All things related to multicast

[Bill Owens <>]

We just had a very large traffic spike (~300 Mbps) that saturated the 
connections for three NYSERNet sites. I can't tell for certain what it was; 
by the time I got to look at the network, it had passed. However, 
circumstantial evidence seems to point to multicast:

 - all three sites are active multicast users
 - two of the three sites have had a history of SAP problems 
 - Internet2 saw the same traffic at their PAIX multicast peering

The traffic came to us across our peering connection with CA*net4 in Toronto. 
According to I2's high-resolution graphs, it ran from 2218 to 2241 UTC, 
hitting 316 Mbps. Unfortunately I don't have NetFlow stats for the peering 
connection to CANARIE. Did anybody else see it, and perhaps capture the 
source?

Bill.