All things related to multicast

[Leonard Giuliano <>]

Anyone notice a large rate of SAP packets the last few days?  Have seen 
spikes up to 20Mbps of SAP.  Here's a packet from a flow seen during one 
of the spikes.  Looks like the culprit is 131.252.176.85:



No.     Time        Source                Destination           Protocol Info
      1 0.000000    131.252.176.85        224.2.127.254         SAP/SDP  
Announcement (v1), with session description

Frame 1 (240 bytes on wire, 240 bytes captured)
    Arrival Time: Mar 19, 2010 12:02:05.711826000
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 240 bytes
    Capture Length: 240 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:ip:udp:sap:sdp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Internet Protocol, Src: 131.252.176.85 (131.252.176.85), Dst: 224.2.127.254 
(224.2.127.254)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 226
    Identification: 0x4634 (17972)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 243
    Protocol: UDP (0x11)
    Header checksum: 0xec83 [correct]
        [Good: True]
        [Bad : False]
    Source: 131.252.176.85 (131.252.176.85)
    Destination: 224.2.127.254 (224.2.127.254)
User Datagram Protocol, Src Port: rdrmshc (1075), Dst Port: sapv1 (9875)
    Source port: rdrmshc (1075)
    Destination port: sapv1 (9875)
    Length: 206
    Checksum: 0x5f28 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Session Announcement Protocol
    Flags: 0x20
        001. .... = Version Number: SAPv1 or later (1)
        ...0 .... = Address Type: IPv4
        .... 0... = Reserved: Not set
        .... .0.. = Message Type: Announcement
        .... ..0. = Encryption Bit: Payload not encrypted
        .... ...0 = Compression Bit: Payload not compressed
    Authentication Length: 0
    Message Identifier Hash: 0x7db0
    Originating Source: 101.103.45.100
    Payload type: application/sdp
Session Description Protocol
    Session Description Protocol Version (v): 0
    Owner/Creator, Session Id (o): - 33390000 3819 IN IP4 131.252.176.85
        Owner Username: -
        Session ID: 33390000
        Session Version: 3819
        Owner Network Type: IN
        Owner Address Type: IP4
        Owner Address: 131.252.176.85
    Session Name (s): PSU Channel 1 - HD 720p
    Connection Information (c): IN IP4 233.78.176.65
        Connection Network Type: IN
        Connection Address Type: IP4
        Connection Address: 233.78.176.65
    Time Description, active time (t): 0 0
        Session Start Time: 0
        Session Stop Time: 0
    Session Attribute (a): tool:vlc 0.8.6f
        Session Attribute Fieldname: tool
        Session Attribute Value: vlc 0.8.6f
    Session Attribute (a): recvonly
    Session Attribute (a): type:broadcast
        Session Attribute Fieldname: type
        Session Attribute Value: broadcast
    Media Description, name and address (m): video 1111 udp 33
        Media Type: video
        Media Port: 1111
        Media Protocol: udp
        Media Format: 33

0000  01 00 5e 02 7f fe 00 12 1e 2b f4 00 08 00 45 00   ..^......+....E.
0010  00 e2 46 34 00 00 f3 11 ec 83 83 fc b0 55 e0 02   ..F4.........U..
0020  7f fe 04 33 26 93 00 ce 5f 28 20 00 7d b0 65 67   ...3&..._( .}.eg
0030  2d 64 61 70 70 6c 69 63 61 74 69 6f 6e 2f 73 64   -dapplication/sd
0040  70 00 76 3d 30 0d 0a 6f 3d 2d 20 33 33 33 39 30   p.v=0..o=- 33390
0050  30 30 30 20 33 38 31 39 20 49 4e 20 49 50 34 20   000 3819 IN IP4 
0060  31 33 31 2e 32 35 32 2e 31 37 36 2e 38 35 0d 0a   131.252.176.85..
0070  73 3d 50 53 55 20 43 68 61 6e 6e 65 6c 20 31 20   s=PSU Channel 1 
0080  2d 20 48 44 20 37 32 30 70 0d 0a 63 3d 49 4e 20   - HD 720p..c=IN 
0090  49 50 34 20 32 33 33 2e 37 38 2e 31 37 36 2e 36   IP4 233.78.176.6
00a0  35 0d 0a 74 3d 30 20 30 0d 0a 61 3d 74 6f 6f 6c   5..t=0 0..a=tool
00b0  3a 76 6c 63 20 30 2e 38 2e 36 66 0d 0a 61 3d 72   :vlc 0.8.6f..a=r
00c0  65 63 76 6f 6e 6c 79 0d 0a 61 3d 74 79 70 65 3a   ecvonly..a=type:
00d0  62 72 6f 61 64 63 61 73 74 0d 0a 6d 3d 76 69 64   broadcast..m=vid
00e0  65 6f 20 31 31 31 31 20 75 64 70 20 33 33 0d 0a   eo 1111 udp 33..