All things related to multicast

[Hank Nussbacher <>]

We too got hit here in Geant-2 land this past Thursday.  We have sap listen 
on a number of interfaces.

You can see it via our router CPU graphs:
http://noc.ilan.net.il/stats/ILAN-CPU/gp0-cpu.html
http://noc.ilan.net.il/stats/ILAN-CPU/tel-aviv-gp-cpu.html
Happened around 8pm (GMT+2) here in Israel.

We have filters in place but they didn't help :-(

From our core router (gp0):
mls rate-limit multicast ipv4 ip-options 500 50
ip multicast boundary boundary-filter
ip igmp access-group igmp-join-filter
ip igmp limit 1000
!
ip access-list standard boundary-filter
 remark lucent-avaya-ap
 deny   224.0.1.76
 remark srvloc-da
 deny   224.0.1.35
 remark cisco-rp-announce
 deny   224.0.1.39
 remark retrospect
 deny   224.1.0.38
 remark cisco-rp-discovery
 deny   224.0.1.40
 remark hp-device-discovery
 deny   224.0.1.60
 remark ntp
 deny   224.0.1.1
 remark sun-rpc
 deny   224.0.2.2
 remark cisco-aironet-ap
 deny   224.1.0.1
 remark rwhod
 deny   224.0.1.3
 remark sgi-dogfight
 deny   224.0.1.2
 remark rwho-group
 deny   224.0.2.1
 remark nis+
 deny   224.0.1.8
 remark srvloc
 deny   224.0.1.22
 remark nbc-pro
 deny   224.0.1.25
 remark microsoft-ds
 deny   224.0.1.24
 remark norton-ghost
 deny   224.77.0.0 0.0.255.255
 remark igmp-control-224-128-0
 deny   224.128.0.0 0.0.0.255
 remark reserved-225
 deny   225.0.0.0 0.255.255.255
 remark reserved-226
 deny   226.0.0.0 0.255.255.255
 remark reserved-227
 deny   227.0.0.0 0.255.255.255
 remark reserved-228
 deny   228.0.0.0 0.255.255.255
 remark reserved-229
 deny   229.0.0.0 0.255.255.255
 remark reserved-230
 deny   230.0.0.0 0.255.255.255
 remark reserved-231
 deny   231.0.0.0 0.255.255.255
 remark igmp-control-232-0-0
 deny   232.0.0.0 0.0.0.255
 remark igmp-control-232-128-0
 deny   232.128.0.0 0.0.0.255
 remark igmp-control-233-0-0
 deny   233.0.0.0 0.0.0.255
 remark igmp-control-233-128-0
 deny   233.128.0.0 0.0.0.255
 remark reserved-234
 deny   234.0.0.0 0.255.255.255
 remark reserved-235
 deny   235.0.0.0 0.255.255.255
 remark reserved-236
 deny   236.0.0.0 0.255.255.255
 remark reserved-237
 deny   237.0.0.0 0.255.255.255
 remark reserved-238
 deny   238.0.0.0 0.255.255.255
 remark admin-scoped - REMOVE if you need these
 deny   239.0.0.0 0.255.255.255
 remark 224/8
 permit 224.0.0.0 0.255.255.255
 remark SSM
 permit 232.0.0.0 0.255.255.255
 remark GLOP
 permit 233.0.0.0 0.255.255.255
 deny   any
ip access-list standard igmp-join-filter
 deny   224.0.1.76
 deny   224.0.1.35
 deny   224.0.1.39
 deny   224.1.0.38
 deny   224.0.1.40
 deny   224.0.1.60
 deny   224.0.1.1
 deny   224.0.2.2
 deny   224.1.0.1
 deny   224.0.1.3
 deny   224.0.1.2
 deny   224.0.2.1
 deny   224.0.1.8
 deny   224.0.1.22
 deny   224.0.1.25
 deny   224.0.1.24
 deny   224.77.0.0 0.0.255.255
 deny   224.128.0.0 0.0.0.255
 deny   225.0.0.0 0.255.255.255
 deny   226.0.0.0 0.255.255.255
 deny   227.0.0.0 0.255.255.255
 deny   228.0.0.0 0.255.255.255
 deny   229.0.0.0 0.255.255.255
 deny   230.0.0.0 0.255.255.255
 deny   231.0.0.0 0.255.255.255
 deny   232.0.0.0 0.0.0.255
 deny   232.128.0.0 0.0.0.255
 deny   233.0.0.0 0.0.0.255
 deny   233.128.0.0 0.0.0.255
 deny   234.0.0.0 0.255.255.255
 deny   235.0.0.0 0.255.255.255
 deny   236.0.0.0 0.255.255.255
 deny   237.0.0.0 0.255.255.255
 deny   238.0.0.0 0.255.255.255
 deny   239.0.0.0 0.255.255.255
 permit any

What am I missing?

On our msdp router (mcast) which seemed to fair better based
on the CPU graphs
http://noc.ilan.net.il/stats/ILAN-CPU/mcast-cpu.html:

 ip multicast boundary boundary-filter
 ip multicast rate-limit in 40000
 ip multicast rate-limit out 40000
 ip igmp access-group igmp-join-filter
 ip igmp limit 1000

Actual Cisco IOS suggestions most welcome.

Thanks,
Hank