All things related to multicast

[John Kristoff <>]

On Fri, 22 Feb 2008 11:58:20 -0600
"Dale W. Carder" 
<>
 wrote:

> I would recommend taking a look at John Kristoff's guide on
> multicast deployment:

I hope people heed the warnings on the page if it's not already
glaringly obivous that it's out of date and likely to cause support
problems if router configs are not carefully maintained, but thanks
for the plug.

> Perhaps this working group could work on updating this document
> now that John is primarily out working in private industry.

I'm still around in academia and can wear that hat legitimately for
part of the time, but I don't have to worry about or support the
periodic mcast problems like these anymore.  I brought up the issue
of releasing some stress tools with a colleague.  Essentially some
hacky Perl code that tries to do various sorts of things that could
cause harm if the global mcast net is not completely hardened.  So
things like:

  ICMP ping floods to the sap group (routers usually respond)
  IGMP join floods to sequential/random mcast netblock addresses
  UDP/TCP packet flooders to selects or select/random mcast netblocks
  Random IP protocol floods to selects/random mcast netblocks

I was also thinking doing something with PIM and MSDP.  MSDP
is kind of like BGP so probably no point there, but with PIM I
thought I could try to prented being a PIM router and see what
sort of havoc routers would be vulnerable to.  The whole end
host-based source and receiver state attacks are most worrisome
to me in the long run, because I think most nets are ill prepared
to deal with those.  I guess on the positive side, deployment is
not ubiquituous.

If someone wants to work on a more formal paper or presentation
documenting attack scenarios and taking some measurements that
might be useful for some limited audience.  I think there is lots
of good info about how to harden multicast nets, it's just not
that easy to actually do it.  Some real-world measurements might
help highlight those problems and get some implementations and
configurations updated?

John