All things related to multicast

[Tim Peiffer <>]

Another sap storm seems to have shown up recently, with a different 
source than previously advertised. Both the packet and bit rate appear 
to be pretty interesting.

Group: 224.2.127.254, (SAP.MCAST.NET)
Source: 64.65.64.70 (hayakawa.lava.net)
Rate: 7 pps/24 kbps(1sec), 24 kbps(last 10 secs), 3 kbps(life avg)
Source: 81.194.43.1 (?)
Rate: 16711 pps/43716 kbps(1sec), 43716 kbps(last 30 secs), 32472 
kbps(life avg)

whois -h whois.arin.net 64.65.64.70
[Querying whois.arin.net]
[Redirected to rwhois.lava.net]
[Querying rwhois.lava.net]
[Unable to connect to remote host]

Regards,
Tim Peiffer
Networking and Telecommunications Services
University of Minnesota/NorthernLights GigaPOP

Taylor, Scott J. wrote:
> Here is what we’re seeing from Universite Paris. Do the high pps and 
> kbps rates indicate that maybe they are accidently trying to source 
> video/audio on the SAP group? We aren’t seeing any performance issues 
> here just a little uptick in traffic.
>
> sh ip mroute active
>
> Active IP Multicast Sources - sending >= 4 kbps
>
> a negative (-) Rate counts pps being fast-dropped
>
> Group: 224.2.127.254, (SAP.MCAST.NET)
>
> Source: 81.194.43.1 (?)
>
> Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484 
> kbps(life avg)
>
> Thanks,
>
> Scott J. Taylor
>
> Network Technician
>
> Connecticut Education Network
>
> University of Connecticut
>
> Tel: 860/622.2242
>
> Helpdesk: 860/622.2300
>
> *From:* McCurry, Barry A 
> [mailto:]
> *Sent:* Wednesday, June 11, 2008 13:30
> *To:* Todd Chapman; 
>
> *Subject:* RE: Another SAP Storm?
>
> Here is the offending party
>
> Viva la France!
>
> inetnum: 81.194.43.0 - 81.194.43.255
>
> netname: FR-U-PARIS13-VILLETANEUSE
>
> descr: Universite Paris13
>
> country: FR
>
> admin-c: JFF1-RIPE
>
> tech-c: JFF1-RIPE
>
> status: ASSIGNED PA
>
> mnt-by: RENATER-MNT
>
> source: RIPE # Filtered
>
> irt: IRT-CERT-Renater
>
> address: c/o ENSAM
>
> address: 151 boulevard de l'H.pital
>
> address: 75013 Paris
>
> address: France
>
> phone: +33 1 5394 2044
>
> fax-no: +33 1 5394 2031
>
> e-mail: 
>
>  
> <mailto:>
>
> signature: PGPKEY-D754E8CD
>
> encryption: PGPKEY-D754E8CD
>
> admin-c: TI123-RIPE
>
> tech-c: TI123-RIPE
>
> auth: PGPKEY-D754E8CD
>
> remarks: http://www.trusted-introducer.org/teams/cert-renater.html
>
> remarks: This is an accredited IRT (level 2)
>
> irt-nfy: 
>
>  
> <mailto:>
>
> mnt-by: TRUSTED-INTRODUCER-MNT
>
> source: RIPE # Filtered
>
> person: Jean-Francois Florence
>
> address: CRI Universite Paris13
>
> address: 99 Avenue J.B Clement
>
> address: 93430 Villetaneuse
>
> e-mail: 
>
>  
> <mailto:>
>
> phone: +33 1 49 40 30 68
>
> fax-no: +33 1 48 22 81 50
>
> mnt-by: RENATER-MNT
>
> nic-hdl: JFF1-RIPE
>
> source: RIPE # Filtered
>
> % Information related to '81.194.43.0/24AS2200'
>
> route: 81.194.43.0/24
>
> descr: FR-U-PARIS13-VILLETANEUSE
>
> origin: AS2200
>
> mnt-by: RENATER-MNT
>
> source: RIPE # Filtered
>
> % Information related to '81.194.0.0/16AS2200'
>
> route: 81.194.0.0/16
>
> descr: RENATER
>
> origin: AS2200
>
> mnt-by: RENATER-MNT
>
> source: RIPE # Filtered
>
> *From:* Todd Chapman 
> [mailto:]
> *Sent:* Wednesday, June 11, 2008 12:16 PM
> *To:* 
>
> *Subject:* Another SAP Storm?
>
> We just got hit with a SAP storm from 81.194.43.1. ARIN reports that 
> this is someone from the RIPE network. Anyone else see this?
>
> Todd Chapman
>
> Network Operations Center
>
> UC Davis