IGMP Snooping for AV Networks
By VJ Ries · Published 2026-07-12 · Updated 2026-08-01 · 10 min read
IGMP snooping is a switch feature that stops multicast AV traffic (Dante, NDI, AV-over-IP video) from flooding every port. The switch reads the join and leave messages devices send, then forwards each stream only to the ports that asked for it. Snooping needs one device per VLAN acting as the IGMP querier to keep memberships fresh; enable it without a querier and multicast can stop forwarding entirely. The rule: on any VLAN carrying multicast, turn on snooping and exactly one querier. Record which switch owns that role.
What is IGMP snooping?
Multicast is the delivery model behind most networked AV: one sender, many possible receivers, one copy on the wire. Dante audio leans on it. So does NDI in multicast mode, and so does AV-over-IP video. IGMP snooping is a Layer 2 switch feature that watches the IGMP (Internet Group Management Protocol) messages devices use to subscribe to multicast streams, then forwards each stream only to the ports that asked for it. Snooping is the switch being smart about who wants each stream, instead of shouting every stream at everyone.
Why does multicast flood the network without snooping?
A switch forwards unicast by learning which MAC address lives on which port: it reads the source address of every frame and builds a forwarding table.
Multicast breaks that model. A multicast destination address never appears as a source address, so the switch never learns a port for it; faced with a destination it has no entry for, a plain Layer 2 switch does the only safe thing it knows and floods the frame out every port in the VLAN, exactly like broadcast.
For a few small control packets, flooding costs nothing. AV is different. A single lightly compressed video stream can eat a large slice of a gigabit link (check the encoder datasheet for the real bitrate), and flooding sends every stream to every device on the VLAN, including ones that will never decode it. Add a few sources and the network saturates. Endpoints drop. Audio glitches.
How does IGMP snooping stop the flood?
With snooping enabled, the switch stops treating multicast as broadcast and starts reading the IGMP conversation flowing through it. A device that wants a stream sends an IGMP membership report (a join) for that multicast group. When it is done it sends a leave. The switch snoops those messages and builds a second table alongside its MAC table: multicast group mapped to the ports that currently want it.
- Which ports joined which groups, so a stream reaches only its subscribers.
- When a port leaves, so the stream stops going there and frees the bandwidth.
- Where the querier and any multicast router sit, so membership reports flow toward them.
Now multicast behaves like a well-run distribution list: one sender, but only the ports that opted in ever see the stream, which for AV video is the difference between a network that works and one that falls over on the second decoder.
What does the IGMP querier do, and why do you need one?
Snooping only works if the IGMP conversation keeps happening. Membership is soft state: a join is not permanent, so devices re-declare their interest whenever they are asked, and something has to do the asking. That is the querier. It periodically sends an IGMP general query, and every device that still wants a stream answers with a fresh report, keeping the snooping table current.
On a network with a multicast router, the router is the querier by default. Most networks carrying Dante, NDI or AV-over-IP are flat Layer 2 islands with no router, so nothing sends queries on its own. Turn on snooping there with no querier and memberships are never refreshed. They age out. The table empties. Depending on the switch, the multicast either stops reaching subscribers or collapses back to flooding. Enabling snooping without a querier is the most common way AV people break their own network.
Why should there be exactly one querier per VLAN?
IGMP is designed for one active querier per segment. When more than one device can query, they hold an election: the one with the lowest IP address on the VLAN wins and stays active, and the others drop into standby and take over only if the winner goes silent. So configuring two queriers rarely causes a visible fight. The problem is predictability. Let the election sort it out and the winner is whichever device holds the lowest IP, which may not be the switch you would have chosen and can change when addresses change.
Pick one querier per VLAN, ideally the core or most stable box. Give it a deliberate address and record which one it is. Keep it next to your VLAN plan and switch port assignments so the crew works from one map.
Which AV protocols actually need IGMP snooping?
Not every AV network needs snooping, and turning it on where it is not needed just adds a querier to babysit. The deciding question: does this system put real multicast on the wire? Confirm behavior against the manufacturer's current network guide. Defaults change between versions.
| Protocol or system | Multicast use | Snooping and querier |
|---|---|---|
| Dante audio | Unicast by default for audio; multicast for clock (PTP) and any flows you set to multicast | Matters. If snooping is on, a working querier is required or the clock multicast can be pruned. Follow Audinate guidance. |
| NDI | Unicast by default; multicast is an optional mode, plus multicast discovery | Matters only in multicast mode. In unicast NDI, snooping is largely irrelevant to the video path. |
| AV-over-IP video (SDVoE, NVX, SVSI and similar) | Heavily multicast by design, often high bitrate | Essential. This is the category that saturates without snooping. Treat a querier as mandatory. |
| Control and discovery (mDNS, some control buses) | Small multicast and link-local traffic | Usually fine either way; the volume is trivial. Do not let it drive the design. |
Snooping gets less optional the more a system depends on multicast video: a unicast Dante or NDI system can often run with snooping off, but a wall of AV-over-IP decoders cannot, and for protocol-specific rules see Dante network requirements and NDI network design.
