PIM-SM (RFC 7761): shared tree (RPT) rooted at the RP vs source tree (SPT); (*,G) vs (S,G) state
Register/Register-Stop: source-side DR encapsulates packets to the RP in unicast; the RP joins the SPT toward the source
SPT switchover: last-hop router learns the source from the first RPT packet and joins (S,G) directly; IOS default threshold = 0 kbps → immediate
mroute flag reading: J (join SPT pending) · T (SPT-bit) · P (pruned) · S/C/L on (*,G) · s (SSM)
ip pim spt-threshold infinity: pin receivers to the RPT — the “keep traffic on the RP path” design lever
SSM as the third option: (S,G) from the first packet, no RP, no switchover event at all — the exchange-style design
Why the transition matters for trading: a brief window where both trees carry the flow (duplicates) or neither does (loss) — on a sequenced market-data feed this is what gap recovery exists for (the market-data practice notes)
1 The Exercise
A market-data channel is distributed with PIM-SM. Receivers join (*,G); the source starts publishing; traffic flows. Explain — and show in the mroute tables — the three phases every packet traverses (register via the RP, delivery down the RPT, switchover to the SPT), then answer the design question quant firms actually face:
Do we let receivers switch to the SPT (default), pin them to the RPT (spt-threshold infinity), or avoid the whole mechanism with SSM?
Receiver joins (*,G) → last-hop router sends a join toward the RP → shared tree built, but no traffic flows yet (the RP doesn’t know the source).
Source starts → source-side DR encapsulates the multicast packets in Register messages (unicast) to the RP → RP decapsulates, delivers down the RPT, and joins the SPT toward the source natively → Register-Stop ends the encapsulation.
Switchover: the last-hop router receives the first RPT packet, learns the source address, and — because the IOS SPT threshold is “traffic exceeds 0 kbps”, i.e. immediately — sends an (S,G) join toward the source. Once SPT traffic arrives, it prunes the flow off the RPT. In the mroute table you can watch the flags do this: (*,G) carries J (SPT pending) before, the (S,G) appears with JT, and the RP’s (*,G) eventually shows P (pruned) for that receiver.
What the transition costs: for a brief moment both trees may carry the flow (receiver sees duplicates) or neither does (loss window). The the multicast failure-modes notes record this as trap #3: with sequenced market data, duplicates are free (arbitrator dedupes) but loss becomes a gap recovery event — TCP replay, added tail latency. That is why the choice of tree is a real design decision, not a trivia answer:
ip pim spt-threshold infinity (on the last-hop router)
Only (*,G); predictable single path via RP; RP placement matters; no (S,G) memory per source
Designs that treat the RP as the traffic anchor (CME-style PIM-SM cores; often paired with Anycast RP — see the protocol fundamentals notes)
SSM
ip pim ssm default + IGMPv3 (S,G) join
Only (S,G) from packet one; no RP, no register, no switchover
Exchange feeds and modern DC designs (the market-data practice notes)
Takeaway: the switchover is not a bug — it is RFC 7761 working as designed — but in a sequenced feed the transition window is a loss/duplicate source you must either accept, design away with infinity, or eliminate with SSM.
3 EVE-NG Lab Design
3.1 Design rationale
Four IOL L3 routers in a triangle: RP (R1), source-edge (R2), last-hop (R3), source host (R4). The R2–R3 link is the point of the exercise: it gives the SPT a shorter path than the RPT, so the switchover visibly changes the incoming interface.
Unicast via OSPF area 0 (all interfaces): R3 reaches the source’s network via R2 (cost 20) rather than via the RP (cost 30), while reaching the RP 1.1.1.1 directly — two genuinely different trees.
Static RP (ip pim rp-address 1.1.1.1 on every router) — the same idiom as the scoping lab; no Auto-RP/BSR noise. RP is R1’s Loopback0 and must have PIM enabled (a classic miss).
