All things related to multicast

[Chris Robb <>]

Hi folks:

Just a heads up that the Internet2 NOC is working to mitigate this  
storm by filtering the SAP announcements at all ingress points. We  
have several cases of networks that have torn down their peering with  
us because the storm is adversely affecting the performance of their  
border equipment.

-Chris

On Jun 11, 2008, at 2:27 PM, Taylor, Scott J. wrote:

> Here is what we’re seeing from Universite Paris.  Do the high pps  
> and kbps rates indicate that maybe they are accidently trying to  
> source video/audio on the SAP group?  We aren’t seeing any  
> performance issues here just a little uptick in traffic.
>
> sh ip mroute active
> Active IP Multicast Sources - sending >= 4 kbps
>  a negative (-) Rate counts pps being fast-dropped
>
> Group: 224.2.127.254, (SAP.MCAST.NET)
>    Source: 81.194.43.1 (?)
>      Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs),  
> 40484 kbps(life avg)
>
> Thanks,
>
> Scott J. Taylor
> Network Technician
> Connecticut Education Network
> University of Connecticut
> Tel: 860/622.2242
> Helpdesk: 860/622.2300
>
> From: McCurry, Barry A 
> [mailto:]
> Sent: Wednesday, June 11, 2008 13:30
> To: Todd Chapman; 
>
> Subject: RE: Another SAP Storm?
>
> Here is the offending party
>
> Viva la France!
>
> inetnum:        81.194.43.0 - 81.194.43.255
> netname:        FR-U-PARIS13-VILLETANEUSE
> descr:          Universite Paris13
> country:        FR
> admin-c:        JFF1-RIPE
> tech-c:         JFF1-RIPE
> status:         ASSIGNED PA
> mnt-by:         RENATER-MNT
> source:         RIPE # Filtered
>
> irt:          IRT-CERT-Renater
> address:      c/o ENSAM
> address:      151 boulevard de l'H.pital
> address:      75013 Paris
> address:      France
> phone:        +33 1 5394 2044
> fax-no:       +33 1 5394 2031
> e-mail:       
>
> signature:    PGPKEY-D754E8CD
> encryption:   PGPKEY-D754E8CD
> admin-c:      TI123-RIPE
> tech-c:       TI123-RIPE
> auth:         PGPKEY-D754E8CD
> remarks:      http://www.trusted-introducer.org/teams/cert- 
> renater.html
> remarks:      This is an accredited IRT (level 2)
> irt-nfy:      
>
> mnt-by:       TRUSTED-INTRODUCER-MNT
> source:       RIPE # Filtered
>
> person:         Jean-Francois Florence
> address:        CRI Universite Paris13
> address:        99 Avenue J.B Clement
> address:        93430 Villetaneuse
> e-mail:         
>
> phone:          +33 1 49 40 30 68
> fax-no:         +33 1 48 22 81 50
> mnt-by:         RENATER-MNT
> nic-hdl:        JFF1-RIPE
> source:         RIPE # Filtered
>
> % Information related to '81.194.43.0/24AS2200'
>
> route:          81.194.43.0/24
> descr:          FR-U-PARIS13-VILLETANEUSE
> origin:         AS2200
> mnt-by:         RENATER-MNT
> source:         RIPE # Filtered
>
> % Information related to '81.194.0.0/16AS2200'
>
> route:          81.194.0.0/16
> descr:          RENATER
> origin:         AS2200
> mnt-by:         RENATER-MNT
> source:         RIPE # Filtered
>
>
> From: Todd Chapman 
> [mailto:]
> Sent: Wednesday, June 11, 2008 12:16 PM
> To: 
>
> Subject: Another SAP Storm?
>
> We just got hit with a SAP storm from 81.194.43.1. ARIN reports that  
> this is someone from the RIPE network. Anyone else see this?
>
> Todd Chapman
> Network Operations Center
> UC Davis

Chris Robb, Manager of Operations
Internet2
Office: 812.855.8604
Cell: 812.345.3188
Twitter Feed: http://www.twitter.com/chrobb
****************
Internet2 Workshops
Hands-on. Brains-on.
http://www.internet2.edu/workshops/