All things related to multicast

[Tim Peiffer <>]

Tim Peiffer wrote:
> Another sap storm seems to have shown up recently, with a different 
> source than previously advertised. Both the packet and bit rate appear 
> to be pretty interesting.
>
> Group: 224.2.127.254, (SAP.MCAST.NET)
> Source: 64.65.64.70 (hayakawa.lava.net)
> Rate: 7 pps/24 kbps(1sec), 24 kbps(last 10 secs), 3 kbps(life avg)
Ish..  I guess I missed that the problem was the second source..

I am sorry..
Regards,
Tim

> Source: 81.194.43.1 (?)
> Rate: 16711 pps/43716 kbps(1sec), 43716 kbps(last 30 secs), 32472 
> kbps(life avg)
>
> whois -h whois.arin.net 64.65.64.70
> [Querying whois.arin.net]
> [Redirected to rwhois.lava.net]
> [Querying rwhois.lava.net]
> [Unable to connect to remote host]
>
> Regards,
> Tim Peiffer
> Networking and Telecommunications Services
> University of Minnesota/NorthernLights GigaPOP
>
> Taylor, Scott J. wrote:
> > Here is what we’re seeing from Universite Paris. Do the high pps and 
> > kbps rates indicate that maybe they are accidently trying to source 
> > video/audio on the SAP group? We aren’t seeing any performance issues 
> > here just a little uptick in traffic.
> >
> > sh ip mroute active
> >
> > Active IP Multicast Sources - sending >= 4 kbps
> >
> > a negative (-) Rate counts pps being fast-dropped
> >
> > Group: 224.2.127.254, (SAP.MCAST.NET)
> >
> > Source: 81.194.43.1 (?)
> >
> > Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484 
> > kbps(life avg)
> >
> > Thanks,
> >
> > Scott J. Taylor
> >
> > Network Technician
> >
> > Connecticut Education Network
> >
> > University of Connecticut
> >
> > Tel: 860/622.2242
> >
> > Helpdesk: 860/622.2300
> >
> > *From:* McCurry, Barry A 
> > [mailto:]
> > *Sent:* Wednesday, June 11, 2008 13:30
> > *To:* Todd Chapman; 
> >
> > *Subject:* RE: Another SAP Storm?
> >
> > Here is the offending party
> >
> > Viva la France!
> >
> > inetnum: 81.194.43.0 - 81.194.43.255
> >
> > netname: FR-U-PARIS13-VILLETANEUSE
> >
> > descr: Universite Paris13
> >
> > country: FR
> >
> > admin-c: JFF1-RIPE
> >
> > tech-c: JFF1-RIPE
> >
> > status: ASSIGNED PA
> >
> > mnt-by: RENATER-MNT
> >
> > source: RIPE # Filtered
> >
> > irt: IRT-CERT-Renater
> >
> > address: c/o ENSAM
> >
> > address: 151 boulevard de l'H.pital
> >
> > address: 75013 Paris
> >
> > address: France
> >
> > phone: +33 1 5394 2044
> >
> > fax-no: +33 1 5394 2031
> >
> > e-mail: 
> >
> >  
> > <mailto:>
> >
> > signature: PGPKEY-D754E8CD
> >
> > encryption: PGPKEY-D754E8CD
> >
> > admin-c: TI123-RIPE
> >
> > tech-c: TI123-RIPE
> >
> > auth: PGPKEY-D754E8CD
> >
> > remarks: http://www.trusted-introducer.org/teams/cert-renater.html
> >
> > remarks: This is an accredited IRT (level 2)
> >
> > irt-nfy: 
> >
> >  
> > <mailto:>
> >
> > mnt-by: TRUSTED-INTRODUCER-MNT
> >
> > source: RIPE # Filtered
> >
> > person: Jean-Francois Florence
> >
> > address: CRI Universite Paris13
> >
> > address: 99 Avenue J.B Clement
> >
> > address: 93430 Villetaneuse
> >
> > e-mail: 
> >
> >  
> > <mailto:>
> >
> > phone: +33 1 49 40 30 68
> >
> > fax-no: +33 1 48 22 81 50
> >
> > mnt-by: RENATER-MNT
> >
> > nic-hdl: JFF1-RIPE
> >
> > source: RIPE # Filtered
> >
> > % Information related to '81.194.43.0/24AS2200'
> >
> > route: 81.194.43.0/24
> >
> > descr: FR-U-PARIS13-VILLETANEUSE
> >
> > origin: AS2200
> >
> > mnt-by: RENATER-MNT
> >
> > source: RIPE # Filtered
> >
> > % Information related to '81.194.0.0/16AS2200'
> >
> > route: 81.194.0.0/16
> >
> > descr: RENATER
> >
> > origin: AS2200
> >
> > mnt-by: RENATER-MNT
> >
> > source: RIPE # Filtered
> >
> > *From:* Todd Chapman 
> > [mailto:]
> > *Sent:* Wednesday, June 11, 2008 12:16 PM
> > *To:* 
> >
> > *Subject:* Another SAP Storm?
> >
> > We just got hit with a SAP storm from 81.194.43.1. ARIN reports that 
> > this is someone from the RIPE network. Anyone else see this?
> >
> > Todd Chapman
> >
> > Network Operations Center
> >
> > UC Davis