Skip to Content.
Sympa Menu

wg-multicast - Re: Another SAP Storm?

Subject: All things related to multicast

List archive

Re: Another SAP Storm?


Chronological Thread 
  • From: Chris Robb <>
  • To: "Taylor, Scott J." <>
  • Cc: <>
  • Subject: Re: Another SAP Storm?
  • Date: Wed, 11 Jun 2008 14:50:16 -0400

Hi folks:

Just a heads up that the Internet2 NOC is working to mitigate this storm by filtering the SAP announcements at all ingress points. We have several cases of networks that have torn down their peering with us because the storm is adversely affecting the performance of their border equipment.

-Chris

On Jun 11, 2008, at 2:27 PM, Taylor, Scott J. wrote:

Here is what we’re seeing from Universite Paris. Do the high pps and kbps rates indicate that maybe they are accidently trying to source video/audio on the SAP group? We aren’t seeing any performance issues here just a little uptick in traffic.

sh ip mroute active
Active IP Multicast Sources - sending >= 4 kbps
a negative (-) Rate counts pps being fast-dropped

Group: 224.2.127.254, (SAP.MCAST.NET)
Source: 81.194.43.1 (?)
Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484 kbps(life avg)

Thanks,

Scott J. Taylor
Network Technician
Connecticut Education Network
University of Connecticut
Tel: 860/622.2242
Helpdesk: 860/622.2300

From: McCurry, Barry A
[mailto:]
Sent: Wednesday, June 11, 2008 13:30
To: Todd Chapman;

Subject: RE: Another SAP Storm?

Here is the offending party

Viva la France!

inetnum: 81.194.43.0 - 81.194.43.255
netname: FR-U-PARIS13-VILLETANEUSE
descr: Universite Paris13
country: FR
admin-c: JFF1-RIPE
tech-c: JFF1-RIPE
status: ASSIGNED PA
mnt-by: RENATER-MNT
source: RIPE # Filtered

irt: IRT-CERT-Renater
address: c/o ENSAM
address: 151 boulevard de l'H.pital
address: 75013 Paris
address: France
phone: +33 1 5394 2044
fax-no: +33 1 5394 2031
e-mail:

signature: PGPKEY-D754E8CD
encryption: PGPKEY-D754E8CD
admin-c: TI123-RIPE
tech-c: TI123-RIPE
auth: PGPKEY-D754E8CD
remarks: http://www.trusted-introducer.org/teams/cert- renater.html
remarks: This is an accredited IRT (level 2)
irt-nfy:

mnt-by: TRUSTED-INTRODUCER-MNT
source: RIPE # Filtered

person: Jean-Francois Florence
address: CRI Universite Paris13
address: 99 Avenue J.B Clement
address: 93430 Villetaneuse
e-mail:

phone: +33 1 49 40 30 68
fax-no: +33 1 48 22 81 50
mnt-by: RENATER-MNT
nic-hdl: JFF1-RIPE
source: RIPE # Filtered

% Information related to '81.194.43.0/24AS2200'

route: 81.194.43.0/24
descr: FR-U-PARIS13-VILLETANEUSE
origin: AS2200
mnt-by: RENATER-MNT
source: RIPE # Filtered

% Information related to '81.194.0.0/16AS2200'

route: 81.194.0.0/16
descr: RENATER
origin: AS2200
mnt-by: RENATER-MNT
source: RIPE # Filtered


From: Todd Chapman
[mailto:]
Sent: Wednesday, June 11, 2008 12:16 PM
To:

Subject: Another SAP Storm?

We just got hit with a SAP storm from 81.194.43.1. ARIN reports that this is someone from the RIPE network. Anyone else see this?

Todd Chapman
Network Operations Center
UC Davis


Chris Robb, Manager of Operations
Internet2
Office: 812.855.8604
Cell: 812.345.3188
Twitter Feed: http://www.twitter.com/chrobb
****************
Internet2 Workshops
Hands-on. Brains-on.
http://www.internet2.edu/workshops/




Archive powered by MHonArc 2.6.16.

Top of Page