Wireshark can’t capture multicast packet in promiscuous mode without IGMP join

The IGMP report or join is used to indicate to the infrastructure your intent to consume the multicast group. This way, the infrastructure knows to forward the group to your physical interface.

Promiscuous mode allows the network interface on your system to pass up all frames and not provide any type of filter. However, if the infrastructure is not sending them to the interface, promisc mode will not help - they are not there to be passed up.

So you really need both: the infrastructure has to send you the frames, and then they need to be sent up the stack for handling in the packet capture tool.

Now WiFi adds an entirely different level of complexity. Multicast is handled in very different ways by different WiFi systems. For instance: some do a multicast_to_unicast conversion, sometimes; some don't send out multicast at all and they just drop it; some send any multicast received from wireless right back on the wireless side but are selective about wired side; some manage their own IGMP snooping states and only transmit multicast if a host asked for it, and this can be either as true multicast or unicast. If encryption is used, multicast or unicast is important because the encryption keys from WPA2 would be different in the two cases.

On top of this, all multicast sent from a host to the network over WiFi are actually unicast at layer 2 (802.11) destined for the access point so you will only see this traffic if you are in monitor+promisc mode on a wifi capture system.