All things related to multicast

["Phil Palanchi" <>]

Rutgers also took the hit. We will be removing ip sap listen from our
loopback interfaces also.

Phil Palanchi
Rutgers, The State University of New Jersey
Telecommunications Division 
Piscataway, NJ

-----Original Message-----
From: Jeff Fitzwater 
[mailto:]
 
Sent: Thursday, February 21, 2008 2:41 PM
To: 

Cc: 
;
 OIT Network Systems Group
Subject: Re: operational content - excessive traffic to port 9875

FYI

Jeff Fitzwater
OIT Network & Communications Systems
Princeton University

Princeton also saw the traffic and two of our downstream routers were  
also cooking.   Interesting that  our edge router tht connects to I2,  
did not have high CPU but the next two internal routers that have PIM
enabled, did have 100% router CPU ( CISCO 720-3B )

On Feb 21, 2008, at 2:26 PM, William F. Maton Sotomayor wrote:

>
> Greetings folks,
>       Pardon the operational content.
>
>       We just experienced a major amount (multi-megabit) of traffic coming

> from 136.244.96.104 going to the SAP/SDR multicast address and port 
> (224.2.127.254/9875).  All CPUs on our routers broke into a sweat as 
> they tried to process this traffic.  I verified this with fellow 
> Canadian RAN Netera and CANARIE.  CANARIE has since placed a filter 
> against this address sending more traffic to our networks, but I was 
> wondering if anyone else has felt this.  Also if someone could track 
> down the real owner of that IP and ask them to stop, that would be 
> nice too. :-)
>
> Thanks,
>
> wfms
>
> Manager, Special Projects, Advanced Infrastructures National Research 
> Council Canada 1200 Montreal Road Ottawa, Canada K2S 1L2