wg-multicast - Re: Sapphire worm and multicast
Subject: All things related to multicast
List archive
- From: Marshall Eubanks <>
- To: Don Salvin <>
- Cc: , ,
- Subject: Re: Sapphire worm and multicast
- Date: Mon, 3 Feb 2003 10:10:07 -0500
The worm certainly did generate multicast traffic in the wild, which would be expected to cause something
of a MSDP storm. Prashant at UCSB / Caida said he saw such a storm, I did not here.
Regards
Marshall
On Monday, February 3, 2003, at 09:42 AM, Don Salvin wrote:
I know that here we had problems with certain switch vendor's equipment
that seem to have been nailed by the traffic load presented by the worm.
We have previously observed that said vendor's equipment has problems with
CPU load, probably from IGMP snooping, under some conditions which we have
not had time to track down precisely. The implication is that somehow the
worm generated significant multicast traffic under some undescribed
condition, capable of swamping some switches.
=Don
Marshall Eubanks wrote:
Does anyone know why in detail the Sapphire worm response
created so many "Client ID only" entries on the beacon web view at
http://beaconserver.accessgrid.org:9999/ ,
who actually did this, and whether continuing to do it is a reasonable
response to the worm ?
Note that sites like Montana.edu seem to be totally off the air now.
Regards
Marshall Eubanks
T.M. Eubanks
Multicast Technologies, Inc.
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624 Fax : 703-293-9609
e-mail :
http://www.multicasttech.com
Test your network for multicast :
http://www.multicasttech.com/mt/
Status of Multicast on the Web :
http://www.multicasttech.com/status/index.html
--
-------------------------------------------------------------------
Don Salvin, Lead Network Engineer Voice: 412-624-6418
Computing Services & Systems Development FAX: 412-624-4774
University of Pittsburgh Email:
3943 O'Hara Street, Room B3 http://www.pitt.edu/~dss
Pittsburgh, PA 15260 Textpager:
T.M. Eubanks
Multicast Technologies, Inc.
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624 Fax : 703-293-9609
e-mail :
http://www.multicasttech.com
Test your network for multicast :
http://www.multicasttech.com/mt/
Status of Multicast on the Web :
http://www.multicasttech.com/status/index.html
- Sapphire worm and multicast, Marshall Eubanks, 02/03/2003
- Re: Sapphire worm and multicast, Joel Jaeggli, 02/03/2003
- <Possible follow-up(s)>
- Re: Sapphire worm and multicast, Marshall Eubanks, 02/03/2003
Archive powered by MHonArc 2.6.16.