Skip to Content.
Sympa Menu

wg-multicast - RE: Another SAP Storm?

Subject: All things related to multicast

List archive

RE: Another SAP Storm?


Chronological Thread 
  • From: "Taylor, Scott J." <>
  • To: <>
  • Subject: RE: Another SAP Storm?
  • Date: Wed, 11 Jun 2008 14:27:34 -0400

Here is what we’re seeing from Universite Paris.  Do the high pps and kbps rates indicate that maybe they are accidently trying to source video/audio on the SAP group?  We aren’t seeing any performance issues here just a little uptick in traffic.

 

sh ip mroute active

Active IP Multicast Sources - sending >= 4 kbps

 a negative (-) Rate counts pps being fast-dropped

 

Group: 224.2.127.254, (SAP.MCAST.NET)

   Source: 81.194.43.1 (?)

     Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484 kbps(life avg)

 

Thanks,

 

Scott J. Taylor

Network Technician

Connecticut Education Network

University of Connecticut

Tel: 860/622.2242

Helpdesk: 860/622.2300

 

From: McCurry, Barry A [mailto:]
Sent: Wednesday, June 11, 2008 13:30
To: Todd Chapman;
Subject: RE: Another SAP Storm?

 

Here is the offending party

 

Viva la France!

 

inetnum:        81.194.43.0 - 81.194.43.255

netname:        FR-U-PARIS13-VILLETANEUSE

descr:          Universite Paris13

country:        FR

admin-c:        JFF1-RIPE

tech-c:         JFF1-RIPE

status:         ASSIGNED PA

mnt-by:         RENATER-MNT

source:         RIPE # Filtered

 

irt:          IRT-CERT-Renater

address:      c/o ENSAM

address:      151 boulevard de l'H.pital

address:      75013 Paris

address:      France

phone:        +33 1 5394 2044

fax-no:       +33 1 5394 2031

e-mail:      

signature:    PGPKEY-D754E8CD

encryption:   PGPKEY-D754E8CD

admin-c:      TI123-RIPE

tech-c:       TI123-RIPE

auth:         PGPKEY-D754E8CD

remarks:      http://www.trusted-introducer.org/teams/cert-renater.html

remarks:      This is an accredited IRT (level 2)

irt-nfy:     

mnt-by:       TRUSTED-INTRODUCER-MNT

source:       RIPE # Filtered

 

person:         Jean-Francois Florence

address:        CRI Universite Paris13

address:        99 Avenue J.B Clement

address:        93430 Villetaneuse

e-mail:        

phone:          +33 1 49 40 30 68

fax-no:         +33 1 48 22 81 50

mnt-by:         RENATER-MNT

nic-hdl:        JFF1-RIPE

source:         RIPE # Filtered

 

% Information related to '81.194.43.0/24AS2200'

 

route:          81.194.43.0/24

descr:          FR-U-PARIS13-VILLETANEUSE

origin:         AS2200

mnt-by:         RENATER-MNT

source:         RIPE # Filtered

 

% Information related to '81.194.0.0/16AS2200'

 

route:          81.194.0.0/16

descr:          RENATER

origin:         AS2200

mnt-by:         RENATER-MNT

source:         RIPE # Filtered

 

 

From: Todd Chapman [mailto:]
Sent: Wednesday, June 11, 2008 12:16 PM
To:
Subject: Another SAP Storm?

 

We just got hit with a SAP storm from 81.194.43.1. ARIN reports that this is someone from the RIPE network. Anyone else see this?

 

Todd Chapman

Network Operations Center

UC Davis

 




Archive powered by MHonArc 2.6.16.

Top of Page