Skip to Content.
Sympa Menu

wg-multicast - Re: Sapphire worm and multicast

Subject: All things related to multicast

List archive

Re: Sapphire worm and multicast


Chronological Thread 
  • From: Marshall Eubanks <>
  • To: Don Salvin <>
  • Cc: , ,
  • Subject: Re: Sapphire worm and multicast
  • Date: Mon, 3 Feb 2003 10:10:07 -0500

The worm certainly did generate multicast traffic in the wild, which would be expected to cause something
of a MSDP storm. Prashant at UCSB / Caida said he saw such a storm, I did not here.

Regards
Marshall

On Monday, February 3, 2003, at 09:42 AM, Don Salvin wrote:

I know that here we had problems with certain switch vendor's equipment
that seem to have been nailed by the traffic load presented by the worm.
We have previously observed that said vendor's equipment has problems with
CPU load, probably from IGMP snooping, under some conditions which we have
not had time to track down precisely. The implication is that somehow the
worm generated significant multicast traffic under some undescribed
condition, capable of swamping some switches.

=Don

Marshall Eubanks wrote:

Does anyone know why in detail the Sapphire worm response
created so many "Client ID only" entries on the beacon web view at

http://beaconserver.accessgrid.org:9999/ ,

who actually did this, and whether continuing to do it is a reasonable
response to the worm ?

Note that sites like Montana.edu seem to be totally off the air now.

Regards
Marshall Eubanks

T.M. Eubanks
Multicast Technologies, Inc.
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624 Fax : 703-293-9609
e-mail :

http://www.multicasttech.com

Test your network for multicast :
http://www.multicasttech.com/mt/
Status of Multicast on the Web :
http://www.multicasttech.com/status/index.html

--
-------------------------------------------------------------------
Don Salvin, Lead Network Engineer Voice: 412-624-6418
Computing Services & Systems Development FAX: 412-624-4774
University of Pittsburgh Email:

3943 O'Hara Street, Room B3 http://www.pitt.edu/~dss
Pittsburgh, PA 15260 Textpager:





T.M. Eubanks
Multicast Technologies, Inc.
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624 Fax : 703-293-9609
e-mail :

http://www.multicasttech.com

Test your network for multicast :
http://www.multicasttech.com/mt/
Status of Multicast on the Web :
http://www.multicasttech.com/status/index.html




Archive powered by MHonArc 2.6.16.

Top of Page