The receiver is R3’s Loopback0 with ip igmp join-group 239.1.1.1 (ASM) for Acts 1–3, re-pointed to an SSM (S,G) join for the optional Act 3b.
Group 239.1.1.1 (organization-local range) for the ASM acts; 232.1.1.1 for the SSM act.
! === R1 (RP) ===hostname R1!ip multicast-routing!interface Loopback0 ip address 1.1.1.1 255.255.255.255 ip pim sparse-mode!interface Ethernet0/0 ip address 10.0.12.1 255.255.255.0 ip pim sparse-mode!interface Ethernet0/1 ip address 10.0.13.1 255.255.255.0 ip pim sparse-mode!router ospf 1 network 0.0.0.0 255.255.255.255 area 0!ip pim rp-address 1.1.1.1!end
! === R2 (source edge) ===hostname R2!ip multicast-routing!interface Ethernet0/0 ip address 10.0.12.2 255.255.255.0 ip pim sparse-mode!interface Ethernet0/1 ip address 10.0.23.2 255.255.255.0 ip pim sparse-mode!interface Ethernet0/2 ip address 10.0.100.1 255.255.255.0 ip pim sparse-mode!router ospf 1 network 0.0.0.0 255.255.255.255 area 0!ip pim rp-address 1.1.1.1!end
! === R3 (last hop / receiver) ===hostname R3!ip multicast-routing!interface Loopback0 ip address 3.3.3.3 255.255.255.255 ip pim sparse-mode ip igmp join-group 239.1.1.1!interface Ethernet0/0 ip address 10.0.13.3 255.255.255.0 ip pim sparse-mode!interface Ethernet0/1 ip address 10.0.23.3 255.255.255.0 ip pim sparse-mode!router ospf 1 network 0.0.0.0 255.255.255.255 area 0!ip pim rp-address 1.1.1.1!end
! === R4 (source, host-style) ===hostname R4!interface Ethernet0/0 ip address 10.0.100.100 255.255.255.0 no shutdown!end
Act 3 adds one line to R3: ip pim spt-threshold infinity. Act 3b (optional SSM): ip pim ssm default on R1–R3 and R3’s Loopback0 becomes ip igmp version 3 + ip igmp join-group 232.1.1.1 source 10.0.100.100 (remove the 239 join).
5 Lab Procedure and Verification
Debugs: debug ip pim on R3 (watch the S-bit Join for the SPT) and on R1 (watch the Register arrive and Register-Stop leave).
Act 1 — Join before the source exists (pure RPT state)
R3 Lo0 joins 239.1.1.1. Source not started yet.
Check
Expected
R3 show ip mroute 239.1.1.1
(*, 239.1.1.1), RP 1.1.1.1, flags: SJ — J = will switch to SPT as soon as traffic shows; Incoming interface: Ethernet0/0 (toward R1/RP)
R1 show ip mroute 239.1.1.1
(*, G) flags: S, OIL includes E0/1 — shared tree, no (S,G) yet
On R3, run show ip mroute 239.1.1.1 twice: immediately (catch the transition) and 30 s later (steady state).
Check
Expected
R1 debug
Register received from R2 (source DR), decapsulated, Register-Stop after RP joins the SPT
R3 right after first packets
(*,G) flags: SJCand new (10.0.100.100, 239.1.1.1) flags: JT — Incoming interface: Ethernet0/1 (the shortcut via R2, not the RPT interface)
R3 steady state
(*,G) with J cleared / (S,G) flags: T; traffic counters increment on the (S,G) line (show ip mroute count)
R2 show ip mroute
Forwarding (S,G) out E0/1 toward R3 — the SPT bypasses the RP entirely
R1 (*,G)
Eventually P in flags — R3 pruned this flow off the RPT
Ping replies
3.3.3.3 answers R4’s pings throughout
The transition artifact: whether you catch lost/duplicate pings in the switchover window is timing luck (it is milliseconds-scale in a lab). What is always verifiable — and what the interview answer needs — is the tree change above: IIF moves from the RP-facing link to the R2-facing link, and show ip mroute count lets you compare packet counts per tree. Note honestly what you observed.
