All things related to multicast

["Taylor, Scott J." <>]

Here is what we’re seeing from Universite Paris.  Do the high pps and kbps rates indicate that maybe they are accidently trying to source video/audio on the SAP group?  We aren’t seeing any performance issues here just a little uptick in traffic.

 

sh ip mroute active

Active IP Multicast Sources - sending >= 4 kbps

 a negative (-) Rate counts pps being fast-dropped

 

Group: 224.2.127.254, (SAP.MCAST.NET)

   Source: 81.194.43.1 (?)

     Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484 kbps(life avg)

 

Thanks,

 

Scott J. Taylor

Network Technician

Connecticut Education Network

University of Connecticut

Tel: 860/622.2242

Helpdesk: 860/622.2300

 

From: McCurry, Barry A [mailto:]
Sent: Wednesday, June 11, 2008 13:30
To: Todd Chapman;
Subject: RE: Another SAP Storm?

 

Here is the offending party

 

Viva la France!

 

inetnum:        81.194.43.0 - 81.194.43.255

netname:        FR-U-PARIS13-VILLETANEUSE

descr:          Universite Paris13

country:        FR

admin-c:        JFF1-RIPE

tech-c:         JFF1-RIPE

status:         ASSIGNED PA

mnt-by:         RENATER-MNT

source:         RIPE # Filtered

 

irt:          IRT-CERT-Renater

address:      c/o ENSAM

address:      151 boulevard de l'H.pital

address:      75013 Paris

address:      France

phone:        +33 1 5394 2044

fax-no:       +33 1 5394 2031

e-mail:      

signature:    PGPKEY-D754E8CD

encryption:   PGPKEY-D754E8CD

admin-c:      TI123-RIPE

tech-c:       TI123-RIPE

auth:         PGPKEY-D754E8CD

remarks:      http://www.trusted-introducer.org/teams/cert-renater.html

remarks:      This is an accredited IRT (level 2)

irt-nfy:     

mnt-by:       TRUSTED-INTRODUCER-MNT

source:       RIPE # Filtered

 

person:         Jean-Francois Florence

address:        CRI Universite Paris13

address:        99 Avenue J.B Clement

address:        93430 Villetaneuse

e-mail:        

phone:          +33 1 49 40 30 68

fax-no:         +33 1 48 22 81 50

mnt-by:         RENATER-MNT

nic-hdl:        JFF1-RIPE

source:         RIPE # Filtered

 

% Information related to '81.194.43.0/24AS2200'

 

route:          81.194.43.0/24

descr:          FR-U-PARIS13-VILLETANEUSE

origin:         AS2200

mnt-by:         RENATER-MNT

source:         RIPE # Filtered

 

% Information related to '81.194.0.0/16AS2200'

 

route:          81.194.0.0/16

descr:          RENATER

origin:         AS2200

mnt-by:         RENATER-MNT

source:         RIPE # Filtered

 

 

From: Todd Chapman [mailto:]
Sent: Wednesday, June 11, 2008 12:16 PM
To:
Subject: Another SAP Storm?

 

We just got hit with a SAP storm from 81.194.43.1. ARIN reports that this is someone from the RIPE network. Anyone else see this?

 

Todd Chapman

Network Operations Center

UC Davis