add support for IGMP

Author: GyulyVGC

CHANGELOG.md

@@ -4,6 +4,7 @@ All Sniffnet releases with the relative changes are documented in this file.
 
 ## [UNRELEASED]
 - IPFIX collector capabilities: receive and analyze network traffic from remote devices ([#1270](https://github.com/GyulyVGC/sniffnet/pull/1270) — fixes [#303](https://github.com/GyulyVGC/sniffnet/issues/303))
+- Added support for IGMP connections and messages ([#1301](https://github.com/GyulyVGC/sniffnet/pull/1301) — fixes [#1269](https://github.com/GyulyVGC/sniffnet/issues/1269))
 - Show output file path in Overview page when exporting a PCAP file ([`3f2c42c`](https://github.com/GyulyVGC/sniffnet/pull/1290/commits/3f2c42c70f06d5d29ddad80dde956281c6705511))
 - Fix the app freezing and exhausting memory when importing a PCAP file containing a large time gap between consecutive packets ([`4605ec7`](https://github.com/GyulyVGC/sniffnet/pull/1290/commits/4605ec717bbaf8fa34268805814d5585f084201e))
 - Restrict the PCAP export file to have a valid PCAP extension, so that files of other types can't be overwritten ([`5b4801b`](https://github.com/GyulyVGC/sniffnet/pull/1290/commits/5b4801b438ff1c7968cfac423a8e8585778309a8))

lib/sniffnet-packet-parser/CHANGELOG.md

@@ -2,5 +2,9 @@
 
 All `sniffnet-packet-parser` releases with the relative changes are documented in this file.
 
+## [UNRELEASED]
+### Added
+- IGMP support ([#1301](https://github.com/GyulyVGC/sniffnet/pull/1301))
+
 ## [0.1.0] - 2026-09-02
 - Initial release of `sniffnet-packet-parser`, the network packet parser for Sniffnet

lib/sniffnet-packet-parser/README.md

@@ -10,6 +10,7 @@ Powered by [`etherparse`](https://github.com/JulianSchmid/etherparse).
 - `UDP`
 - `ICMPv4`
 - `ICMPv6`
+- `IGMP`
 - `ARP`
 
 ## Supported link types

lib/sniffnet-packet-parser/src/headers.rs

@@ -1,3 +1,4 @@
+use crate::igmp_type::IgmpType;
 use crate::link_type::LinkType;
 use crate::{ArpType, IcmpType, Protocol};
 use etherparse::{EtherType, LaxPacketHeaders};
@@ -36,6 +37,8 @@ pub struct TransportInfo {
     pub protocol: Protocol,
     /// ICMP message type, if the packet is an ICMP packet.
     pub icmp_type: Option<IcmpType>,
+    /// IGMP message type, if the packet is an IGMP packet.
+    pub igmp_type: Option<IgmpType>,
 }
 
 #[must_use]

lib/sniffnet-packet-parser/src/igmp_type.rs

@@ -0,0 +1,70 @@
+use std::fmt::{Display, Formatter};
+
+#[derive(Copy, Clone, PartialEq, Eq, Hash, Debug)]
+/// The IGMP message type.
+pub enum IgmpType {
+    MembershipQuery,
+    MembershipReportV1,
+    MembershipReportV2,
+    MembershipReportV3,
+    LeaveGroup,
+    Dvmrp,
+    Pim,
+    CiscoTrace,
+    MulticastTracerouteResponse,
+    MulticastTraceroute,
+    MulticastRouterAdvertisement,
+    MulticastRouterSolicitation,
+    MulticastRouterTermination,
+    Unknown,
+}
+
+impl IgmpType {
+    #[must_use]
+    pub(crate) fn from_etherparse(igmp_type: &etherparse::IgmpType) -> IgmpType {
+        match igmp_type {
+            etherparse::IgmpType::MembershipQuery(_)
+            | etherparse::IgmpType::MembershipQueryWithSources(_) => IgmpType::MembershipQuery,
+            etherparse::IgmpType::MembershipReportV1(_) => IgmpType::MembershipReportV1,
+            etherparse::IgmpType::MembershipReportV2(_) => IgmpType::MembershipReportV2,
+            etherparse::IgmpType::MembershipReportV3(_) => IgmpType::MembershipReportV3,
+            etherparse::IgmpType::LeaveGroup(_) => IgmpType::LeaveGroup,
+            etherparse::IgmpType::Unknown(h) => match h.igmp_type {
+                0x13 => IgmpType::Dvmrp,
+                0x14 => IgmpType::Pim,
+                0x15 => IgmpType::CiscoTrace,
+                0x1e => IgmpType::MulticastTracerouteResponse,
+                0x1f => IgmpType::MulticastTraceroute,
+                0x30 => IgmpType::MulticastRouterAdvertisement,
+                0x31 => IgmpType::MulticastRouterSolicitation,
+                0x32 => IgmpType::MulticastRouterTermination,
+                _ => IgmpType::Unknown,
+            },
+        }
+    }
+}
+
+impl Display for IgmpType {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                IgmpType::MembershipQuery => "Membership Query",
+                IgmpType::MembershipReportV1 => "Membership Report v1",
+                IgmpType::MembershipReportV2 => "Membership Report v2",
+                IgmpType::MembershipReportV3 => "Membership Report v3",
+                IgmpType::LeaveGroup => "Leave Group",
+                IgmpType::Dvmrp => "DVMRP",
+                IgmpType::Pim => "PIM v1",
+                IgmpType::CiscoTrace => "Cisco Trace",
+                IgmpType::MulticastTracerouteResponse => "Multicast Traceroute Response",
+                IgmpType::MulticastTraceroute => "Multicast Traceroute",
+                IgmpType::MulticastRouterAdvertisement => "Multicast Router Advertisement",
+                IgmpType::MulticastRouterSolicitation => "Multicast Router Solicitation",
+                IgmpType::MulticastRouterTermination => "Multicast Router Termination",
+                IgmpType::Unknown => "?",
+            }
+        )
+    }
+}

