears and talk security.
Because IGMP and MLD primarily operate at the edges of the network,
we'll focus there.
I pointed out many of the IGMP packet types in our Wireshark analyses,
and here is where they start to matter.
Let's think about the flows between client and router.
Any layer 2 devices in between, such as switches or transparent firewalls,
should allow traffic to flow as depicted above.
What usually happens first?
The router sends a general query to the clients.
I'll depict right-to-left flows in orange.
IGMP types are referenced as either hex or decimal numbers,
so I include both here.
I'll use blue for left-to-right flows.
Clients reply with membership reports.
I'll show all three versions for completeness,
but in production environments, only permit the versions required.
Personally, I see little reason not to use IGMPv3 everywhere these days.
Don't forget the IGMPv2 leave group message if relevant.
If multicast traceroute is supported,
be sure to permit those requests from the clients or downstream routers.
And, of course, the traceroute response must be allowed back.
Keep in mind the traceroute packets should be
allowed through the entire network, not just between client and router.
Let's quickly recreate a design template for MLD,
keeping in mind the minor differences in formatting types.
I'll use the same colored arrow strategy for consistency.
The router sends an MLD query towards the clients to test
their interest in receiving multicast.
Note that MLD types are always referenced as decimal numbers,
which simplifies things.
Clients reply with membership reports.
I'll show both MLDv1 and v2 variants in their corresponding ICMPv6 types.
Be sure you permit what is necessary and MLDv2 should be
widely supported on all devices by now.
I would recommend using that.
If you are using MLDv1,
be sure to include the done message equivalent to a
leave group message in IGMPv2.
One caveat worth mentioning is that when doing IPv6 security,
don't neglect the IPv6 neighbor discovery messages or
other important link-local traffic.
I briefly spoke about IPv6 neighbor discovery in this course,
which is critical for IPv6 to function.
My ICMP deep dive course explains this in greater detail.
Note I'm omitting the IPv6 mtrace packet types here,
since we did not test it and did not analyze them,
so it would be awkward to suddenly introduce them in this context.
Okay, we've reached the end of the course.
Let me share some final thoughts with all of you.
We've covered three versions of IGMP for IPv4 and 2 versions of MLD for IPv6.
The protocols are more similar than they are different.
When you're dealing with a complex multicast issue,
lean on multicast traceroute to point you in the right direction.
Finally, I want to extend my sincere gratitude to you for viewing this course.
Feel free to contact me on Twitter with any questions you have. Thank you.