What is IGMP Querier?

Understanding IGMP Querier

An IGMP querier is the network device (usually a router, or a Layer 3 switch) elected on a subnet to periodically send IGMP membership queries. Hosts reply with reports indicating which multicast groups they want, letting the device and any IGMP-snooping switches maintain accurate group membership so multicast traffic reaches only interested receivers.

Internet Group Management Protocol operates between hosts and their local multicast router. The querier sends General Membership Queries (every 125 seconds by default in IGMPv2) to the all-hosts address 224.0.0.1; hosts respond with reports, and a host's silence eventually times out its membership. When multiple multicast routers share a segment, the one with the lowest IP address is elected querier. On switched networks, IGMP snooping listens to these query/report exchanges to prune multicast away from ports with no interested hosts, but snooping needs an active querier to function, so switches can run a querier when no router is present.

This matters for both performance and security. Without a querier, snooping has no membership data and many switches fall back to flooding multicast to every port, wasting bandwidth and leaking traffic such as IPTV or financial market-data feeds to unintended hosts, a confidentiality and availability concern. A rogue or misconfigured querier can also disrupt group membership, so hardening guidance recommends defining the querier explicitly and filtering IGMP on untrusted ports.

For example, in an enterprise VLAN carrying a video-surveillance multicast stream, the Layer 3 switch acts as IGMP querier. Cameras and the recording server send IGMPv2 reports for the stream's group; the querier's periodic queries refresh that state, and IGMP snooping forwards the stream only to the recorder's port instead of flooding it to every workstation, containing the feed and conserving link capacity.