> Source: [sk106858](https://support.checkpoint.com/results/sk/sk106858)

# sk106858 - Security Gateway randomly stops forwarding the IGMP / PIM Sparse Mode multicast traffic

| Property | Value |
|----------|-------|
| Solution ID | sk106858 |
| Date Created | 2015-07-15 |
| Last Modified | 2019-08-20 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Security Gateway / Cluster randomly stops forwarding the IGMP traffic.

* IGMP reports are received from the clients.  

  PIM joins are not sent to PIM Rendezvous Point.  

  Upon sending new IGMP reports, PIM prune messages are sent to both the PIM Rendezvous Point and to the Senders of the stream.

* Disabling and re-enabling the PIM Rendezvous Point resolves the issue.

* PIM and Multicast debug (per [sk92598](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=XXX_XXX)) shows messages like these:

  *MMM DD HH:MM:SS.SSSSSS*` mfc_data_driven_prune: deleting kernel forwarding entry for (230.0.0.1, X.X.X.X)/64 to trigger data driven prune`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` mfc_get_krt_pktcnt: retrieve usage counts for kernel multicast forwarding entry for (230.0.0.1, X.X.X.X)/64`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` task_set_option: task IGMP socket 22 option MulticastDelMfc(46) group 230.0.0.1 source X.X.X.X`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` PIM MRT: join is already a part of j/p listof nbr Y.Y.Y.Y`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` PIM MRT: Added prune to triggered list of nbr Z.Z.Z.Z`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` PIM MRT: sending join/prune(54) to Z.Z.Z.Z on eth2-01.2417 (Z.Z.Z.Z)`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` task_send_packet_iovec: task PIM_IO socket 23 length 54 if_index 24 to 224.0.0.13`  
  `
  PIM SENT Z.Z.Z.Z -> 224.0.0.13 len 34 join/prune: `  
  `
  upstream nbr Z.Z.Z.Z num_groups 1 holdtime 210`  
  `
  group 230.0.0.1/32 num_joins 0 num_prunes 1`  
  `
  prune source X.X.X.W/32 SPARSE `  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` `  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` mfc_del_oif: deleting oif eth2-01.2417 from (230.0.0.1, X.X.X.W)/64`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` mfc_krt: parent IF eth1-02.1016`  
  `
  `*MMM DD HH:MM:SS.SSSSSS*` group 230.0.0.1 source X.X.X.W`

## Cause

1. (Issue 01714924) Multicast traffic times out and does not resume because no PIM null register packets are being sent when Security Gateway is DR for local sender of PIM traffic (PIM null register packets are sent every 60 seconds while PIM traffic is still arriving from local senders).
2. (Issue 01952634) In PIM Sparse Mode, low amount of arriving multicast traffic causes RouteD daemon to crash.
3. (Issue 01946518) In PIM Sparse Mode, low amount of arriving multicast traffic causes the local multicast members to be pruned early.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content