Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using tcpdump to capture multicast packets and had to code up a custom program to join multicast feeds so tcpdump will "see" the packets. Just wondering if netcat or any other applications can perform this function instead?

share|improve this question
up vote 7 down vote accepted

You can do this using the ip maddr add command.


ip maddr [ add | del ] MULTIADDR dev STRING 


It attaches/detaches a static link layer multicast address to listen on the interface. Note that it is impossible to join protocol multicast groups statically. This command only manages link layer addresses.

address LLADDRESS (default)
    the link layer multicast address. 
dev NAME
    the device to join/leave this multicast address. 


Example for a wired connection:

ip maddr add ff02::fb dev eth0

Example for a wireless connection:

ip maddr add dev wlan0
share|improve this answer
Running this on an Ubuntu 14.04 box yields the following error message: "ff02" is invalid lladdr. Error: "ff02" is not a legal ll address. – Nathan Osman Jun 11 '15 at 18:05
After more digging, it appears that ip maddr only works with link-layer multicast addresses and not protocol-layer multicast addresses. – Nathan Osman Jun 11 '15 at 18:35

One can use socat to subscribe to groups. This works nicely for both L2 and L3 subscription:


This will subscribe to group using the interface with address The UDP4-DATAGRAM: bit listens for packets on a dummy group and udp port that should not receive any data to prevent socat from also outputting everything to stdout. If, instead, you want to direct the payload to stdout, change that group and port to be actual group and port that you want to subscribe to.

Multiple comma-separated ip-add-membership directives can be specified to subscribe to multiple groups at the same time. When socat exits, it seems to clear out the IGMP subscriptions too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.