All things related to multicast

[Prashant Rajvaidya <>]

hi marshall,

> Anyone else seeing msdp floods ? We are apparently
> getting hit pretty hard.

assumption: these floods were in fact result of 
cnn@nwu
 session.

open problem: what shall be a valid threshold (relative or absolute) that
can distinguish genuine SA's from malicious/erroneous floods? is using
threshold as a flood-diagnosis mechanism good approach at all?

observation #1: unlike msdp-storm that was induced by ramen worm, the SA's
were being generated for multiple sources today. however, all these SA's
were for the same multicast 
group--cnn@nwu
 session.

observation #2: all these SA's were for participant-hosts that were not
sending data at a rate greater than 4kbps. thus, it seems, all the traffic
that they were sourcing was control traffic (RTCP??).

statement: this provides with yet another trick to add to our bag of
goodies for correctly detecting malicious/erroneous floods.

--prashant

 ,_,
(O,O)
(   ) "there is no spoon!"
-"-"-------------------------------------------------------------
Prashant Rajvaidya    |  Department of Computer Science
Ph.D. Grad -- "slave" |  University of California, Santa Barbara
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
tel(O): 805-893-7520 (Networking and Multimedia Systems Lab)
-----------------------------------------------------------------