Documentation
Replicating IP multicast, encrypted, across the mesh
VIGIL-MESH restores IP multicast as on a LAN: mDNS, SSDP, WS-Discovery, LLMNR, LAN games and business UDP reach every interested member. Subscriptions are detected automatically by a local IGMPv3/MLDv2 querier, traffic is encrypted under sender keys that the relay replicates without reading, a two-stage storm control bounds the throughput, and the link-local TTL 255 arrives intact. DDS discovery stacks, including those of ROS 2, ride on this replicated multicast.
The supported protocols
Multicast and link-local broadcast are not a special case: they cross the VIGIL network as if on a single cable. The protocol families that rely on this broadcast therefore work between distant members exactly as on a local LAN.
- mDNS/Bonjour — printers, Chromecast, AirPlay, file shares, service discovery.
- SSDP/UPnP — TVs, media boxes, home-automation gateways.
- WS-Discovery — ONVIF cameras and devices, network scanners.
- LLMNR and NetBIOS-NS — legacy name resolution on Windows machines.
- LAN games — match and lobby discovery on the local segment.
- Business UDP multicast and broadcast — announcements from PLCs, sensors and proprietary services.
For all of these, a discovery started from one member reaches the other members of the network, wherever they physically sit. The page dedicated to L2 broadcast details the "one network = one logical link" model this behavior relies on.
Automatic subscriptions, zero configuration
You have no multicast group to declare. The agent acts as a local IGMPv3 (IPv4) and MLDv2 (IPv6) querier on each machine's TUN interface. When an application subscribes to a group, the operating system announces it as on any network, and the agent detects it.
These subscriptions are then propagated across the mesh: a broadcast is only replicated to the members actually interested in the group. There is no list of groups to maintain by hand and no per-machine configuration — the system's IP stack does the work, the agent listens to it.
Multicast encryption
Broadcasting in clear text across a shared relay would defeat the point. Each multicast sender owns its own sender key: a 32-byte ChaCha20-Poly1305 symmetric key, specific to that sender and to a given epoch. It is distributed to authorized members through the end-to-end encrypted sessions — never by the relay.
The key rotates on three occasions: when a group member is revoked, when the sender restarts, and at the latest every 24 hours. A member who has left can therefore no longer decrypt subsequent broadcasts.
On the relay side, the multicast group identifier is only an opaque hash (BLAKE2s). The vigie replicates the packet to the right receivers on the strength of this identifier, without knowing which application group it corresponds to and without ever accessing its content.
| Element | What protects it | Who has access |
|---|---|---|
| Sender key | ChaCha20-Poly1305, 32 bytes, rotation on revocation / on restart / within 24 h | The authorized members of the group |
| Group identifier | Opaque BLAKE2s hash | The relay, for routing — without reading the content |
| Packet content | Encrypted end to end | Sender and authorized receivers only |
Storm control
Broadcast is powerful but dangerous: poorly bounded, it degenerates into a broadcast storm. VIGIL applies a two-stage storm control, complemented by safeguards that structurally forbid loops.
- Per sender: a token bucket of 200 packets/s and 512 kbit/s, applied both on send and on fan-out.
- Per network, on the vigie side: a global ceiling of 2,000 replicated packets/s, regardless of the number of senders.
- Never an echo: a receiver never re-emits a broadcast packet it received. No loop can form.
- Strict deduplication on the (group, sender index, epoch, counter) quadruplet: a packet duplicated by the mesh is delivered only once.
A runaway sender is throttled at its source, a whole network stays capped at the vigie, and the absence of re-emission by receivers prevents any loop from taking hold.
Link-local TTL 255 intact
Many link-local protocols protect themselves by requiring a TTL of 255 on reception: if the packet has been routed — and therefore decremented — it is rejected. This is notably the case for strict mDNS stacks. An overlay that routes naively breaks these protocols without warning.
VIGIL treats the network as a single logical link: the link-local TTL is carried end to end without decrement. A packet sent with TTL 255 arrives with TTL 255, and the receiving stack considers it legitimately local — because, from the broadcast point of view, it is.
DDS and ROS 2
DDS middlewares — which ROS 2 relies on through its RMW — natively depend on IP multicast for participant discovery. Since VIGIL replicates this encrypted IP multicast between members, that discovery can work across the mesh without a dedicated application gateway: participants announce themselves and find each other as on a LAN.