How to plan IGMP snooping before you touch a switch
Snooping is a design decision and not a switch-day afterthought: make it on the diagram, where you can see which VLANs carry multicast and which device should own the querier, before anyone is on a ladder.
- Mark which flows are multicast. On the diagram, identify every stream that is genuinely multicast (AV-over-IP video, Dante clock or multicast flows, multicast NDI). A VLAN with none needs no snooping.
- Isolate multicast on its own VLAN where you can. A dedicated AV-over-IP VLAN limits the flood radius before snooping and the blast radius of a querier mistake. Plan it in your VLAN layout.
- Choose one querier per multicast VLAN. Pick the most stable switch (usually the core), plan a deliberate low IP, and label it the querier on the diagram.
- Write down the IPs. A querier election turns on IP address order, so your IP schedule is part of the multicast design.
- Hand the switch tech a documented target: which VLANs, which switch, which addresses. They configure snooping and the querier per the switch manual.
In WireFlow you document all of this on the same drawing as the signal flow: VLANs and IP assignments and switch ports, sitting where the crew already looks. WireFlow does not configure switches or watch live multicast (confirm the running state on the gear). But it keeps the plan in one place, and the port-to-port documentation and crew handoff are built from it.
Where IGMP snooping goes wrong on site
Most multicast disasters trace back to a short list of mistakes, and knowing them turns a mystery outage into a checklist.
- Snooping on, querier missing. The classic. It runs for a few minutes after boot while joins are fresh, then multicast dies as the table ages out. If audio or video drops a minute or two after a clean start, suspect the querier first.
- Querier on the wrong VLAN. A querier only serves the VLAN it lives on. If your multicast rides a VLAN with no querier, snooping there has nothing keeping it alive even when another VLAN is fine.
- A rogue low-IP device winning the election. A switch or device set to query with a lower IP than your intended querier silently takes the role. If multicast changed right after new gear arrived, check who is querying.
- Mixed IGMP versions. Older gear on IGMPv2 alongside IGMPv3 can interact badly on some switches. Keep it consistent where you can, and defer to the switch and device documentation on version settings.
Get the concept right and the configuration is short: on any VLAN carrying multicast, enable snooping and exactly one deterministic querier. Document both. Treat it as preproduction, not a switch-day surprise, and it stops being the thing that takes down your show.
See how it fits the preproduction workflow.
Frequently asked questions
- Do I need IGMP snooping for Dante?
- Only if Dante multicast is actually on the network. Even then, only with a working querier. Many Dante systems run unicast audio and are fine with snooping off on a capable switch. If you enable snooping on a VLAN carrying Dante, provide a querier or the multicast clock can be pruned and devices lose sync. Follow Audinate's current network guidance for your firmware.
- What happens if I enable IGMP snooping without a querier?
- Multicast usually works for a short time after boot, then fails as the membership table ages out with nothing refreshing it; depending on the switch, streams either stop reaching real subscribers or revert to flooding, which is why snooping without a querier is considered worse than leaving snooping off.
- Can I have two IGMP queriers?
- You can. IGMP will elect one active querier per VLAN (the lowest IP wins), with the others on standby. It rarely causes an open conflict, but it makes behavior depend on IP order rather than your intent. Configure one deliberate querier per VLAN. Document which switch holds the role.
- Does IGMP snooping help NDI?
- Only when NDI runs in multicast mode. Standard NDI is unicast and does not stress the network the way multicast video does, so snooping has little effect on the video path. If you switch NDI to multicast, treat snooping and a querier the way you would for any multicast AV; the NDI network design guide covers the specifics.
- Is IGMP snooping a Layer 2 or Layer 3 feature?
- Snooping itself is a Layer 2 function: the switch inspects IGMP messages and prunes multicast per port without routing anything, while the querier role is borrowed from Layer 3 multicast (normally a router job), which is why a flat AV LAN with no router has to nominate a switch to do it.
Document your AV network in WireFlow
VLANs, IPs, PoE, and switch ports live on the same diagram as your signal flow, one source of truth for the whole system.