All things related to multicast

> assumption: these floods were in fact result of 
> cnn@nwu
>  session.
> 
> open problem: what shall be a valid threshold (relative or absolute) that
> can distinguish genuine SA's from malicious/erroneous floods? is using
> threshold as a flood-diagnosis mechanism good approach at all?
> 
> observation #1: unlike msdp-storm that was induced by ramen worm, the SA's
> were being generated for multiple sources today. however, all these SA's
> were for the same multicast 
> group--cnn@nwu
>  session.
>
> observation #2: all these SA's were for participant-hosts that were not
> sending data at a rate greater than 4kbps. thus, it seems, all the traffic
> that they were sourcing was control traffic (RTCP??).

yes, it would appear to be so. i didn't realize that the vbrick clients
would become sources (albeit small) on the session. i'm not even sure
what the clients are doing, but we'll definitely be asking vbrick about
it. however, i found them to be handy to track the number of viewers
at any given point in time. (i haven't processed that data fully yet,
but there were approximately ~300 clients at one given point during the day.)