We are currently suffering from an IGMPv2 storm on our network on a single VLAN across multiple HP switches. Wireshark records over 2000000 IGMP packets within a few seconds. Unsurprisingly clients are unable to get network access while this is happening. We have roughly 50 WAP's on this VLAN and some client PC's. I'm struggling to tell which WAP / client is causing the issue as the traffic all seems to relate to the clients responding to the IGMP packets. I don't know how to work out which one is causing them to all respond.
A snapshot of the wireshark log is attached. The destination address's appear to be multicast and can be 220.127.116.11, 18.104.22.168 or 22.214.171.124
I've tried physically unplugging switches one by one to try and work out which one has the offending client but I can't get a definitive answer. I assume because packets are moving throughout the network. When I do this the storm will "calm down" but be back within a few hours.
Any help in working out what's going on would be greatly appreciated.