I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP subscription.
I am currently getting around this by having a separate application hold the groups open I wish to record, but I am trying to set up a system to start/stop recording data dynamically and this extra complexity is painful.
Is there a way to force Wireshark to send out IGMP Subscriptions for multicast groups it is recording?
Create a custom lua listener and call it from wireshark.
Here is a well documented example:
You can use "ip maddr add" to subscribe to additional groups. That should cause the kernel to respond to IGMP queries and receive traffic for them.
Presumably by "multicast groups it is recording" you mean that you've specified a capture filter asking for particular multicast destination addresses in a "host" keyword; that's the only way Wireshark could limit its packet capture to particular multicast groups.
Wireshark has no mechanism by which it sends out IGMP subscriptions based on the capture filter; it assumes that you have somehow arranged to have all relevant packets sent to the port on which it's capturing, for example by port mirroring/SPAN/whatever your switch vendor calls it on that port, so that the switch sends all packets to that port. If you can't set up port mirroring, or if that will send too many packets to the port on which you're capturing, you'll have to subscribe that port to the appropriate multicast group (as you appear to be doing already).
You can use Ostinato to build, craft and send packets.