lib/sniffnet-packet-parser/src/lib.rs

@@ -7,6 +7,8 @@ mod headers;
 #[cfg(feature = "full")]
 mod icmp_type;
 #[cfg(feature = "full")]
+mod igmp_type;
+#[cfg(feature = "full")]
 mod link_type;
 #[cfg(feature = "full")]
 mod packet;
@@ -19,6 +21,8 @@ pub use headers::{LinkInfo, NetInfo, TransportInfo};
 #[cfg(feature = "full")]
 pub use icmp_type::{IcmpType, IcmpTypeV4, IcmpTypeV6};
 #[cfg(feature = "full")]
+pub use igmp_type::IgmpType;
+#[cfg(feature = "full")]
 pub use link_type::LinkType;
 #[cfg(feature = "full")]
 pub use packet::ParsedPacket;

lib/sniffnet-packet-parser/src/packet.rs

@@ -5,6 +5,7 @@ use etherparse::{ArpHardwareId, EtherType, LinkHeader, NetHeaders, TransportHead
 use crate::arp_type::ArpType;
 use crate::headers::{LinkInfo, NetInfo, TransportInfo, get_sniffable_headers};
 use crate::icmp_type::{IcmpTypeV4, IcmpTypeV6};
+use crate::igmp_type::IgmpType;
 use crate::link_type::LinkType;
 use crate::protocol::Protocol;
 
@@ -37,6 +38,7 @@ impl ParsedPacket {
                 dst_port: None,
                 protocol: Protocol::Arp,
                 icmp_type: None,
+                igmp_type: None,
             })
         } else {
             analyze_transport_header(headers.transport)
@@ -78,11 +80,10 @@ fn analyze_link_header(link_header: Option<LinkHeader>) -> LinkInfo {
             } else {
                 None
             };
-            let dst_mac = None;
             let bytes = 16;
             LinkInfo {
                 src_mac,
-                dst_mac,
+                dst_mac: None,
                 bytes,
             }
         }
@@ -151,11 +152,11 @@ fn analyze_net_header(network_header: Option<NetHeaders>) -> Option<NetInfo> {
                 _ => return None,
             };
             let bytes = arp_packet.packet_len();
-            let arp_type = ArpType::from_etherparse(arp_packet.operation);
+            let arp_type = Some(ArpType::from_etherparse(arp_packet.operation));
             Some(NetInfo {
                 src_ip,
                 dst_ip,
-                arp_type: Some(arp_type),
+                arp_type,
                 bytes,
             })
         }
@@ -176,6 +177,7 @@ fn analyze_transport_header(transport_header: Option<TransportHeader>) -> Option
                 dst_port,
                 protocol,
                 icmp_type: None,
+                igmp_type: None,
             })
         }
         Some(TransportHeader::Tcp(tcp_header)) => {
@@ -187,36 +189,41 @@ fn analyze_transport_header(transport_header: Option<TransportHeader>) -> Option
                 dst_port,
                 protocol,
                 icmp_type: None,
+                igmp_type: None,
             })
         }
         Some(TransportHeader::Icmpv4(icmpv4_header)) => {
-            let src_port = None;
-            let dst_port = None;
             let protocol = Protocol::Icmpv4;
-            let icmp_type = IcmpTypeV4::from_etherparse(&icmpv4_header.icmp_type);
+            let icmp_type = Some(IcmpTypeV4::from_etherparse(&icmpv4_header.icmp_type));
             Some(TransportInfo {
-                src_port,
-                dst_port,
+                src_port: None,
+                dst_port: None,
                 protocol,
-                icmp_type: Some(icmp_type),
+                icmp_type,
+                igmp_type: None,
             })
         }
         Some(TransportHeader::Icmpv6(icmpv6_header)) => {
-            let src_port = None;
-            let dst_port = None;
             let protocol = Protocol::Icmpv6;
-            let icmp_type = IcmpTypeV6::from_etherparse(&icmpv6_header.icmp_type);
+            let icmp_type = Some(IcmpTypeV6::from_etherparse(&icmpv6_header.icmp_type));
             Some(TransportInfo {
-                src_port,
-                dst_port,
+                src_port: None,
+                dst_port: None,
                 protocol,
-                icmp_type: Some(icmp_type),
+                icmp_type,
+                igmp_type: None,
             })
         }
-        Some(TransportHeader::Igmp(_)) => {
-            #[allow(clippy::match_same_arms)]
-            // TODO!
-            None
+        Some(TransportHeader::Igmp(igmp_header)) => {
+            let protocol = Protocol::Igmp;
+            let igmp_type = Some(IgmpType::from_etherparse(&igmp_header.igmp_type));
+            Some(TransportInfo {
+                src_port: None,
+                dst_port: None,
+                protocol,
+                icmp_type: None,
+                igmp_type,
+            })
         }
         None => None,
     }

