All things related to multicast

[Stig Venaas <>]

Michael Forrest wrote:
> Yeah that would be the simple option to turn it off, but we require the sap
> announcements for the moment. It also shouldn't really have this effect on
> the router, so agreed a TAC case is the way forward.

I would turn off "ip sap listen" as Caren noted. There is not much point
in leaving this on, it's only useful for debugging, and in my opinion of
very limited use. The router will forward SAP just fine with this off.

The reason the router runs out of memory, may not be a memory leak, but
might for instance be due to people sending lots of SAP announcements
for different groups. I hope IOS has a memory limit for that, but I
don't know. Having "ip sap listen" enabled might make you vulnerable to
DoS attacks where all cpu and memory in the router can be consumed,
unless there are some built-in limits...

Stig

> 
> Thanks :-)
> 
> -Michael
> 
>> -----Original Message-----
>> From: Caren Litvanyi 
>> [mailto:]
>> Sent: 23 March 2006 18:09
>> To: Michael Forrest
>> Cc: 
>> 
>> Subject: Re: Cisco IPv4 Multicast Issue
>>
>> I have not seen this issue before, and I agree with opening
>> A TAC case with Cisco.
>> I was wondering, does this mean you have "ip sap listen"
>> turned on?  I tend not to unless really necessary.
>> Thanks,
>> Caren
>>
>>
>> On Thu, 23 Mar 2006, Michael Forrest wrote:
>>
>>> Has anyone seen the following issue with Cisco router running ipv4
>>> multicast?
>>>
>>> The log messages just seem to be full of the following msg:-
>>>
>>> Mar 20 16:05:38 door.erg.abdn.ac.uk 299: *Mar 16 06:39:31.369 UTC:
>>> %MROUTE-6-UNSUPPORTED_SAP_FORMAT: Received unsupported format SAP
>> message
>>> from (129.116.74.139)
>>>
>>> The MFIB (multicast forwarding information base) seems to have a memory
>> leak
>>> and eventually consumes all the memory available on the router. The
>> router
>>> becomes inaccessible on the console and over the network and requires a
>>> power cycle to recover. Although strangely enough, still seems to be
>>> functional (if just unaccessible).
>>>
>>> A show ver from the router yields (it's a Cisco 2621XM):-
>>>
>>> Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version
>>> 12.4(7), RELEASE SOFTWARE (fc6)
>>> Technical Support: http://www.cisco.com/techsupport
>>> Copyright (c) 1986-2006 by Cisco Systems, Inc.
>>> Compiled Tue 28-Feb-06 23:32 by alnguyen
>>>
>>> Doing a show proc memory shows that it seems to consume about 1MB of
>> memory
>>> every 4-5hours until the router just falls over.
>>>
>>> All the unsupported SAP messages come from a cluster of machines with
>>> similar names to:-
>>>
>>> vbrick-cma5136.communication.utexas.edu
>>>
>>> Anyone had/solved this issue before?
>>>
>>> -Michael
>>>
>>> --
>>> Michael Forrest,
>>> Directorate of Information Systems and Services,
>>> University of Aberdeen.
>>>
>>> Tel: +44-1224-273392
>>>
>>>
>>
>> ------------
>> Caren Litvanyi, network engineer
>> Global Research NOC at Indiana University
>> 
>> o:812-856-4576  c:720-839-7739
>