All things related to multicast

["Marshall Eubanks" <>]

Well, whatever is going on continues this morning.

It doesn't seem to be growing - and I note that AS109 is
Cisco Systems. So I suspect that this is either internal traffic
that is not being filtered, or some new application gone wild.

Regards
Marshall


 Date of MBGP Dump  Sat Oct 18 06:13:05 EDT 2003
 
 There were  8188 SA-Cache Entries      
 There were   171 Duplicate S,G Entries 
 There were  4511 SA-Cache Groups       
 There were  1324 SA-Cache Sources      
 There were   254 SA-Cache RPs          
 There were   162 SA-Cache ASs          
 
 The Most Active Group  is      224.0.1.76 with   120 members 
 The Most Active Source is   144.254.7.161 with   466 groups 
 The Most Active RP     is    64.102.254.9 with  3022 entries 
 The Most Active AS     is             109 with  5272 entries 
 
 There were  3275 Groups with only one Sender      
 
 First Octet Histogram
 
 Octet 224 had   2238 entries or  49.61 % 
 Octet 225 had     23 entries or   0.51 % 
 Octet 226 had     22 entries or   0.49 % 
 Octet 227 had     15 entries or   0.33 % 
 Octet 228 had     22 entries or   0.49 % 
 Octet 229 had     29 entries or   0.64 % 
 Octet 230 had     11 entries or   0.24 % 
 Octet 231 had     10 entries or   0.22 % 
 Octet 233 had   1967 entries or  43.60 % 
 Octet 234 had    118 entries or   2.62 % 
 Octet 235 had      8 entries or   0.18 % 
 Octet 236 had     25 entries or   0.55 % 
 Octet 237 had      9 entries or   0.20 % 
 Octet 238 had     14 entries or   0.31 % 
 



On Fri, 17 Oct 2003 22:58:42 -0700 (PDT)
 

 wrote:
> 
> Nice stats!! 
> 
> My vote is storm - AS109. Its sending SAs in mass outside its GLOP space.
> 
> Greg
> 
> On Fri, 17 Oct 2003, Marshall Eubanks wrote:
> 
> > Hello;
> > 
> > There seems to be either a lot of MSDP use or an MSDP storm
> > in progress. Since about 1800 EDT on Wednesday, the number
> > of MSDP sources has more than doubled.
> > 
> > Before the storm
> > 
> > Date of MBGP Dump  Thu Oct 16 00:13:01 EDT 2003
> >  
> >  There were  4595 SA-Cache Entries      
> >  There were   107 Duplicate S,G Entries 
> >  There were  2739 SA-Cache Groups       
> >  There were  1421 SA-Cache Sources      
> >  There were   276 SA-Cache RPs          
> >  There were   166 SA-Cache ASs          
> >  
> >  The Most Active Group  is      224.0.1.76 with   121 members 
> >  The Most Active Source is     192.73.7.34 with   173 groups 
> >  The Most Active RP     is    64.102.254.9 with   900 entries 
> >  The Most Active AS     is             109 with  1544 entries 
> >  
> >  There were  2387 Groups with only one Sender      
> >  
> >  First Octet Histogram
> >  
> >  Octet 224 had   1360 entries or  49.65 % 
> >  Octet 225 had     22 entries or   0.80 % 
> >  Octet 226 had     15 entries or   0.55 % 
> >  Octet 227 had     80 entries or   2.92 % 
> >  Octet 228 had    110 entries or   4.02 % 
> >  Octet 229 had     69 entries or   2.52 % 
> >  Octet 230 had      7 entries or   0.26 % 
> >  Octet 231 had      7 entries or   0.26 % 
> >  Octet 233 had    959 entries or  35.01 % 
> >  Octet 234 had     65 entries or   2.37 % 
> >  Octet 235 had      8 entries or   0.29 % 
> >  Octet 236 had     15 entries or   0.55 % 
> >  Octet 237 had      7 entries or   0.26 % 
> >  Octet 238 had     15 entries or   0.55 % 
> > 
> > ------------------------
> > Now
> > 
> > Date of MBGP Dump  Fri Oct 17 18:13:02 EDT 2003
> >  
> >  There were  7240 SA-Cache Entries      
> >  There were   147 Duplicate S,G Entries 
> >  There were  4288 SA-Cache Groups       
> >  There were  1470 SA-Cache Sources      
> >  There were   271 SA-Cache RPs          
> >  There were   167 SA-Cache ASs          
> >  
> >  The Most Active Group  is      224.0.1.76 with   121 members 
> >  The Most Active Source is   144.254.7.161 with   377 groups 
> >  The Most Active RP     is    64.102.254.9 with  2462 entries 
> >  The Most Active AS     is             109 with  4147 entries 
> >  
> >  There were  3207 Groups with only one Sender      
> >  
> >  First Octet Histogram
> >  
> >  Octet 224 had   2114 entries or  49.30 % 
> >  Octet 225 had     21 entries or   0.49 % 
> >  Octet 226 had     20 entries or   0.47 % 
> >  Octet 227 had     11 entries or   0.26 % 
> >  Octet 228 had     10 entries or   0.23 % 
> >  Octet 229 had    128 entries or   2.99 % 
> >  Octet 230 had      7 entries or   0.16 % 
> >  Octet 231 had     38 entries or   0.89 % 
> >  Octet 233 had   1822 entries or  42.49 % 
> >  Octet 234 had     22 entries or   0.51 % 
> >  Octet 235 had     61 entries or   1.42 % 
> >  Octet 236 had     14 entries or   0.33 % 
> >  Octet 237 had      9 entries or   0.21 % 
> >  Octet 238 had     11 entries or   0.26 % 
> >  
> > Note the excess traffic is all in 224 and 233.
> > 
> > Regards
> > Marshall
> > __________________________________________________________
> > web archive:  http://darkwing.uoregon.edu/~llynch/mboned/
> > 
> 
> __________________________________________________________
> web archive:  http://darkwing.uoregon.edu/~llynch/mboned/