All things related to multicast

[Pekka Savola <>]

On Wed, 11 Jun 2008 

 wrote:
> Here you go....
>
> [edit]
> admin@L3-XX-XXXXXX#
>
> set protocols sap disable
>
> It should be off by default...

That protects a particular router, but not downstream routers which have 
sap enabled.

We've for years now installed policers in our upstream/peering interfaces 
which rate-limit SAP to 1 mbit/s.  That has saved our and our customers' 
backsides a couple of times already -- without crippling the real use of 
SAP.

> Chris Spears 
> <>
> 06/11/2008 03:03 PM
> Please respond to
>
>
>
> To
> Chris Robb 
> <>
> cc
> "Taylor, Scott J." 
> <>,
>  
>
> Subject
> Re: Another SAP Storm?
>
>
>
>
>
>
> Oddly, it never hit our control-plane filters (or the PFE was too busy
> to report it).
>
> Anyone have a good way to mitigate the effects of this on JUNOS?
>
> Chris
>
> --
>
> %%%%%%%%%%%%%%%%%%%%%%%%%%%
> Chris Spears, OSCnet
> Senior Routing Engineer
> phone: 614-292-9415
> fax: 614-728-8110
>
>
>
> Chris Robb wrote:
> > Hi folks:
> >
> > Just a heads up that the Internet2 NOC is working to mitigate this storm
>
> > by filtering the SAP announcements at all ingress points. We have
> > several cases of networks that have torn down their peering with us
> > because the storm is adversely affecting the performance of their border
>
> > equipment.
> >
> > -Chris
> >
> > On Jun 11, 2008, at 2:27 PM, Taylor, Scott J. wrote:
> >
> > > Here is what we?re seeing from Universite Paris.  Do the high pps and
> > > kbps rates indicate that maybe they are accidently trying to source
> > > video/audio on the SAP group?  We aren?t seeing any performance issues
> > > here just a little uptick in traffic.
> > >
> > > sh ip mroute active
> > > Active IP Multicast Sources - sending >= 4 kbps
> > >  a negative (-) Rate counts pps being fast-dropped
> > >
> > > Group: 224.2.127.254, (SAP.MCAST.NET)
> > >    Source: 81.194.43.1 (?)
> > >      Rate: 16911 pps/44240 kbps(1sec), 44240 kbps(last 10 secs), 40484
> > > kbps(life avg)
> > >
> > > Thanks,
> > >
> > > Scott J. Taylor
> > > Network Technician
> > > Connecticut Education Network
> > > University of Connecticut
> > > Tel: 860/622.2242
> > > Helpdesk: 860/622.2300
> > >
> > > From: McCurry, Barry A 
> > > [mailto:]
> > > Sent: Wednesday, June 11, 2008 13:30
> > > To: Todd Chapman; 
> > >
> > > Subject: RE: Another SAP Storm?
> > >
> > > Here is the offending party
> > >
> > > Viva la France!
> > >
> > > inetnum:        81.194.43.0 - 81.194.43.255
> > > netname:        FR-U-PARIS13-VILLETANEUSE
> > > descr:          Universite Paris13
> > > country:        FR
> > > admin-c:        JFF1-RIPE
> > > tech-c:         JFF1-RIPE
> > > status:         ASSIGNED PA
> > > mnt-by:         RENATER-MNT
> > > source:         RIPE # Filtered
> > >
> > > irt:          IRT-CERT-Renater
> > > address:      c/o ENSAM
> > > address:      151 boulevard de l'H.pital
> > > address:      75013 Paris
> > > address:      France
> > > phone:        +33 1 5394 2044
> > > fax-no:       +33 1 5394 2031
> > > e-mail:       
> > >
> > > signature:    PGPKEY-D754E8CD
> > > encryption:   PGPKEY-D754E8CD
> > > admin-c:      TI123-RIPE
> > > tech-c:       TI123-RIPE
> > > auth:         PGPKEY-D754E8CD
> > > remarks:      http://www.trusted-introducer.org/teams/cert-renater.html
> > > remarks:      This is an accredited IRT (level 2)
> > > irt-nfy:      
> > >
> > > mnt-by:       TRUSTED-INTRODUCER-MNT
> > > source:       RIPE # Filtered
> > >
> > > person:         Jean-Francois Florence
> > > address:        CRI Universite Paris13
> > > address:        99 Avenue J.B Clement
> > > address:        93430 Villetaneuse
> > > e-mail:         
> > >
> > > phone:          +33 1 49 40 30 68
> > > fax-no:         +33 1 48 22 81 50
> > > mnt-by:         RENATER-MNT
> > > nic-hdl:        JFF1-RIPE
> > > source:         RIPE # Filtered
> > >
> > > % Information related to '81.194.43.0/24AS2200'
> > >
> > > route:          81.194.43.0/24
> > > descr:          FR-U-PARIS13-VILLETANEUSE
> > > origin:         AS2200
> > > mnt-by:         RENATER-MNT
> > > source:         RIPE # Filtered
> > >
> > > % Information related to '81.194.0.0/16AS2200'
> > >
> > > route:          81.194.0.0/16
> > > descr:          RENATER
> > > origin:         AS2200
> > > mnt-by:         RENATER-MNT
> > > source:         RIPE # Filtered
> > >
> > >
> > > From: Todd Chapman 
> > > [mailto:]
> > > Sent: Wednesday, June 11, 2008 12:16 PM
> > > To: 
> > >
> > > Subject: Another SAP Storm?
> > >
> > > We just got hit with a SAP storm from 81.194.43.1. ARIN reports that
> > > this is someone from the RIPE network. Anyone else see this?
> > >
> > > Todd Chapman
> > > Network Operations Center
> > > UC Davis
> >
> > Chris Robb, Manager of Operations
> > Internet2
> > Office: 812.855.8604
> > Cell: 812.345.3188
> > Twitter Feed: http://www.twitter.com/chrobb
> > ****************
> > Internet2 Workshops
> > Hands-on. Brains-on.
> > http://www.internet2.edu/workshops/