All things related to multicast

[Chuck Anderson <>]

On Fri, Feb 13, 2009 at 12:25:43PM -0500, Taylor, Scott J. wrote:
> We are seeing a noticeable multicast group count increase this morning.
> It looks like the group 224.9.9.9 accounts for most of the increase.
> 
> Are other people seeing this group and these sources or are you dropping
> these at your edge?  From what I found it looks like this group is
> likely something to do with SQUID proxy configuration and not legitimate
> traffic that users on our network would be interested in.

I'm applying the Secure Multicast Template:

http://aharp.ittns.northwestern.edu/papers/mcast-template.html

I'm also additionally dropping all control plane (PIM, MSDP) traffic 
for IANA-reserved groups and my RP isn't configured for these groups 
either:

http://www.iana.org/assignments/multicast-addresses

        route-filter 224.1.0.0/16 orlonger;
        route-filter 224.3.0.0/16 orlonger;
        route-filter 224.4.0.0/14 orlonger;
        route-filter 224.8.0.0/13 orlonger;
        route-filter 224.16.0.0/12 orlonger;
        route-filter 224.32.0.0/11 orlonger;
        route-filter 224.64.0.0/10 orlonger;
        route-filter 224.128.0.0/9 orlonger;
        route-filter 225.0.0.0/8 orlonger;
        route-filter 226.0.0.0/7 orlonger;
        route-filter 228.0.0.0/6 orlonger;
        route-filter 234.0.0.0/7 orlonger;
        route-filter 236.0.0.0/6 orlonger;

It looks like there have been some new assignments in some of these 
ranges I'll have to take a look at, but I doubt these are necessary 
for general use:

224.3.0.0 - 224.3.0.63 Nasdaqmdfeeds  (re-new/March 2003)  [Nelson]
224.4.0.0-224.4.0.255  London Stock Exchange           [Whitehouse]  31 March 
2006
224.4.1.0-224.4.1.255  London Stock Exchange             [Saunders]  25 
February 2008
224.4.2.0-224.4.2.255  London Stock Exchange             [Saunders]  29 
February 2008
224.4.3.0-224.4.4.255  London Stock Exchange             [Saunders]  24 
December 2008
224.252.000.000-224.255.255.255 DIS Transient Groups         [IANA]