src/gui/pages/connection_details_page.rs

@@ -176,8 +176,6 @@ fn col_info<'a>(
         val.traffic_direction,
     ) == TrafficType::Unicast;
     let measure_latency = sniffer.capture_source.supports_latency() && is_unicast;
-    let is_icmp = key.protocol.is_icmp();
-    let is_arp = key.protocol.eq(&Protocol::Arp);
 
     let mut ret_val = Column::new()
         .spacing(10)
@@ -209,7 +207,7 @@ fn col_info<'a>(
         &key.protocol.to_string(),
     ));
 
-    if !is_icmp && !is_arp {
+    if !key.protocol.is_portless() {
         ret_val = ret_val.push(TextType::highlighted_subtitle_with_desc(
             service_translation(language),
             &val.service.to_string(),
@@ -252,12 +250,11 @@ fn col_info<'a>(
         ));
     }
 
-    let messages = if is_icmp {
-        pretty_print_message_types(&val.icmp_types)
-    } else if is_arp {
-        pretty_print_message_types(&val.arp_types)
-    } else {
-        String::new()
+    let messages = match key.protocol {
+        Protocol::Icmpv4 | Protocol::Icmpv6 => pretty_print_message_types(&val.icmp_types),
+        Protocol::Arp => pretty_print_message_types(&val.arp_types),
+        Protocol::Igmp => pretty_print_message_types(&val.igmp_types),
+        _ => String::new(),
     };
 
     if !messages.is_empty() {

src/networking/ipfix/collect.rs

@@ -237,6 +237,7 @@ fn ingest_flow_record(
         mac_addresses,
         None,
         None,
+        None,
         packets,
         bytes,
         ip_blacklist,

src/networking/manage_packets.rs

@@ -18,8 +18,8 @@ use crate::networking::types::service_query::ServiceQuery;
 use crate::networking::types::traffic_direction::TrafficDirection;
 use crate::networking::types::traffic_type::TrafficType;
 use crate::utils::types::timestamp::Timestamp;
-use sniffnet_packet_parser::ArpType;
 use sniffnet_packet_parser::IcmpType;
+use sniffnet_packet_parser::{ArpType, IgmpType};
 use std::time::Instant;
 
 include!(concat!(env!("OUT_DIR"), "/services.rs"));
@@ -76,14 +76,15 @@ pub fn get_service(
 }
 
 /// Function to insert the source and destination of a packet into the map containing the analyzed traffic
-#[allow(clippy::too_many_arguments)]
+#[allow(clippy::too_many_arguments, clippy::similar_names)]
 pub fn modify_or_insert_in_map(
     info_traffic_msg: &mut InfoTraffic,
     key: &AddressPortPair,
     my_interface_addresses: &[Address],
     mac_addresses: (Option<[u8; 6]>, Option<[u8; 6]>),
     icmp_type: Option<IcmpType>,
     arp_type: Option<ArpType>,
+    igmp_type: Option<IgmpType>,
     packets: u128,
     bytes: u128,
     ip_blacklist: &IpBlacklist,
@@ -147,6 +148,14 @@ pub fn modify_or_insert_in_map(
                     .and_modify(|n| *n += 1)
                     .or_insert(1);
             }
+            if key.protocol.eq(&Protocol::Igmp)
+                && let Some(igmp_type) = igmp_type
+            {
+                info.igmp_types
+                    .entry(igmp_type)
+                    .and_modify(|n| *n += 1)
+                    .or_insert(1);
+            }
         })
         .or_insert_with(|| InfoAddressPortPair {
             mac_address1: mac_addresses.0,
@@ -172,6 +181,13 @@ pub fn modify_or_insert_in_map(
             } else {
                 HashMap::new()
             },
+            igmp_types: if key.protocol.eq(&Protocol::Igmp)
+                && let Some(igmp_type) = igmp_type
+            {
+                HashMap::from([(igmp_type, 1)])
+            } else {
+                HashMap::new()
+            },
             is_blacklisted,
             program: Program::NotApplicable,
         });