Act 3 — Pin to the RPT
On R3: ip pim spt-threshold infinity, then clear ip mroute * (on R3), restart the pings.
30 s later:
Check
Expected
R3 show ip mroute 239.1.1.1
Only (*, 239.1.1.1) flags: SC — no J, no (S,G): the receiver stays on the shared tree
R3 incoming interface
Stays Ethernet0/0 (via R1/RP) — traffic path now includes the RP on purpose
R2
No (S,G) state for 239.1.1.1 — proof the shortcut is unused
Design reading: with infinity the RP is a permanent traffic anchor — which is why this design is paired with RP redundancy (Anycast RP) in production, not a single RP (the protocol fundamentals notes).
Act 3b (optional) — SSM: no RP, no switchover
On R1, R2, R3: ip pim ssm default. On R3 Lo0: remove the 239 join, add ip igmp version 3 and ip igmp join-group 232.1.1.1 source 10.0.100.100. Restart pings from R4 (to 232.1.1.1).
show ip mroute 232.1.1.1 on R3: only(10.0.100.100, 232.1.1.1) flags: sT exists from the first packet — no (*,G), no register, no transition. This is the exchange-style subscription model from Lab 2.
6 Troubleshooting Notes
Symptom
Check
Likely cause
Receiver gets nothing even before switchover
show ip pim rp mapping on R3
RP address missing/wrong on the last-hop router — static RP must exist on every router
(*,G) built but traffic never arrives
Is the source sending? debug ip pim on R1
No Register → source DR has no PIM to the RP, or RP’s Lo0 lacks ip pim sparse-mode
(S,G) never appears on R3
show ip mroute count; is J flag set?
No traffic reached R3 through the RPT, so the source was never learned
R3 has (S,G) but IIF is the RP-facing link
show ip rpf 10.0.100.100 on R3
OSPF metric made the RP path shortest — the “SPT” goes through the RP; add cost or check the shortcut link
Duplicates seen on receivers
Expected briefly during switchover
Both trees carrying the flow — compare show ip mroute count per tree
infinity set but (S,G) still appears
Applied on R3 (the last-hop) router? clear ip mroute * after
Threshold is per last-hop router; stale state needs clearing
Key mechanism: J on the (,G) entry is the switchover waiting to happen; T on the (S,G) entry is the SPT in use; P on the RP’s (,G) is the RPT being abandoned.
7 One-Page Summary
Phase 1 receiver joins (*,G) ──────────► toward RP (no traffic yet)Phase 2 source starts ──► Register (unicast) ──► RP ──► down the RPT to receiverPhase 3 receiver learns S from 1st packet ──► (S,G) join toward source → default: IMMEDIATE (threshold 0 kbps) → IIF moves to the shortcut link → brief dup/loss window → sequenced feed = gap-recovery eventPhase 4 (optional) RPT prune: RP's (*,G) shows PDESIGN LEVERS default : (S,G) + (*,G), shortest path, switchover exists spt-threshold infinity: (*,G) only, RP is the anchor (pair with Anycast RP) SSM (ip pim ssm default + IGMPv3 (S,G) join): (S,G) from packet one — no RP, no switchover
Interview one-liner: “PIM-SM delivers down the shared tree through the RP, then the last-hop router switches to the shortest path at 0 kbps by default — that transition is a duplicate-or-loss window on a sequenced feed, so designs either pin the RPT with spt-threshold infinity (and make the RP redundant) or go SSM and never have a transition.”
Flags to quote cold: J (SPT pending) · T (SPT active) · P (pruned) · s (SSM group).
Cross-references: the multicast failure-modes notes trap #3 · the protocol fundamentals notes (ASM vs SSM, Anycast RP) · the market-data practice notes (gap recovery, arbitration) · Lab 2 (SSM command set) · RFC 7761 §4.5/§4.6.1, RFC 4607.
