All things related to multicast

["Brown, Robin" <>]

Same here:

Top 10     IP Addr ordered by packets:
Date first seen          Duration Proto          IP Addr    Flows
Packets    Bytes      pps      bps   bpp
2008-06-25 18:19:28.831  1230.169 any      224.2.127.254     1632  144.2
M   38.6 G   122887  256.9 M   274
2008-06-25 18:19:57.955  1201.045 any      142.104.22.43       40  144.1
M   38.6 G   125850  263.1 M   274

SAP storm from the University of Victoria BC Canada this time.  Hmmm,
MiniSAP server?

-Robin


 

-----Original Message-----
From: Bill Owens 
[mailto:]
 
Sent: Wednesday, June 25, 2008 7:05 PM
To: 

Cc: 

Subject: Huge multicast spike just now?

We just had a very large traffic spike (~300 Mbps) that saturated the
connections for three NYSERNet sites. I can't tell for certain what it
was; by the time I got to look at the network, it had passed. However,
circumstantial evidence seems to point to multicast:

 - all three sites are active multicast users
 - two of the three sites have had a history of SAP problems
 - Internet2 saw the same traffic at their PAIX multicast peering

The traffic came to us across our peering connection with CA*net4 in
Toronto. According to I2's high-resolution graphs, it ran from 2218 to
2241 UTC, hitting 316 Mbps. Unfortunately I don't have NetFlow stats for
the peering connection to CANARIE. Did anybody else see it, and perhaps
capture the source?

Bill.