All things related to multicast

[Jimmy Kyriannis <>]

At 02:02 AM 5/2/2006, ken lindahl wrote:
> hi Toerless et al,
>
> Toerless Eckert wrote:
> >  c) In general we recommend not to enable SAP, so i am very interested
> >     to get a reinforcement about how useful this command still is
> >     to common user practices ;-))
>
> i will shamelessly confess that SAP listening is enabled in all
> of our routers, and on more than one occasion i have successfully
> used "show ip sap" to quickly narrow down the location of a problem.
> ("ok, 134 sessions shown on this router, 132 on this one, but only 67
> on this one, wtf???")

We too run SAP listeners on routers, but have been forced to cut down 
on its use because we've been burned by it in a few instances.  In a 
couple of events over the past year or so, individuals sourced 4+ GB 
of data to the SAP group, and as the Cisco routers (running fairly 
recent 12.2(18)SX code) gobbled up the data, their CPU loads when 
through the roof.  The routers lost their OSPF adjacencies, and the 
mess continued from there...

I posted some data on this to the MBONE development group last year, 
suggesting at least some rudimentary protection into the SAP listener 
IOS code, such as putting a cap on how much data a router would 
ingest on a per announcement basis.  The feedback I received, 
however, wasn't encouraging, and the general view was that it was not 
considered wise to run SAP listeners on routers exposed to the wild.

We've also found that routers running SAP listeners are great at 
giving us rudimentary multicast diagnostic windows into distant 
portions of our networks, especially given the lack of strong 
multicast diagnostic tools.  This simple diagnostic feature spares 
folks considerable time and effort through a simple "show command", 
where either running out to some distant building for a brief test or 
installing SAP probes around our network wouldn't be practical nor 
scalable.  Having at least the ability to run a SAP listener without 
concern for processor spikes or invalid format complaints continues 
to be quite valuable.


Jimmy