CND (312-38) Network Defense Simulation

In this simulation, you will analyze network protocols associated with multicast routing across multiple domains. You will learn to identify the correct protocol structure to support secure, source-specific traffic flows and mitigate rogue multicast broadcasting.

Network Scenario

An enterprise organization is deploying a secure live corporate training broadcast system that spans multiple Autonomous Systems (AS) across global offices. The network engineering and security teams mandate that the multicast architecture must prevent unauthorized (rogue) sources from injecting traffic into the multicast groups. To achieve this, the design requires a routing protocol that operates between different administrative domains and natively integrates with Source-Specific Multicast (SSM).

Traffic & Logs

[RT-BORDER-GW-01] %PIM-5-NBRCHG: neighbor 10.0.0.2 UP on interface GigabitEthernet0/0/1 [RT-BORDER-GW-01] %PROTO-5-PEER_UP: Peer 192.168.100.1 (AS 65001) state changed to Established [RT-BORDER-GW-01] Multicast Routing Table Extraction: (10.1.1.50, 232.0.0.1), uptime: 01:23:45, flags: S TI Incoming interface: GigabitEthernet0/0/2, RPF nbr 192.168.200.1 Outgoing interface list: GigabitEthernet0/0/1, Forward/Sparse, 01:23:45/00:02:14 [SEC-IDS-01] ALERT: IGMPv3 Report observed. Client requesting strict (S,G) state for 232.0.0.0/8 range.

* PCAP analysis confirms clients are utilizing IGMPv3 to request specific source IPs, dropping any Any-Source Multicast (ASM) attempts.

Question

Which of the following protocols is used for inter-domain multicast routing and natively supports "source-specific multicast" (SSM)?

Defensive Hint: Look at the prefix "inter-domain." OSPF and EIGRP are interior (intra-domain) protocols. DVMRP is also primarily an interior protocol using dense mode. Which option specifically references "Gateway" implying border/inter-domain routing?

Expert Analysis

1. What is happening in the network

The enterprise is distributing multicast traffic across multiple Autonomous Systems. To secure this traffic, clients are using IGMPv3 to request streams from a specific IP address rather than any address transmitting to the group. This requires routers at the border to map these (Source, Group) or (S,G) requests accurately across domain boundaries.

2. Identify attack or behavior

In standard Any-Source Multicast (ASM), any host can send traffic to a multicast IP, leading to potential Denial of Service (DoS) or content hijacking. By enforcing Source-Specific Multicast (SSM), the network drops traffic from unauthorized sources inherently at the routing layer.

3. Why correct answer is correct

A. BGMP (Border Gateway Multicast Protocol) is designed specifically for inter-domain multicast routing. It constructs shared trees between domains and inherently supports the (S,G) state required for SSM, seamlessly preventing rogue multicast injection from outside domains.

4. Why others are wrong

B. DVMRP (Distance Vector Multicast Routing Protocol): This is a legacy, dense-mode intra-domain protocol. It floods the network and prunes back, which is highly inefficient and insecure for inter-domain scale. It does not natively support SSM.
C. OSPF (Open Shortest Path First): This is an intra-domain unicast routing protocol. While MOSPF exists, it is strictly for interior routing, not inter-domain.
D. EIGRP (Enhanced Interior Gateway Routing Protocol): This is a proprietary (now largely open) intra-domain unicast routing protocol. It does not handle inter-domain multicast routing.

5. Defensive action

Configure border routers to strictly enforce IGMPv3 and drop IGMPv2/v1 packets if SSM is the baseline. Implement strict Unicast Reverse Path Forwarding (URPF) to ensure the source IP of the multicast traffic hasn't been spoofed before allowing it into the BGMP routing table.

MINI LESSON: Multicast Security & SSM

Traffic Pattern Recognition: Multicast traffic in the 232.0.0.0/8 range is IANA-reserved specifically for SSM.
Protocol Behavior: SSM bypasses the need for complex Rendezvous Points (RPs) used in sparse-mode ASM, reducing the attack surface of the multicast control plane.
Detection vs Prevention: Relying on firewalls to filter rogue multicast is detection/reaction. Using SSM + BGMP is prevention by design, as the routing plane simply will not build a path for unauthorized sources.

Ready for the real exam?

Sharpen your Blue Team skills with more realistic network scenarios.

Explore more CND simulations