All things related to multicast

["Phil Palanchi" <>]

We messed up the rpf for this source on the cisco by using

"ip mroute 81.194.43.1 255.255.255.255 null0"

 

Seems to work very well.

 

Thanks,

Phil

---

From: [mailto:]
Sent: Wednesday, June 11, 2008 3:15 PM
To:
Cc: Chris Robb; Taylor, Scott J.;
Subject: Re: Another SAP Storm?

Here you go....

[edit]
admin@L3-XX-XXXXXX#

set protocols sap disable

It should be off by default...


Thanks
Anand

Chris Spears <>

06/11/2008 03:03 PM

Please respond to

To	Chris Robb <>
cc	"Taylor, Scott J." <>,
Subject	Re: Another SAP Storm?

Oddly, it never hit our control-plane filters (or the PFE was too busy
to report it).

Anyone have a good way to mitigate the effects of this on JUNOS?

Chris

--

%%%%%%%%%%%%%%%%%%%%%%%%%%%
Chris Spears, OSCnet
Senior Routing Engineer
phone: 614-292-9415
fax: 614-728-8110



Chris Robb wrote:
> Hi folks:
>
> Just a heads up that the Internet2 NOC is working to mitigate this storm
> by filtering the SAP announcements at all ingress points. We have
> several cases of networks that have torn down their peering with us
> because the storm is adversely affecting the performance of their border
> equipment.
>
> -Chris
>
> On Jun 11, 2008, at 2:27 PM, Taylor, Scott J. wrote:
>
>> Here is what we’re seeing from Universite Paris.  Do the high pps and
>> kbps rates indicate that maybe they are accidently trying to source
>> video/audio on the SAP group?  We aren’t seeing any performance issues
>> here just a little uptick in traffic.
>>
>> sh ip mroute active
>> Active IP Multicast Sources - sending >= 4 kbps
>>  a negative (-) Rate counts pps being fast-dropped
>>
>> Group: 224.2.127.254, (SAP.MCAST.NET)
>>    Source: 81.194.43.1 (?)
>>      Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484
>> kbps(life avg)
>>
>> Thanks,
>>
>> Scott J. Taylor
>> Network Technician
>> Connecticut Education Network
>> University of Connecticut
>> Tel: 860/622.2242
>> Helpdesk: 860/622.2300
>>
>> From: McCurry, Barry A [mailto:]
>> Sent: Wednesday, June 11, 2008 13:30
>> To: Todd Chapman;
>> Subject: RE: Another SAP Storm?
>>
>> Here is the offending party
>>
>> Viva la France!
>>
>> inetnum:        81.194.43.0 - 81.194.43.255
>> netname:        FR-U-PARIS13-VILLETANEUSE
>> descr:          Universite Paris13
>> country:        FR
>> admin-c:        JFF1-RIPE
>> tech-c:         JFF1-RIPE
>> status:         ASSIGNED PA
>> mnt-by:         RENATER-MNT
>> source:         RIPE # Filtered
>>
>> irt:          IRT-CERT-Renater
>> address:      c/o ENSAM
>> address:      151 boulevard de l'H.pital
>> address:      75013 Paris
>> address:      France
>> phone:        +33 1 5394 2044
>> fax-no:       +33 1 5394 2031
>> e-mail:      
>> signature:    PGPKEY-D754E8CD
>> encryption:   PGPKEY-D754E8CD
>> admin-c:      TI123-RIPE
>> tech-c:       TI123-RIPE
>> auth:         PGPKEY-D754E8CD
>> remarks:      http://www.trusted-introducer.org/teams/cert-renater.html
>> remarks:      This is an accredited IRT (level 2)
>> irt-nfy:      
>> mnt-by:       TRUSTED-INTRODUCER-MNT
>> source:       RIPE # Filtered
>>
>> person:         Jean-Francois Florence
>> address:        CRI Universite Paris13
>> address:        99 Avenue J.B Clement
>> address:        93430 Villetaneuse
>> e-mail:        
>> phone:          +33 1 49 40 30 68
>> fax-no:         +33 1 48 22 81 50
>> mnt-by:         RENATER-MNT
>> nic-hdl:        JFF1-RIPE
>> source:         RIPE # Filtered
>>
>> % Information related to '81.194.43.0/24AS2200'
>>
>> route:          81.194.43.0/24
>> descr:          FR-U-PARIS13-VILLETANEUSE
>> origin:         AS2200
>> mnt-by:         RENATER-MNT
>> source:         RIPE # Filtered
>>
>> % Information related to '81.194.0.0/16AS2200'
>>
>> route:          81.194.0.0/16
>> descr:          RENATER
>> origin:         AS2200
>> mnt-by:         RENATER-MNT
>> source:         RIPE # Filtered
>>
>>
>> From: Todd Chapman [mailto:]
>> Sent: Wednesday, June 11, 2008 12:16 PM
>> To:
>> Subject: Another SAP Storm?
>>
>> We just got hit with a SAP storm from 81.194.43.1. ARIN reports that
>> this is someone from the RIPE network. Anyone else see this?
>>
>> Todd Chapman
>> Network Operations Center
>> UC Davis
>>
>
> Chris Robb, Manager of Operations
> Internet2
> Office: 812.855.8604
> Cell: 812.345.3188
> Twitter Feed: http://www.twitter.com/chrobb
> ****************
> Internet2 Workshops
> Hands-on. Brains-on.
> http://www.internet2.edu/workshops/
>