All things related to multicast

[Chris Spears <>]

Oddly, it never hit our control-plane filters (or the PFE was too busy 
to report it).

Anyone have a good way to mitigate the effects of this on JUNOS?

Chris

--

%%%%%%%%%%%%%%%%%%%%%%%%%%%
Chris Spears, OSCnet
Senior Routing Engineer
phone: 614-292-9415
fax: 614-728-8110



Chris Robb wrote:
> Hi folks:
>
> Just a heads up that the Internet2 NOC is working to mitigate this storm 
> by filtering the SAP announcements at all ingress points. We have 
> several cases of networks that have torn down their peering with us 
> because the storm is adversely affecting the performance of their border 
> equipment.
>
> -Chris
>
> On Jun 11, 2008, at 2:27 PM, Taylor, Scott J. wrote:
>
> > Here is what we’re seeing from Universite Paris.  Do the high pps and 
> > kbps rates indicate that maybe they are accidently trying to source 
> > video/audio on the SAP group?  We aren’t seeing any performance issues 
> > here just a little uptick in traffic.
> >
> > sh ip mroute active
> > Active IP Multicast Sources - sending >= 4 kbps
> >  a negative (-) Rate counts pps being fast-dropped
> >
> > Group: 224.2.127.254, (SAP.MCAST.NET)
> >    Source: 81.194.43.1 (?)
> >      Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484 
> > kbps(life avg)
> >
> > Thanks,
> >
> > Scott J. Taylor
> > Network Technician
> > Connecticut Education Network
> > University of Connecticut
> > Tel: 860/622.2242
> > Helpdesk: 860/622.2300
> >
> > From: McCurry, Barry A 
> > [mailto:]
> > Sent: Wednesday, June 11, 2008 13:30
> > To: Todd Chapman; 
> >
> > Subject: RE: Another SAP Storm?
> >
> > Here is the offending party
> >
> > Viva la France!
> >
> > inetnum:        81.194.43.0 - 81.194.43.255
> > netname:        FR-U-PARIS13-VILLETANEUSE
> > descr:          Universite Paris13
> > country:        FR
> > admin-c:        JFF1-RIPE
> > tech-c:         JFF1-RIPE
> > status:         ASSIGNED PA
> > mnt-by:         RENATER-MNT
> > source:         RIPE # Filtered
> >
> > irt:          IRT-CERT-Renater
> > address:      c/o ENSAM
> > address:      151 boulevard de l'H.pital
> > address:      75013 Paris
> > address:      France
> > phone:        +33 1 5394 2044
> > fax-no:       +33 1 5394 2031
> > e-mail:       
> >
> > signature:    PGPKEY-D754E8CD
> > encryption:   PGPKEY-D754E8CD
> > admin-c:      TI123-RIPE
> > tech-c:       TI123-RIPE
> > auth:         PGPKEY-D754E8CD
> > remarks:      http://www.trusted-introducer.org/teams/cert-renater.html
> > remarks:      This is an accredited IRT (level 2)
> > irt-nfy:      
> >
> > mnt-by:       TRUSTED-INTRODUCER-MNT
> > source:       RIPE # Filtered
> >
> > person:         Jean-Francois Florence
> > address:        CRI Universite Paris13
> > address:        99 Avenue J.B Clement
> > address:        93430 Villetaneuse
> > e-mail:         
> >
> > phone:          +33 1 49 40 30 68
> > fax-no:         +33 1 48 22 81 50
> > mnt-by:         RENATER-MNT
> > nic-hdl:        JFF1-RIPE
> > source:         RIPE # Filtered
> >
> > % Information related to '81.194.43.0/24AS2200'
> >
> > route:          81.194.43.0/24
> > descr:          FR-U-PARIS13-VILLETANEUSE
> > origin:         AS2200
> > mnt-by:         RENATER-MNT
> > source:         RIPE # Filtered
> >
> > % Information related to '81.194.0.0/16AS2200'
> >
> > route:          81.194.0.0/16
> > descr:          RENATER
> > origin:         AS2200
> > mnt-by:         RENATER-MNT
> > source:         RIPE # Filtered
> >
> >
> > From: Todd Chapman 
> > [mailto:]
> > Sent: Wednesday, June 11, 2008 12:16 PM
> > To: 
> >
> > Subject: Another SAP Storm?
> >
> > We just got hit with a SAP storm from 81.194.43.1. ARIN reports that 
> > this is someone from the RIPE network. Anyone else see this?
> >
> > Todd Chapman
> > Network Operations Center
> > UC Davis
>
> Chris Robb, Manager of Operations
> Internet2
> Office: 812.855.8604
> Cell: 812.345.3188
> Twitter Feed: http://www.twitter.com/chrobb
> ****************
> Internet2 Workshops
> Hands-on. Brains-on.
> http://www.internet2.edu/workshops/